Essential Eight vs ISO 27001: why most links are only "loosely related"
Map ASD's Essential Eight against ISO 27001 and a pattern appears: every control touches something in Annex A, but few match it closely. That says more about the two frameworks than about the mapping.
Australian organisations increasingly face both: ISO 27001 for customers and tenders, and ASD's Essential Eight for government work, regulators and insurers. Mapping one to the other produces an unusual result, and understanding it saves a lot of misplaced confidence.
The two directions
| Direction | Mapped | No mapping | ||
|---|---|---|---|---|
| Have ISO 27001 → need Essential Eight | 57 of 126 (45%) | 69 | 0 | report → |
| Have Essential Eight → need ISO 27001 | 23 of 123 (19%) | 39 | 61 | report → |
From ISO 27001 to the Essential Eight, every Essential Eight control maps or is loosely related to something in ISO; none has no match at all. Yet only about half map closely. From the Essential Eight to ISO 27001, the picture flips: most of ISO is untouched, because eight mitigation strategies were never meant to be a whole programme.
By strategy
| Essential Eight section | Mapped | No mapping | |
|---|---|---|---|
| Patch applications | 6 of 12 | 6 | 0 |
| Patch applications & Patch operating systems | 2 of 2 | 0 | 0 |
| Patch operating systems | 5 of 15 | 10 | 0 |
| Multi-factor authentication | 7 of 16 | 9 | 0 |
| Restrict administrative privileges | 9 of 20 | 11 | 0 |
| Application control | 6 of 11 | 5 | 0 |
| Restrict Microsoft Office macros | 1 of 11 | 10 | 0 |
| User application hardening | 7 of 20 | 13 | 0 |
| Regular backups | 6 of 11 | 5 | 0 |
| Logging and incident response (all strategies) | 8 of 8 | 0 | 0 |
Have ISO 27001, need Essential Eight. Requirement by requirement: open the gap report →
Why "loosely related" dominates
The Essential Eight and ISO 27001 sit at opposite ends of a spectrum.
ISO 27001 says what to manage. A.8.8 asks you to manage technical vulnerabilities; A.8.2 to restrict privileged access; A.8.7 to protect against malware; A.8.13 to back up information. How, and how well, comes from your risk assessment.
The Essential Eight says exactly what to do, and when. Patch internet-facing services within set deadlines that tighten at each maturity level. Block Office macros from the internet. Allow only approved programs, scripts and libraries to run. Use phishing-resistant MFA at higher levels. Test restoration of backups. Each requirement is an ISM control with a maturity level.
So an ISO control and an Essential Eight control usually address the same outcome without one satisfying the other. In our data that shows as loosely related: they share a NIST CSF 2.0 outcome, but nobody has published a crosswalk, and the gap between "manage vulnerabilities" and "patch within the set deadline" is real work.
What this means in practice
- An ISO certificate tells you nothing about Essential Eight maturity. An organisation can be certified and be at maturity level zero on application control.
- The Essential Eight gives your ISMS teeth. Using its requirements as the implementation standard for the matching Annex A controls (A.8.8, A.8.2, A.8.5, A.8.7, A.8.9, A.8.13) turns ISO's risk-based controls into specific, testable settings.
- The ISMS gives the Essential Eight a home. Risk assessment chooses the target maturity level; internal audit checks it; management review tracks progress.
Key takeaways
- Most Essential Eight controls are only loosely related to ISO 27001.
- Use the Essential Eight as the implementation standard inside an ISMS.
A practical approach
- Choose an Essential Eight target maturity level through your ISO risk assessment, and record it in the Statement of Applicability.
- Write the Essential Eight requirements for that level into your Annex A control descriptions.
- Assess with ASD's process, and treat failures as ISO nonconformities with corrective actions.
- Use the Essential Eight strategy pages to see each control by maturity level, and the ISO 27001 → Essential Eight gap report for the full list.
ASD publishes no crosswalk from the Essential Eight to ISO 27001, so every link here is ControlMapping's editorial judgement. Our Essential Eight guide explains the maturity model and assessment.
Questions
Does ISO 27001 certification mean we meet the Essential Eight?
No. ISO 27001 requires the same areas (patching, access, malware, backups) but not the Essential Eight's specific settings, timelines and maturity levels. Assess against ASD's Essential Eight Assessment Process Guide.
Should Australian organisations do ISO 27001 or the Essential Eight?
Often both: the Essential Eight as a prioritised technical baseline, inside an ISO 27001 ISMS that provides governance, risk management and certification.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.