Cyber Essentials vs the Essential Eight: two national baselines compared
Both are short, technical and government-backed. One certifies five controls; the other grades eight strategies by maturity. Doing one gets you part of the way to the other.
The UK and Australia each publish a short list of technical controls that stop most common attacks. The UK's is Cyber Essentials, run by the National Cyber Security Centre and delivered by IASME; Australia's is the Essential Eight, from the Australian Signals Directorate. They are often mentioned in the same breath, and organisations operating in both countries ask the obvious question: if we have one, how far does it take us towards the other?
How they are built
Cyber Essentials certifies five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The current requirements, version 3.3, apply from 27 April 2026. Certification has two levels: a verified self-assessment, and Cyber Essentials Plus, which adds hands-on technical testing. Certificates last a year.
The Essential Eight is a set of eight mitigation strategies (patching applications, patching operating systems, multi-factor authentication, restricting administrative privileges, application control, restricting Office macros, user application hardening and regular backups), each implemented at one of three maturity levels. ControlMapping maps the 126 ISM controls that ASD tags with those levels. There is no certification: organisations assess themselves or commission an assessment, and since 1 July 2022 the Protective Security Policy Framework has required Australian non-corporate Commonwealth entities to implement all eight strategies to at least Maturity Level Two.
From the Essential Eight to Cyber Essentials
Of the 5 Cyber Essentials technical controls, 4 (80%) map to something in Essential Eight, 0 are only loosely related and 1 have no mapping in our data. Open the gap report →
| Cyber Essentials | Requirement | Match | Essential Eight |
|---|---|---|---|
| CE 1 | Firewalls | No mapping in our data | — |
| CE 2 | Secure Configuration | Editorial | ISM-1412ISM-1585ISM-1621ISM-1654 |
| CE 3 | Security Update Management | Editorial | ISM-1501ISM-1691ISM-1693ISM-1695 |
| CE 4 | User Access Control | Editorial | ISM-0445ISM-0974ISM-1173ISM-1175 |
| CE 5 | Malware protection | Editorial | ISM-0843ISM-1488ISM-1490ISM-1544 |
Most of Cyber Essentials has an Essential Eight counterpart. The exception is firewalls: no Essential Eight strategy addresses boundary or host firewalls, so an Essential Eight programme leaves that control to you.
From Cyber Essentials to the Essential Eight
Of the 126 Essential Eight ISM controls, 39 (31%) map to something in Cyber Essentials, 72 are only loosely related and 15 have no mapping in our data. Open the gap report →
Going the other way, Cyber Essentials covers only part of the Essential Eight, which is unsurprising: it has five controls against a much longer list of graded requirements. The largest gaps are:
- Regular backups. Cyber Essentials version 3.3 emphasises the importance of backing up data but doesn't require it. Backups are one of the eight strategies, with tested restoration at every maturity level.
- Office macros and user application hardening. Cyber Essentials' secure configuration control removes unnecessary software and disables auto-run; it doesn't address macros or browser and PDF hardening.
- Maturity levels and timeframes. Where both require the same thing, the Essential Eight is usually more specific at its higher levels, for example on how quickly vulnerabilities in internet-facing services must be patched, and on logging and protecting privileged access.
- Incident reporting. Some Essential Eight controls require reporting cyber security incidents; Cyber Essentials has no incident requirements at all.
The requirements with no Cyber Essentials link in our data:
| Essential Eight | Requirement | Match | Cyber Essentials |
|---|---|---|---|
| ISM-1511 | Backups of data, applications and settings are performed and retained in accordance… | No mapping in our data | — |
| ISM-1515 | Restoration of data, applications and settings from backups to a common point in time… | No mapping in our data | — |
| ISM-1705 | Privileged user accounts (excluding backup administrator accounts) cannot access… | No mapping in our data | — |
| ISM-1706 | Privileged user accounts (excluding backup administrator accounts) cannot access their… | No mapping in our data | — |
| ISM-1707 | Privileged user accounts (excluding backup administrator accounts) are prevented from… | No mapping in our data | — |
| ISM-1708 | Backup administrator accounts are prevented from modifying and deleting backups during… | No mapping in our data | — |
| ISM-1810 | Backups of data, applications and settings are synchronised to enable restoration to a… | No mapping in our data | — |
| ISM-1811 | Backups of data, applications and settings are retained in a secure and resilient manner | No mapping in our data | — |
