Drag
loader

Contact info

Email
hello@ferressystems.com.au
Based in
Melbourne, Victoria

Follow us

Talk to the team
Talk to the team
// FREE READINESS CHECKLIST

Where do you actually stand on the Essential Eight?

Eight controls, a count of what you report in place, and a list of the gaps with a first step for each. About a minute, no email, no form, and nothing is stored anywhere. It is a starting point if an insurer or a customer has started asking and you are not sure what to tell them. It is not a maturity rating.

1 minuteTo complete Nothing storedRuns in your browser No emailThere is no form at the end
// ESSENTIAL EIGHT READINESS CHECKLIST

Which of the Essential Eight do you have in place?

Eight baseline controls from the Australian Signals Directorate, and the ones insurers and larger customers tend to ask about. Mark each one honestly, including Not sure, and see what you report in place and where the gaps are. It takes a minute, and nothing is stored.

01. Application control Only approved applications can run.
02. Patch applications Known vulnerabilities are patched quickly.
03. Configure Office macros Macros are restricted and controlled.
04. User application hardening Browsers and apps are locked down.
05. Restrict admin privileges Admin access is limited and reviewed.
06. Patch operating systems Operating systems are kept current.
07. Multi-factor authentication MFA protects logins and remote access.
08. Regular backups Backups are taken, kept, and tested.
0 of 8 in place

Answer to begin

Nothing answered yet

Pick an answer for each of the eight. The count and the list of gaps update as you go.

This is a readiness checklist built from your own answers. It is not an ASD maturity rating, and it is not evidence for an insurer or an auditor.

Get the written action plan

Nothing here is stored. The written plan turns the gaps into what to fix and in what order. If you want your real environment checked, with evidence, rather than self-reported, that is the Security Baseline Assessment.

// WHAT THE CHECKLIST IS WORTH

A checklist is not a plan. Here is the next honest step.

Plenty of people take the gaps above and work on them themselves without ever speaking to us. That is a perfectly good outcome and the reason this asks for nothing.

Free, work email

The written action plan

Which two controls to move first for a business your size, a page on each of seven gaps, and what each one actually takes. Preview a real page before you give us anything.

See a page of it Free, work email

The evidence checklist

Knowing the Essential Eight is easy. Proving it is the part that eats a fortnight when an insurer asks. Per control: what evidence helps, where it lives, and what assessors reject.

See a page of it $495 + GST, fixed

Have us check it properly

Three business days of read-only access to your Microsoft 365 and Entra environment, assessed against the Essential Eight and ISO 27001, with the evidence behind each finding.

See what is included
// QUESTIONS, ANSWERED

Before you rely on the result

No. Nobody can give you a maturity level from eight questions, and this does not try. It is a readiness checklist: it counts the controls you report as in place and lists the rest as gaps. A maturity level depends on how each control is actually configured, measured against the specific requirements in ASD's Essential Eight Maturity Model, and ASD's guidance is that leaving out a mitigation strategy without suitable compensating controls can mean Maturity Level Zero overall. So the result here is not an ASD maturity rating, and it is not evidence for an insurer or an auditor. A real assessment looks at how your environment is configured rather than at how you remember it being configured, and the two disagree more often than people expect.

No. The whole thing runs in your browser. Nothing is sent anywhere, nothing is saved, and there is no form at the end. Close the tab and it is gone.

It is mandatory for most non-corporate Commonwealth entities and it is not law for private businesses. In practice it arrives through the side door anyway, through cyber insurance questionnaires, tenders and enterprise customer requirements, which is why most of the businesses we work with end up adopting it.

The Essential Eight explained in plain English

Start with the gaps list. Find out the Not sure answers first, because an answer you cannot back up counts for little when an insurer asks. Then there are two honest options. Work through the gaps yourself, which plenty of people do and which is a perfectly good outcome. Or, if you want the reasoning written out, the action plan sets out which two controls to move first for a business your size and what each one actually takes.

The written action plan

This checklist is your own view of your environment, given in a minute. The Security Baseline Assessment is our view of it, with evidence, after three business days of read-only access to your Microsoft 365 and Entra tenant. The gap between the two is usually the interesting part.

See the Security Baseline Assessment

Stop guessing on the renewal form.

Talk it through
Shapes Shapes