Policy and regulation
Free tool · Compliance readiness
Essential Eight self-score
Eight strategies, three levels, one question each. See the level each strategy self-scores at.
Runs in your browser. Nothing you enter is sent, stored or logged.
Essential Eight self-score
Patch applications
Level zeroPatches for the software you run, applied inside the windows the model sets.
Level one
Level two opens once the answer above is yes.
Patch operating systems
Level zeroPatches for the operating systems under it, with the same clock.
Level one
Level two opens once the answer above is yes.
Multi-factor authentication
Level zeroA second factor on every sign-in that matters, and a phishing-resistant one as you climb.
Level one
Level two opens once the answer above is yes.
Restrict administrative privileges
Level zeroAdmin rights that are asked for and approved, used from a separate environment, logged and reviewed.
Level one
Level two opens once the answer above is yes.
Application control
Level zeroOnly approved software runs, first on workstations, then on servers.
Level one
Level two opens once the answer above is yes.
Restrict Microsoft Office macros
Level zeroOffice macros off unless there is a business need, and signed before they run.
Level one
Level two opens once the answer above is yes.
User application hardening
Level zeroThe features attackers use and users do not, switched off in browsers, Office and PDF readers.
Level one
Level two opens once the answer above is yes.
Regular backups
Level zeroBackups that restore to one point in time and that no stolen account can delete.
Level one
Level two opens once the answer above is yes.
Self-score
Answer the level one questions to place each strategy.
0 of 8 open questions answered. A strategy self-scores at a level when its answer there and at every level below is yes; the organisation sits at its lowest strategy.
- Patch applications0/1Level zero
- Patch operating systems0/1Level zero
- Multi-factor authentication0/1Level zero
- Restrict administrative privileges0/1Level zero
- Application control0/1Level zero
- Restrict Microsoft Office macros0/1Level zero
- User application hardening0/1Level zero
- Regular backups0/1Level zero
What most raises the level
Application control to level one
Unanswered; 3 requirements at this level. The assessment
Multi-factor authentication to level one
Unanswered; 7 requirements at this level. The assessment
Patch applications to level one
Unanswered; 9 requirements at this level. The assessment
A self-score reads what you say is true today. Assessed maturity needs sighted evidence and tested controls across every workstation, server and account, which is engagement work. Model wording: Australian Signals Directorate, Essential Eight maturity model, November 2023 edition, CC BY 4.0.
Want the evidence-based version of this exercise?
Method
How this works
What it reads
- One yes, partly or no question per strategy per maturity level, 23 in all, each summarising what the level adds
- Behind each question, the requirements the ASD model first lists at that level, in its own wording with attribution
- The model’s rule: a strategy self-scores at a level when its answers there and at every level below are yes
- The organisation sits at its lowest strategy, partly counts as not met, and a level the model leaves unchanged is carried
Sources
- Australian Signals Directorate: Essential Eight maturity model, November 2023 edition. Retrieved 30 Oct 2026 (CC BY 4.0).
Version 2.0, 31 Oct 2026.
The questions and every ASD requirement as JSON, CC BY 4.0.
Limits
- A self-score reads what you say is true today.
- An assessment sights the evidence and tests the controls on every workstation, server and account.
- Answers stay in your browser; a share link carries them in the fragment, which a browser never sends.
- A new ASD edition is a new version of the questions; an older share link renders against its own version.
Where the engagement goes further
One question per strategy per level of the ASD Essential Eight maturity model, November 2023 edition, each summarising that level’s requirements with the ASD wording behind it. A strategy self-scores at a level when its answers there and below are yes; the organisation sits at its lowest strategy. An assessment sights the evidence and tests the controls.
Talk to us about the full versionShare
Cite this tool, or put it on your site
Cite this tool
A plain citation with the address and the version. Quote the result with the date you ran it.
Black Shard Pty Ltd (2026). Essential Eight self-score, version 2.0. https://blackshard.com.au/tools/essential-eight-check
Embed it
The frame renders the compact tool. The link under it is a real link on your page, so readers and search engines can follow it here.
Newsroom
Latest in compliance readiness
Free tools
More free tools
Breach remediation
Breach notification helper
Walk the Notifiable Data Breaches test the way the OAIC frames it.
Free, no sign-upOpen
Secure development
Security headers check
Paste your response headers. See at once which protections are missing.
Free, no sign-upOpen
Defensive and advisory
Breach cost estimator (Australia)
Your own figures beside the Australian averages, the OAIC breach counts and the Privacy Act maximums.
Free, no sign-upOpen