| ISM-1812 | Unprivileged user accounts cannot access backups belonging to other user accounts | No mapping in our data | — |
| ISM-1813 | Unprivileged user accounts cannot access their own backups | No mapping in our data | — |
| ISM-1814 | Unprivileged user accounts are prevented from modifying and deleting backups | No mapping in our data | — |
| ISM-0123 | Cyber security incidents are reported to the chief information security officer, or one… | No mapping in our data | — |
| ISM-0140 | Cyber security incidents are reported to ASD as soon as possible after they occur or… | No mapping in our data | — |
| ISM-1815 | Event logs are protected from unauthorised modification and deletion | No mapping in our data | — |
| ISM-1819 | Following the identification of a cyber security incident, the cyber security incident… | No mapping in our data | — |
Where they agree, topic by topic
| Framework | Patch Management | Link |
|---|---|---|
| NIST CSF 2.0 | PR.PS-02 | Topic definition |
| ISO 27001 | A.8.8 | Crosswalk |
| CIS v8.1 | CIS 2.2CIS 7.3CIS 7.4CIS 12.1 | Crosswalk |
| SOC 2 | CC7.1 | Editorial |
| PCI DSS | 6.3.16.3.3 | Crosswalk |
| CMMC | SI.L2-3.14.1 | Crosswalk |
| 800-53 | SI-2 | Crosswalk |
| HIPAA | — | |
| GDPR | — | No mapping in our data |
| NIS2 | 6.6 | Crosswalk |
| Essential Eight | ISM-1876ISM-1691ISM-1693ISM-1877ISM-1695ISM-1704ISM-1501 | Editorial |
| DORA | Art.9(4)(f) | Editorial |
| CPS 234 | — | No mapping in our data |
| Cyber Essentials | CE 3 | Editorial |
Full detail and the reason for every link: Patch Management across frameworks →
| Framework | Multi-Factor Auth | Link |
|---|---|---|
| NIST CSF 2.0 | PR.AA-03 | Topic definition |
| ISO 27001 | A.8.5 | Crosswalk |
| CIS v8.1 | CIS 6.3CIS 6.4CIS 6.5 | Editorial |
| SOC 2 | CC6.1 | Editorial |
| PCI DSS | 8.4.18.4.28.4.38.5.1 | Editorial |
| CMMC | IA.L2-3.5.3 | Crosswalk |
| 800-53 | IA-2(1)IA-2(2) | Crosswalk |
| HIPAA | — | |
| GDPR | — | No mapping in our data |
| NIS2 | 11.611.7 | Crosswalk |
| Essential Eight | ISM-1504ISM-1679ISM-1173ISM-0974ISM-1401ISM-1872 | Editorial |
| DORA | Art.9(4)(d) | Editorial |
| CPS 234 | — | No mapping in our data |
| Cyber Essentials | CE 4 | Editorial |
Full detail and the reason for every link: Multi-Factor Auth across frameworks →
Patching and multi-factor authentication are the clearest common ground. Cyber Essentials sets a single rule for updates (critical and high-risk fixes within 14 days) and requires MFA wherever it's available, and always for cloud services; the Essential Eight sets different timeframes and MFA scope at each maturity level.
Which to use
If you need one for a contract, the contract decides: UK government buyers ask for Cyber Essentials, and Australian government entities work to the Essential Eight. If you're choosing freely, they combine well. Cyber Essentials gives you an external certificate for a sound minimum; the Essential Eight gives you a route to go further, with backups and application hardening that Cyber Essentials leaves out. To be ready for both, build to the Essential Eight, add firewall rules, and check your patch timeframes: Cyber Essentials' 14-day rule applies to every critical or high-risk update, which can be stricter than the lower maturity levels for some software.
Key takeaways
- Most of Cyber Essentials maps to the Essential Eight; firewalls are the gap.
- Cyber Essentials covers only part of the Essential Eight: backups, macro and application hardening, and the maturity-level detail are extra.
- Neither body publishes a mapping, so treat these links as a starting point and check the detail.
Where to go next
See the Cyber Essentials and Essential Eight framework pages, run the gap analysis to export the comparison as a tracker, or read our Essential Eight guide.
Questions
Does Cyber Essentials certification meet the Essential Eight?
No. The two overlap on patching, multi-factor authentication, administrative privileges and application control, but the Essential Eight also requires regular backups, Office macro and application hardening, and sets maturity levels with their own timeframes. Cyber Essentials also certifies firewalls, which no Essential Eight strategy covers.
Is there a certification for the Essential Eight?
There is no certification scheme like Cyber Essentials. Organisations assess themselves, or commission an independent assessment, against ASD's maturity model. Cyber Essentials is a certification with two levels, Cyber Essentials and Cyber Essentials Plus.
Is there an official mapping between the two?
Neither the NCSC nor ASD publishes one. The links on ControlMapping are editorial, and each one shows its reason.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.
Analysis · 2026-10-13MFA requirements compared across 11 security frameworksWhich frameworks require MFA, for whom and how strictly: PCI DSS, CMMC, NIS2, Essential Eight, ISO 27001, SOC 2 and HIPAA compared side by side.