Home / Resources / Essential Eight Maturity Level 2 self-check

Where do you sit against Maturity Level Two?

Sixteen questions, two per mitigation strategy, scored in your browser. Nothing is sent anywhere and no email is asked for.

Sorami Consulting built this self-check for the question a requester usually asks first: are you at Maturity Level Two. Sixteen questions, two per mitigation strategy, scored in your browser. The Essential Eight is scored per strategy, so your maturity level is the lowest strategy you can evidence, not the average of the eight.

Score yourself first

Where you sit against Maturity Level Two

Sixteen questions, two per mitigation strategy. Answer no if you cannot show the evidence today.

Patching

Do you patch critical internet-facing vulnerabilities within 48 hours of release?

Is every application other than browsers and office software scanned fortnightly and patched within a month?

Authentication and privilege

Is your multi-factor authentication phishing-resistant for staff logging into internal systems?

Are privileged accounts disabled after 45 days of inactivity and revalidated at least yearly?

Administration paths

Are administrative tasks performed through jump servers rather than from daily-use laptops?

Are break glass, local administrator and service account credentials long, unique and centrally managed?

Application control

Is application control enforced on internet-facing servers as well as workstations?

Is the Microsoft recommended application blocklist deployed and its ruleset reviewed each year?

Macros and application hardening

Are Office macros blocked from making Win32 API calls?

Are browsers, office suites and PDF software hardened to ASD and vendor guidance, with settings locked?

Logging and response

Are PowerShell and command line process creation events centrally logged and protected from deletion?

Are logs from internet-facing servers analysed promptly, with incidents reported and the response plan enacted?

Backups

Are privileged accounts other than backup administrators blocked from modifying or deleting backups?

Has a restore to a common point in time been tested in a disaster recovery exercise this year?

Coverage

Does your patching evidence cover developer laptops and not only servers?

Do the eight strategies cover your cloud workloads and not only the Microsoft 365 estate?

16 questions. Answer them all and your score appears here.

Nothing is sent anywhere. The scoring runs in your browser.

Self-assessment. Not an audit or an assessment against the ASD model.

If the result is useful, send us the answers and we will scope the assessment against them.

How it is scored

What each band means.

  • 0 to 5 yes. Maturity Level One is not complete yet.
  • 6 to 11 yes. Partway. Some strategies reach the second level.
  • 12 to 16 yes. Close to Maturity Level Two.

The model is scored per strategy, so your level is the lowest strategy you can evidence. What usually remains at the top band is evidence a requester will accept, per strategy and per system.

Scoring runs in your browser. Nothing is sent anywhere, no email is asked for, and there is no follow-up unless you start one.

Source. Questions are written against the ASD Essential Eight Maturity Model, November 2023 release, last updated 27 November 2023. The wording is ours; the requirements are the model's.

What this is not

The limits of a self-assessment

  • A self-assessment, not an assessment against the ASD model.
  • No ASD or government endorsement is implied.
  • Scored per strategy. Your level is the lowest strategy you evidence.
  • Answer no if the evidence does not exist today.

Two questions per strategy cannot cover every requirement in the model, so treat the result as an indication of where to look rather than a measurement. An intention is not a control.

Questions before you book

Practical answers.

Is this an Essential Eight assessment?

No. It is a self-assessment you score yourself, in your browser. An assessment against the ASD Essential Eight Maturity Model is engagement work that examines evidence per strategy and per system. Sorami is not an ASD-endorsed or IRAP provider.

Which version of the model is this written against?

The ASD Essential Eight Maturity Model, November 2023 release, last updated 27 November 2023. It remains the current published model.

Why two questions per strategy?

The model defines Maturity Level Two across eight strategies with several requirements each. Two questions per strategy is enough to show where to look and short enough that people finish it. It is an indicator, not a substitute for reading the model.

Is anything sent to Sorami?

No. The scoring runs in your browser and your answers stay on your device. If you want them looked at, you send them yourself.

If the result says the work is bigger than an afternoon, the Essential Eight assessment page sets out what an engagement actually covers. The other self-check is the SOC 2 readiness self-check, and every free artefact is listed on resources.

Let’s scope it

Want the answers looked at?

Send us your yes and no answers with the deadline you are working to. We will tell you what the distance means and what it would take to close it.

Request a quote

Last reviewed: