Essential Eight compliance is live, inside the portal
Our biggest release to date. Essential Eight compliance has left the pilot and is generally available, and it now lives inside the portal you already use. It is not a separate tool with a separate login.
What's new
Guided Essential Eight self-assessment. Work through all 48 Maturity Level 1 controls at your own pace. For each one you record what you actually do, attach evidence, and rate how strong that evidence is. Plain-language explanations sit beside every control, so you are not expected to arrive already knowing what "application control" means.
Your scan evidence flows straight in. Findings from the website scans you are already running attach themselves to the relevant controls. No re-keying, no spreadsheet, no exporting one tool into another.
A report you can hand over. When you finish, you get a signed report with a shareable link. It carries your control-by-control findings, the gaps, the evidence behind each answer, and a one-page summary for people who will not read the rest. It is built for the moment an insurer, a client or a tender asks you to show your position.
Honest evidence grading. Where your evidence is weak, the report says so. We do not round results up. A report that overstates your position is worth nothing to the person reading it, and worse than nothing to you.
Compliance for each business you run. If your account covers more than one company, each gets its own assessment, its own evidence and its own report. Switch between them from the company selector.
Team seats. Invite colleagues to work on assessments and scans with you. Five team members are included, and you can add more.
Close your account yourself. Account closure is now self-service in Settings, with a clear summary of what is deleted and what is kept, rather than an email to support.
Alongside these, we have made a long run of smaller improvements across the portal, covering sign-in, two-factor re-enrolment, billing and subscription management, the dashboard, and the way domains are organised.
Getting access
Essential Eight compliance is available on the Business plan, licensed per company. You can see what is included on the pricing page, and there is a free trial on your first licence.
If you are on Free or Individuals, everything else in this release is already yours, and the compliance area will tell you what it needs when you open it.
Why it matters
Most small businesses can answer "is our website secure?" but not "can you evidence your security position?". It is increasingly the second question that gets asked, by insurers at renewal, by enterprise clients during procurement, and by anyone tendering for government work.
The Essential Eight is the Australian Signals Directorate's baseline for reducing the risk of the most common attacks, and Maturity Level 1 is the level most small and medium organisations should reach first. This release is about being able to show where you stand against it, with the evidence attached, without hiring a consultant to find out.
Curious what the framework actually asks for? We have written a plain-English explainer.
A note on what this is. The portal gives you a guided self-assessment: you record your own position, and the report states plainly that you assessed it yourself. It is informed by the ASD Essential Eight Assessment Process Guide. If you need an assessment carried out by someone other than yourself, that is a consulting engagement, so please talk to us.