ESSENTIAL EIGHT
Essential Eight Assessment Tool — Maturity in Minutes
Map your current and target ACSC Essential Eight maturity, get a prioritised uplift plan, and generate a board-ready posture report — without spinning up a four-week engagement.
WHY IT MANAGERS, CISOS AND SECURITY ANALYSTS IN AUSTRALIAN ORGANISATIONS CHOOSE FORTE/CYBERx
Decisions that hold up under scrutiny.
Maturity Level 0–3 in one mission
Score each of the eight strategies against the latest ACSC maturity model and see the realistic gap to your target.
Prioritised uplift plan
Get a sequence of mitigations ordered by risk reduction, effort and cost — not just a static checklist.
Board-ready posture report
BLUF, traffic-light heatmap and quarterly trend — formatted for the audit-and-risk committee.
TRY IT NOW
Bring one real decision. Get three defensible options.
The council returns a board-ready BLUF and three strategic options in under 60 seconds.
DECISIONS THE COUNCIL HANDLES
Sized for the conversation you're already having.
Pick a starting point or describe your decision in your own words. FORTE/CYBERx returns three strategic options with trade-offs, framework anchors and an execution-ready plan.
Where are we today vs ML1 / ML2 / ML3?
A defensible self-assessment that maps to the ASD ISM and Essential Eight Maturity Model.
What do we fix first?
Top five mitigations sorted by risk-reduction per dollar — not just patching first because it is easy.
How much will ML2 cost us?
A defensible budget shape for the uplift programme with optional managed-service comparison.
Are we eligible for federal contracts?
Map your maturity to the procurement requirements government and prime contractors increasingly enforce.
Quarterly board update on Essential Eight
Auto-generated trend and gap report ready to drop into the next board pack.
QUESTIONS
FAQ
Is this a self-assessment or a third-party audit?
Self-assessment. It gives you a defensible, framework-anchored view of your Essential Eight posture you can take to the board and use to scope a formal assessment with an IRAP assessor when needed.
Do you cover all four mitigation strategy groupings?
Yes — application control, patch applications, configure MS Office macros, user application hardening, restrict admin privileges, patch operating systems, multi-factor authentication and regular backups.
Will the output map to ISO 27001:2022 controls?
Yes. Each Essential Eight strategy is cross-walked to the relevant Annex A 8.x controls so a single uplift plan satisfies both frameworks.
How often should we re-run the assessment?
Quarterly is the cadence most boards expect. The tool stores prior runs so trend lines show up automatically.
Run your first mission free.
Two free missions. No credit card. Average mission resolves in under 60 seconds.