What is the Essential 8?

The Essential 8 is a set of eight baseline cyber security mitigation strategies recommended by the Australian Cyber Security Centre (ACSC) to protect organisations against the most common cyber threats.

How long does the Essential 8 audit take?

Our online Essential 8 self-assessment takes approximately 2 minutes. A full technical audit by our specialists typically takes 1–2 business days.

Is the Essential 8 mandatory in Australia?

The Essential 8 is mandatory for Australian Government agencies. For private businesses it is strongly recommended, and many industries and contracts now require Essential 8 compliance.

How much does managed IT support cost?

OzeIT's managed IT plans are tailored to each business's size and requirements. Contact us on 1300 780 588 for a free consultation and quote.

Is the Essential 8 audit really free?

Yes. OzeIT initial Essential 8 audit is completely free with no obligation. The 2-minute assessment gives an instant score and personalised recommendations.

How long does an Essential 8 audit take?

The online assessment takes about 2 minutes. A full technical assessment typically takes 1 to 2 business days.

Is Essential 8 compliance mandatory?

Essential 8 is mandatory for Australian government agencies and increasingly required for government contracts and cyber insurance.

Essential 8 Audit: Free Cyber Security Assessment

1

Application Control

Preventing unauthorised or malicious software from running on your systems.

We don't have controls over what software runs on our computers Staff can install any software they like without approval

We have some controls but they aren't consistently enforced There's a policy but staff can sometimes install software without approval

Software requires IT approval to install We maintain an approved list and unapproved software is blocked or reviewed

Only approved/whitelisted applications can run: anything else is blocked automatically Technically enforced application whitelisting is in place across all systems

Question 1 of 8

2

Patch Applications

Keeping software up to date to close known security vulnerabilities.

We update software when we notice it's out of date, or not at all No regular patching schedule exists

We try to patch monthly, but it's not always consistent Patches are applied eventually but may lag weeks or months behind release

Critical patches are applied within 2 weeks of release We track vendor patch releases and have a regular patching cadence

Critical patches are applied within 48 hours, automated and monitored Automated patching with vulnerability scanning and compliance reporting

Question 2 of 8

3

Microsoft Office Macro Settings

Macros in Word and Excel documents are one of the most common ways malware enters businesses.

We don't manage macro settings; they're at the default Staff can enable macros in any document without restriction

We've told staff not to enable macros from unknown sources Policy exists but is not technically enforced

Macros are blocked by default; only trusted/signed macros can run Group Policy or Intune enforces macro restrictions

Macros are fully locked down with digitally signed exceptions and logging Only specifically whitelisted macros can run, all attempts are logged

Question 3 of 8

4

User Application Hardening

Disabling risky browser and application features that attackers commonly exploit.

Default browser and application settings; we haven't hardened anything Flash, Java, and other plugins may still be enabled in browsers

We've done some hardening but it's inconsistent across devices Some browsers and devices are hardened but not all

Browsers are configured to block ads, scripts, and dangerous content types Flash/Java disabled, web content filtering in place

All applications are hardened using vendor security guides, enforced via policy CIS benchmarks or equivalent applied and monitored across all endpoints

Question 4 of 8

5

Restrict Administrative Privileges

Limiting who has admin rights to your systems, a critical control for stopping malware from spreading.

Most or all staff have administrator rights on their computers Staff can install software and change system settings freely

Only some staff have admin rights, but we haven't formally reviewed who has access Admin access has grown organically without a clear policy

Admin rights are restricted to IT staff only, reviewed at least annually Standard users cannot install software or change system settings

Privileged Access Management in place: admins use separate accounts, just-in-time access PAM solution enforced, all privileged activity is logged and reviewed

Question 5 of 8

6

Patch Operating Systems

Keeping Windows, macOS, and server operating systems updated to close vulnerabilities.

We have computers running older operating systems or haven't patched in months Some systems may be running Windows 7, Windows 10 EOL, or significantly outdated versions

All computers run supported OS versions but patching isn't always timely Updates happen but may be weeks or months behind

OS patches are applied within 2 weeks of release across all systems Consistent patching schedule, all systems on supported versions

Critical OS patches deployed within 48 hours, automated, monitored, reported Automated deployment, vulnerability scanning, and compliance dashboard

Question 6 of 8

7

Multi-Factor Authentication

Requiring a second verification step for logins, the single most effective defence against account compromise.

We use passwords only, no MFA anywhere Email, cloud services, and remote access protected by password only

MFA is optional or only enabled for some accounts/services Some staff have MFA but it's not enforced or consistent

MFA is enforced for email, cloud services (Microsoft 365 / Google), and remote access All staff must use MFA for critical business systems

MFA enforced everywhere, including phishing-resistant methods (hardware keys or passkeys) Conditional access policies, hardware tokens or FIDO2, all systems covered

Question 7 of 8

8

Regular Backups

Ensuring your business data can be recovered quickly after ransomware, accidental deletion, or disaster.

We don't have reliable backups, or we're not sure if they work If ransomware hit today, we'd likely lose significant data

We back up occasionally, but haven't tested recovery Backups exist but we've never verified they actually work

Daily backups to an offsite or cloud location; we've tested restoring Regular automated backups with at least annual recovery testing

3-2-1 backup strategy, immutable backups, regular tested recovery, documented RTO/RPO Backups are isolated from the main network (ransomware-proof), quarterly recovery drills

Question 8 of 8

Your results are ready!

Enter your details below to see your Essential 8 score and personalised recommendations. We'll also send a copy to your email.

Your Name *

Work Email *

Business Name *

Phone Number

Number of Staff

Your information is kept private and will never be shared with third parties. By submitting you agree to be contacted by OzeIT about your results. Privacy Policy

Essential 8 Security Audit