Skip to content
CyberByte Security home

Free tool · 5 minutes

ASD Essentials Quick Check

Sixteen plain-English questions across the four domains ASD asks you to start with: the two priority phase 1 domains (Boundary services and Identity services) and the two that apply across every phase (Governance and culture, and Visibility and response). You get an indicative result for each, the chapter that likely fits you, and a sensible next step. No email needed. Your answers stay in your browser. We use Google Analytics to count visits and how many people finish the check; it never receives your answers.

Indicative only. This is not an ASD rating or an assessment, and CyberByte Security is not endorsed by ASD.

  • 10+ years across IT, cloud & cyber
  • Enterprise & government experience
  • Principal consultant-led delivery
  • Independent & Australian-owned
  • Melbourne-based · Australia-wide

About you

Where do your systems run?
How many staff?
Have you already done Essential Eight work?

Priority phase 1

Boundary services

Everything you expose to the internet.

  1. You know everything you have on the internet: websites, remote access, cloud apps and email services.

    Evidence that shows Yes: A current list of domains, public services and cloud apps.

  2. Internet-facing systems get security updates within days, not weeks.

    Evidence that shows Yes: Patch reports or update history for those systems.

  3. Remote access (VPN or remote desktop) is either not exposed or protected by multi-factor authentication.

    Evidence that shows Yes: Firewall or remote-access settings showing MFA.

  4. Email and web filtering block malicious links and attachments.

    Evidence that shows Yes: Filtering policies, such as Safe Links and Safe Attachments.

Priority phase 1

Identity services

Accounts, sign-in and admin access.

  1. Everyone signs in with phishing-resistant MFA (passkeys, FIDO2 security keys or Windows Hello for Business), not SMS codes or app approvals.

    Evidence that shows Yes: An authentication methods report from Entra ID or your main platform, showing each user's registered methods.

  2. Old sign-in methods (legacy authentication) are turned off in Microsoft 365 or your main platform.

    Evidence that shows Yes: A Conditional Access policy or setting that blocks legacy sign-in.

  3. Admin accounts are separate from everyday accounts and kept to as few people as possible.

    Evidence that shows Yes: A list of admin roles and who holds them.

  4. Leavers' and unused accounts are removed promptly, and access is reviewed regularly.

    Evidence that shows Yes: An offboarding record or the last access review.

All phases

Governance and culture

Leadership accountability, AI, suppliers and staff awareness.

  1. A named executive or board member is accountable for cyber risk, and the board hears about it at least twice a year.

    Evidence that shows Yes: Board minutes or a role description naming the accountable person.

  2. You have written rules for how staff may use AI tools, and someone is accountable for AI use.

    Evidence that shows Yes: An AI acceptable-use policy with an owner.

  3. You know which outside providers hold your data or run your systems, and you've checked their security in the last 12 months.

    Evidence that shows Yes: A supplier list with the date each was last reviewed.

  4. All staff have had security awareness training in the last 12 months.

    Evidence that shows Yes: Training completion records.

All phases

Visibility and response

Knowing what you have, seeing what happens, and responding well.

  1. You have an up-to-date list of your devices, accounts, systems and where your important data lives.

    Evidence that shows Yes: An asset register or device inventory (for example, Intune).

  2. Sign-in and admin activity is logged centrally, and someone reviews the alerts.

    Evidence that shows Yes: Audit log settings and a named person or provider for alerts.

  3. You have a written incident response plan and have practised it in the last 12 months.

    Evidence that shows Yes: The plan, and notes from the last exercise.

  4. You know who to call in a breach (IT provider, insurer, ASD, OAIC) and what you must report.

    Evidence that shows Yes: A contact list in the incident plan.

0 of 16 questions answered, plus 3 about you.

Request a scoping call

Talk to a senior advisor.

A 20-minute scoping call: tell us what's prompting this, and we'll tell you the smallest credible engagement that solves it. Fixed price for the agreed scope, no obligation.

Request a scoping callSee packages & pricing