Test your Essential Eight knowledge
Ten random questions drawn from a bank of forty: one from each Essential Eight strategy plus two model fundamentals, with an explanation after every answer.
Last checked against cyber.gov.au on . Current model: Essential Eight Maturity Model (November 2023).
Knowledge challenge
Ten questions. Eight strategies.
Round complete
0/10
Best score on this browser: / Best streak this round:
This score tests recall, not implementation. It is not an Essential Eight assessment or certification.
How a round works
The bank contains forty questions. Each round draws ten: two fundamentals about the maturity model and one question for each of the eight mitigation strategies. Both the question order and answer positions are randomised. A replay avoids the ten questions you just saw rather than simply changing their order.
Choose an answer to see the rule and why it matters. The explanation links to the relevant guide if you want the complete requirement rather than the quiz-sized version.
What the score means
The score measures recall of this small question set. It does not measure how well an organisation has implemented the Essential Eight, and it cannot establish a maturity level.
A real assessment examines implementation and effectiveness using evidence. ASD's assessment guidance places a policy or verbal statement of intent at the weakest end of its evidence scale. If you need an indicative starting point, use the 24-question self-assessment; if you need assurance, test the controls themselves.
Question basis
The quiz uses ASD's current Essential Eight Maturity Model (November 2023) and its associated FAQ and changes publication. It deliberately tests details that older checklists often get wrong: the 48-hour patching trigger, the one-month operating-system window, phishing-resistant MFA, removed macro logging and backup retention.
Requirements are shortened to fit a learning game. Follow the answer's guide link or the full requirements matrix before using one operationally.
Sources
- ASD — Essential Eight maturity model — Last updated 27 November 2023
- ASD — Essential Eight maturity model changes — Last updated 27 November 2023
- ASD — Essential Eight maturity model FAQ — Last updated 28 October 2024
Common questions
Does this quiz assess my organisation's Essential Eight maturity?
No. It checks your recall of selected requirements. An assessment tests how controls are implemented and whether they are effective across the environment. A quiz score cannot establish a maturity level.
Which version of the Essential Eight does the quiz use?
The questions use ASD's Essential Eight Maturity Model of November 2023, which remains the current release. Each answer links to the relevant guide, and the primary ASD publications are listed below the quiz.
Is my quiz result stored or submitted?
No result leaves your browser. The page only keeps your best score in local browser storage so you can try to beat it later. You can remove it by clearing site data.
How many Essential Eight quiz questions are there?
The bank contains forty questions. Each round draws ten: two maturity-model fundamentals and one question for each of the eight mitigation strategies. Question order and answer positions are randomised, and the next round avoids the questions you just saw.
Read next
-
The Essential Eight, explained
The Essential Eight is ASD's baseline set of eight cyber security mitigation strategies for internet-connected corporate IT. This hub explains what each strategy requires, who must implement it, and what ASD has announced about the proposed Essentials series.
-
Essential Eight self-assessment
Twenty-four questions, three per mitigation strategy, one for each maturity level. Scored the way ASD scores: cumulative within a strategy, and capped at your weakest strategy overall.
-
Essential Eight glossary
A sourced guide to terms used in ASD's Essential Eight publications and in the separate instruments that make the framework mandatory for some organisations.
Essential Eight
Need this assessed rather than explained?
We assess your maturity across all eight strategies, show you where you actually stand, and do the remediation. We are not an ASD-endorsed assessor — nobody is, because no such endorsement exists.
