One verdict.
Eight strategies behind it.
Eightfold reads your evidence, assesses each of the eight strategies against its target, and reports the lowest of the eight as your overall level — never the average. It shows what's at target, what isn't, and exactly what's missing.
Essential Eight self-assessment · Cyber & internal IT
Interactive walkthrough — sample assessment
What it is
Assess your own posture, honestly.
Point Eightfold at your IT evidence — device management exports, security policies, patch and backup records — and it assesses each Essential Eight strategy against the level you're aiming for.
Get a report you can hand to an auditor.
An evidence-backed assessment, signed off inside your business, you can give to an external IT audit firm.
Works for assessors too.
An MSP or consultant can run the same assessment on a client's environment and issue the report under their own name.
Eight strategies
Assessed against the requirement, never averaged.
For every strategy, Eightfold shows three things: the evidence it found, what's missing, and what to do next.
The average is the comfortable lie.
Why the lowest, not the average.
Four of these eight strategies sit at ML2. Average them and you'd read ML1.5, round it up in the board pack, and get an unwelcome surprise when the auditor writes ML1 on the certificate. Essential Eight maturity is the level every strategy meets — so Eightfold reports the lowest, which is the number the auditor will land on too.
- Masks non-compliance.
- Creates false board confidence.
- Obscures remediation priority.
- Produces unverified claims.
- Exposes the true floor.
- Aligns with external auditors.
- Pinpoints immediate actions.
- Binds every grade to evidence.
What Eightfold will not do
- Guess missing evidence.
- Override ACSC rules.
- Quote the maturity model at you (it paraphrases the requirement and cites the published model).
- Sign it for you (a named person inside your business approves; their name is on every page).
Watch it work, stage by stage.
One client, five stages, the same evidence throughout — from collect to a signed report. The Review, Approve and Export stages below are the real tool, not a staged tour.
Your evidence lands as real files, not a blank form.
Eightfold reads your evidence against each requirement and finds exactly where it falls short — before any number is shown.
Open a strategy to see the case for its score — not just the grade.
A named person signs it. The log entry is what proves that happened.
Audit · append-only
The signed report, ready to hand to your auditor.