Essential Eight Maturity Assessment for Australian SMBs
Self-assess against the ACSC Essential Eight framework. Get your Essential Eight readiness score, gap report and remediation roadmap in minutes. Free assessment, no account required.
What is the ACSC Essential Eight?
The Essential Eight is Australia's baseline cybersecurity framework, developed by the Australian Signals Directorate (ASD) and recommended by the Australian Cyber Security Centre (ACSC). It covers eight mitigation strategies across application control, patch management, multi-factor authentication, and more.
Compliance is mandatory for Commonwealth agencies and increasingly required by government contractors, enterprise clients, and cyber insurers. The EssentialScore assessment is a self-assessment across the eight mitigation strategies. It gives you a readiness score and a band (Initial, Developing, Managed or Optimised). It does not issue an ASD Maturity Level rating, which requires a formal assessment against the Maturity Model.
Pricing
Essential Eight Assessment Pricing
for 24/7 monitoring and remediationSelf-assessment
Full 74-question Essential Eight assessment with an instant readiness score across all eight mitigation strategies.
- 74-question assessment
- Readiness score for all eight strategies
- Top gaps identified
- Summary PDF, no account required
14 policies and the full report
Fourteen Essential Eight policies written from your answers, plus the full gap report with a prioritised remediation roadmap.
- 14 policies generated from your gaps
- Word and PDF, fully editable
- Full control-by-control gap report
- Prioritised remediation roadmap
Free assessment first, pay only when you want the report.
All prices are in Australian dollars and include GST. One-time payments, no subscription.
Case study
Essential Eight ML2 achieved in 6 weeks
An Australian professional services firm with 80 staff used EssentialScore to self-assess against the Essential Eight ahead of a client security audit. They generated their gap report, followed the built-in remediation roadmap, and achieved Maturity Level 2 within 6 weeks.
Ready to assess your Essential Eight compliance?
74 questions. Free. No account required.
Essential Eight Assessment FAQs
What is the Essential Eight?
The Essential Eight is a set of eight cybersecurity mitigation strategies developed by the ASD and recommended by the ACSC. It is the baseline standard for Australian organisations and is widely used by businesses, insurers, and auditors to measure cyber maturity.
Is the Essential Eight assessment free?
Yes. The 74-question assessment is completely free. No account required. You get your readiness score and top gaps instantly. The paid options are the downloadable gap report ($99) and the policy template bundle ($99).
What Maturity Level should I be aiming for?
Maturity Level One is a common starting point, and it is mandatory only where a contract, regulator or government requirement says so. What you need depends on your risk, your clients and your obligations. The assessment shows where you stand against each strategy so you can decide. It addresses the most critical attack vectors. ML2 is required for organisations working with sensitive client data. ML3 is the top tier and typically required for critical infrastructure.
How long does it take to complete the assessment?
Most users complete the 74-question assessment in 15 to 20 minutes. Questions are plain English, no deep technical knowledge required. Your IT manager, operations lead, or business owner can answer them.
Do Australian SMBs have to comply with the Essential Eight?
The Essential Eight is mandatory for Commonwealth agencies and increasingly required by government contractors. The ACSC strongly recommends it for all Australian SMBs as the baseline for cyber resilience and it is referenced by most Australian cyber insurers.
What do I get with the paid gap report?
The $99 gap report is a downloadable PDF and Word document showing your score across all 8 controls, the specific gaps behind your score, and a prioritised remediation roadmap, designed to share with your board, auditor, or cyber insurer.