Cloud security · free self-check
How does your business score on the Essential Eight?
The Essential Eight is the Australian government’s baseline for cyber resilience — but most guides explain it for a security team a small business doesn’t have. Answer 24 plain-English questions for a real maturity read in about five minutes: a score out of 100, the weakest control holding you back, and where to start. No signup.
The Essential Eight is only as strong as its weakest control — you’re assessed at the lowest level you reach across all eight strategies, not the average. This check scores each strategy and shows you the one holding your whole baseline back, plus where to start.
What the Essential Eight actually is
The Essential Eight is a set of eight baseline strategies from the ACSC that, together, stop the large majority of common attacks: controlling what software can run, patching applications and operating systems, locking down Office macros and browsers, restricting admin rights, enforcing multi-factor authentication, and keeping tested backups. It’s deliberately a minimum — the floor, not the ceiling — and the first few controls are exactly where small businesses are most exposed. If you want the bigger picture, see our cloud security work.
How maturity is actually scored
This is where most self-assessments mislead you. The ACSC scores maturity on a weakest-link basis — your overall level is the lowest level you reach across all eight strategies, not the average. Seven strong controls and one weak one still leaves you at the weak one. That’s why this check reports your weakest strategy as the headline: lifting your lowest controls is what actually moves your maturity, and polishing the ones already in place doesn’t.
Where to start if you’re near zero
Multi-factor authentication and backups first. MFA is the single highest-impact control a small business can turn on, and it’s free on most Microsoft 365 and Google Workspace plans — start with email, then remote access. For the identity and Microsoft 365 side specifically, our free M365 security check goes deeper than this breadth-level self-check does. Then get automatic, tested, protected backups in place so a ransomware hit can’t take everything.
Isn’t the Essential Eight being retired?
You may have seen the news: in June 2026 the Australian Signals Directorate confirmed a staged move from the Essential Eight to a new outcomes-based “Essentials” series, phased in over roughly two years. It doesn’t change what you should do now. The Essential Eight is still the current, supported baseline, it’s still what tenders, contracts and cyber insurers measure against, and the work you do against it is expected to carry across to the new series. So this check stays a useful read of where you stand today.
Built for Brisbane and Queensland small business
SecureLoop is a Brisbane-based cloud security and AI automation practice for Australian small business — the 5-to-20 person firm with no dedicated IT team. If your result shows gaps you’d rather not tackle alone, we help close them at a fixed price, in plain English. Book a free 30-minute walkthrough and we’ll talk through your score.