---
title: "Essential Eight self-assessment checklist and tool | CCP"
description: "Eight plain-English questions, one per control. Get your estimated Essential Eight maturity level (ML0 to ML3) and a PDF for your board or broker. No email."
url: "https://ccp.com.au/resources/essential-eight-checklist/"
---

# Essential Eight self-assessment checklist

## Your maturity level, in eight questions.

The Essential Eight is the Australian Government’s list of eight controls that stop most cyber attacks. Answer one question for each control. You get your estimated maturity level and a PDF for your board, broker or auditor.

At a glance

Questions

Eight, one for each control

Time

About 10 minutes

You get

Your level, ML0 to ML3, and a PDF

Your data

Stays in your browser. No email

## Essential Eight questions in plain English

### Answer for what is in place today.

Each question tells you what the control is before it asks. If you do not know an answer, pick “Not sure”. Open “Help me answer” for the question to ask your IT provider.

## How Essential Eight maturity is scored

### The same rules an auditor uses, without the evidence.

The Essential Eight is a set of eight security controls from the Australian Signals Directorate (ASD). ASD measures each control at a maturity level from ML0 to ML3. This check uses ASD’s November 2023 model.

1.  01

    #### Answer for today

    Pick the answer that is true now, not the answer that you plan for. If a control is only on some computers, pick the lower answer.

2.  02

    #### Your lowest control sets your level

    Your overall level is your lowest control, not the average. If seven controls are at ML2 and one is at ML0, you are at ML0. ASD scores the Essential Eight this way.

3.  03

    #### Take the PDF with you

    Download your level and a result for each control. Give it to your board, your insurance broker or your auditor. Your device makes the PDF from your answers.

4.  04

    #### Evidence is the real test

    An auditor, insurer or regulator checks documents and tests the controls. They do not use your own answers, so their result can be lower than this one.

## Essential Eight self-assessment FAQs

### Common questions.

Something not covered? Call [(08) 9467 2269](tel:+61894672269) and ask an engineer.

### What is the Essential Eight?

The Essential Eight is a list of eight security controls from the Australian Signals Directorate (ASD). Together they stop most common cyber attacks on Australian businesses. [Read about each control](https://ccp.com.au/essential-eight/).

### Does anything I enter leave my browser?

No. Your device handles the questions, your answers and the PDF. Nothing goes to CCP, and you do not give an email address.

### Is this an official Essential Eight assessment?

No. This check uses only your own answers. A formal assessment checks documents and tests that each control works. We do the formal assessment as part of our [compliance service](https://ccp.com.au/services/compliance/).

### I do not know some of the answers. What do I do?

Pick “Not sure”. The check counts it as ML0. Each question has a “Help me answer” panel with the question to ask your IT provider. Ask them, then do the check again.

### Why is my overall level my lowest score?

Because ASD scores it that way. An attacker uses the weakest control, so strong scores on other controls do not raise your level.

### Which maturity level should we aim for?

Most cyber insurance renewals and corporate client audits now expect Maturity Level 1 (ML1). Regulated clients and some insurers now ask for ML2. Most mid-sized businesses do not need ML3. [Compare the maturity levels](https://ccp.com.au/essential-eight/#maturity).

### We scored ML0. Where do we start?

Start with your lowest control. Close its gaps to ML1 and keep them closed. Then move to the next control. For help with the order, book the free risk review below.