Completing a VGCMB self-assessment

1. Click “Enter Assessment” action button to complete the main assessment.

To answer each of the eight self-assessment questions, select the appropriate level of maturity from the options provided. To help you select the right maturity level, there is a detailed description of the control at the top of the screen, and a description of the relevant control maturity for each of the levels under the Essential Eight (maturity levels zero, one, two and three).

Choose ‘Current’ and ‘Desired’ maturity levels for each of the eight questions.

Definition guide

Current: Select the maturity level for your agency at this current point in time.

Desired: Select the option that best fits the maturity level your agency is working towards.

Navigate the questions

Unanswered questions will have a grey dash next to them in the left-hand question menu.

Status of Assessments

Green Tick: Completed Assessment

Orange Tick: Partially completed Assessment

Red Exclamation Mark: Incomplete Assessment

Control Effectiveness section

To help you assess the effectiveness of the controls in place, there are four additional questions for each of the eight control areas, in the form of dropdown menus. Simply select the option which most accurately represents the arrangements for each type of control. This is a mandatory requirement in this assessment.

1. Select your coverage and assurance ratings.

Definition guide

Coverage: The number/percentage of systems in scope which have implemented the security control and the risk impact of systems in scope that are not covered.

Assurance: Who is responsible for maturity assessment of the control (e.g. self-assessed or audited) and how recently.

2. Enter any explanatory notes.
   You can add information about why the maturity level was chosen for each of the eight control areas, as well as notes about coverage and assurance. This is not a mandatory field.

3. Upload supporting evidence you think may be relevant to this topic assessment.
   This is not a mandatory field.

To enhance the benchmarking process, additional assessment questions have been introduced. Your responses to these questions will support the Victorian Government in comparing cyber maturity across departments, agencies, and industry sectors. This will provide valuable insights into performance levels and help identify improvement opportunities.

1. Click “Enter Assessment” action button to complete the main assessment.

2. Select the appropriate answer from the dropdown box.

3. Once completed, click ‘Okay’.

Each year, we report aggregated results annually to all state government Departments. We have an opt-in option to agencies to share their identified results with their portfolio department. This can be accessed from your Assessment Overview Page under Assessment Profile Questions.

Here, you can opt-in to the data sharing and update other profile specific questions.

1. From the Assessment Overview page, click on ‘Assessment Profile Questions’.

2. Answer the questions in the pop-up and press ‘Okay’ to save.

Once all assessment questionnaires have been completed, the ‘Waiting for Approval’ orange label will appear next to the assessment name, as well as the “Send for Approval” action button next to the Assessment Profile Questions button.

1. Click on the ‘Send for Approval’ action button

2. Once modal pop-up appears, check the tick box ‘I confirm sending the notification to the designated Approver’ and click ‘Okay’.

Once a completed assessment has been submitted, the approver can proceed to review and approve it. On the approver’s Overview page, an Approve Assessment action will become available next to the Assessment Profile Questions button. This action allows the approver to finalise the assessment approval after thoroughly reviewing the submitted responses.

1. Click on the ‘Approve Assessment’ action button.

2. Check the statement “I understand….”

Once all assessment questionnaires have been approved, the ‘Waiting for Approval’ orange label will change to a green tag label.

On any of your assessment overview pages, select “Report List” from the sub-menu to view reports specific to that assessment.

To generate a particular report that is available, click on the selected report, i.e. Cyber Maturity Benchmark Results – Executive Summary.

From the dropdown boxes selections;

1. Assessment Year: select the “current” value in the dropdown box.
2. Profile Category: Keep default box “Empty” ticked.
3. Category Value: Keep default box “Empty” ticked.
4. Note: For Profile Catergory and Category Value if you require one of the profile question to show in the report, un-tick the “Empty” box and select the required question to be shown in the report.
5. Once all value are selected from the dropdown boxes, the report will automatically generate.

To export this report, select the desired format and click “Export” for download.