Where does your business stand on the Essential Eight?
A free Essential Eight self-assessment for Australian small businesses, written in plain English. Spend about 20 minutes on the questions and you get an indicative maturity snapshot across all eight ASD controls. It's the same framework insurers and big customers ask about.
Built for Australian
Progress saves automatically · Plain English, no jargon
08.
Controls assessed
~50.
Plain-English questions
~20.
Minutes to a snapshot
L0–3.
Maturity scale per control
Twenty minutes to a clear picture
- Step 1 / 3
Answer plain-English questions
About 50 questions across the eight controls: MFA, backups, patching, macros, admin rights and more. "Unsure" is a perfectly good answer.
- Step 2 / 3
See your maturity snapshot
You get an indicative Level 0–3 for each control and overall, assessed against the ASD Essential Eight Maturity Model (November 2023).
- Step 3 / 3
Know what to fix first
The snapshot points to the gaps holding your overall level down. That tells you where to spend your effort first.
Veritas Cyber · Diagnostics
Maturity snapshot
- 01Multi-factor authenticationL2
- 02Regular backupsL2
- 03Patch applicationsL1
- 04Patch operating systemsL1
- 05Restrict admin privilegesL1
- 06Office macro settingsL1
- 07User application hardeningL0
- 08Application controlL0
Sample values, for illustration only. Your snapshot reflects your own answers, and overall maturity follows your lowest control.
Four maturity levels, based on the ASD model
0.
Not implemented
Not implemented, or only done ad hoc.
1.
The baseline
The control is in place, but only partly and at a basic level.
2.
The common target
Systematically implemented and monitored. This is the usual small-business target.
3.
Advanced
Optimised, and continually improved over time.
All eight controls, in plain English
Each card opens a short guide. It covers what the control means, why brokers and insurers commonly ask about it, and what each maturity level involves.
Free to see where you stand
The self-assessment and maturity snapshot cost nothing. Subscribe when you want the documents that go with them.
Free
$0
The full self-assessment and your indicative maturity snapshot.
- Guided ~50-question self-assessment
- Indicative Level 0–3 for each control and overall
- Highlights the gaps holding your level down
- Progress saves as you go, and you can email yourself the results
StarterThe subscription
$99AUD / month
or $990/year (2 months free)
Your snapshot, turned into the documents brokers and insurers commonly ask for.
- Everything in Free
- Evidence Pack: your maturity summary plus the cyber-insurance readiness checklist, ready for your broker
- Incident Response Plan, a document insurers commonly ask about
- Remediation Roadmap: prioritised actions in plain English
- Five more security policies, from Information Security to Acceptable Use
- Documents regenerate whenever your answers change
- A read-only status link you can share with your broker
- Cancel any time from your billing page
Already assessed? Sign in
Pro
$199AUD / month
or $1,990/year (2 months free)
Everything in Starter, plus the Privacy Act and AI modules.
- Everything in Starter
- Privacy & Data Security Statement: the APP 11 "reasonable steps" story, written down
- Data Breach Response Plan, aligned to the Notifiable Data Breaches scheme
- Personal Information Inventory starter
- AI Use Policy, setting out the rules customers increasingly expect
Compliance Pack: $399 AUD, paid once
Rather not subscribe? Buy the same document pack once, generated from your current assessment.
Prices are in Australian dollars. Veritas Cyber is not registered for GST, so no GST is added: the price shown is the price you pay. Every document is generated from your own self-assessment answers. Veritas Cyber is not a certification, audit, or guarantee of security or insurance outcomes, and is not legal or insurance advice. You remain responsible for verifying and implementing the controls described.
Built for Australian small businesses
It's made for businesses of 5–50 people: trades, clinics, professional practices and online stores. If your insurer, broker or a big customer has asked about your cyber security, this is for you. You don't need a consultant, and nobody will ring you with a sales pitch.
- Facing a cyber insurance application or renewal questionnaire
- Asked by a customer or partner about your security posture
- Getting ahead of Privacy Act obligations for small businesses
- Wanting to find your gaps before someone else does
Not ready to assess? Grab the free checklist
A one-page Essential Eight checklist for Australian small businesses, in plain English. It covers the same eight controls insurers ask about. Print it, tick off what you already do, and you'll see where to focus next.
Frequently asked questions
No. Veritas Cyber is a self-assessment tool. You answer questions about your own business and we turn those answers into an indicative maturity snapshot. It is not a certification, audit or guarantee, and it is not legal or insurance advice.
The Essential Eight is a set of eight baseline mitigation strategies published by the Australian Signals Directorate (ASD). Each one is assessed at a maturity level from 0 to 3. Many Australian insurers and larger customers ask small businesses to show where they sit against it.
More and more Australian insurers ask applicants about controls like multi-factor authentication, backups and patching before they offer or renew cyber cover. A documented self-assessment helps you understand where you stand and talk it through with your broker. The insurer still makes its own decision.
No. The questions are written in plain English for business owners and office managers. Each one has a "why we ask" note showing the ASD criterion behind it. You can also answer "unsure": we treat that conservatively and flag it for follow-up.
Your answers stay in your browser while you work through the assessment. If you choose to email yourself the results, we store your email address and the level summary, and that is all. Never your detailed answers, and never any credentials or system data.
Know where you stand in about twenty minutes
It's free and written in plain English. Your answers stay in your browser until you decide otherwise.
Check your maturity for free