Can you do your own Essential Eight assessment?

Yes, and it is worth doing: the model is public, the checks are concrete, and a self-assessment against real evidence beats guessing. What it cannot give you is proof, because a business marking its own homework, or its provider marking theirs, carries a conflict everyone can see. Use self-assessment for direction, and independent eyes for evidence.

Doing it credibly takes three disciplines. Work from the ASD's published maturity model, control by control, at the level you are targeting, because the requirements are specific and paraphrasing them is where rigour leaks out. Enforce the evidence rule on yourself: a control scores only what an export, a report or a log can support, never what everyone is fairly sure is true. And score by the weakest control, however unflattering, because that is how anyone else will score you later.

Know the failure modes going in. Self-scores run generous, reliably, because the person scoring configured the thing being scored. Blind spots are structural: you cannot examine the account you forgot exists or the server nobody mentions. And conflict of interest does not spare providers, ours included: our Scorecard is us assessing an environment we might later be paid to fix, which is exactly why it ships with the evidence attached, so the findings stand up in anyone's hands, not just ours. Judge every assessment, self, provider or independent, by that same standard.

The practical split, then: self-assess quarterly to stay oriented and catch drift, use a provider assessment when you want the evidence gathered properly without paying for it, and pay for genuine independence when the report becomes an instrument, tenders, DISP applications, disputes, insurance arguments. The three are not rivals; they are the same exercise at three levels of formality, and a business that runs the first two rarely gets surprised by the third. Start wherever suits, but start with evidence: the free Scorecard is one way, 1800 456 567 is another.