Comparison

Essential Eight vs CPS 234

ASD Essential Eight · APRA CPS 234 Information Security · data 2026-10-27

Requirement-level comparison of ASD Essential Eight and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.

Have Essential Eight → need CPS 234

24 reqs

10 mapped · · 13 no mapping Open in gap view →

Of 24 APRA CPS 234 Information Security requirements, 10 map to something in Essential Eight, 1 are only loosely related, and 13 have no mapping in our data.

CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.

Likely new work: CPS 234 requirements with no mapping to Essential Eight (13)

CPS 234	Requirement	Match	Essential Eight	Evidence
Roles and responsibilities · 2
Para 13	Board ultimately responsible for information security	No mapping in our data	—	No mapping to Essential Eight in our data.
Para 14	Define information security roles and responsibilities	No mapping in our data	—	No mapping to Essential Eight in our data.
Information security capability · 2
Para 15	Maintain a capability commensurate with threats	No mapping in our data	—	No mapping to Essential Eight in our data.
Para 16	Assess third parties' information security capability	No mapping in our data	—	No mapping to Essential Eight in our data.
Policy framework · 2
Para 18	Maintain an information security policy framework	No mapping in our data	—	No mapping to Essential Eight in our data.
Para 19	Policies direct everyone with security obligations	No mapping in our data	—	No mapping to Essential Eight in our data.
Implementation of controls · 1
Para 22	Evaluate the design of third parties' controls	No mapping in our data	—	No mapping to Essential Eight in our data.
Testing control effectiveness · 3
Para 28	Check third parties' control testing is adequate	No mapping in our data	—	No mapping to Essential Eight in our data.
Para 29	Escalate deficiencies that can't be fixed quickly	No mapping in our data	—	No mapping to Essential Eight in our data.
Para 31	Review the testing programme at least annually	No mapping in our data	—	No mapping to Essential Eight in our data.
Internal audit · 3
Para 32	Internal audit reviews control design and effectiveness	No mapping in our data	—	No mapping to Essential Eight in our data.
Para 33	Assurance provided by appropriately skilled personnel	No mapping in our data	—	No mapping to Essential Eight in our data.
Para 34	Internal audit assesses third-party assurance relied on	No mapping in our data	—	No mapping to Essential Eight in our data.

Check these: only loosely related (a shared CSF outcome, not a mapping) (1)

CPS 234	Requirement	Match	Essential Eight	Evidence
Implementation of controls · 1
Para 21	Timely controls commensurate with risk and asset life-cycle	Loosely related	ISM-1488	Only shares CSF PR.DS-02: related, not a mapping

Mapped (10)

CPS 234	Requirement	Match	Essential Eight	Evidence
Information security capability · 1
Para 17	Keep capability current as threats and vulnerabilities change	Editorial	ISM-1698 ISM-1699 ISM-1701+3	Same topic: Vulnerability Mgmt (editorial pick)
Information asset identification and classification · 1
Para 20	Classify information assets by criticality and sensitivity	Editorial	ISM-1807	Same topic: Asset Management (editorial pick)
Incident management · 4
Para 23	Detect and respond to incidents in a timely manner	Editorial	ISM-1819	Same topic: Incident Response (editorial pick)
Para 24	Maintain information security response plans	Editorial	ISM-1819	Same topic: Incident Response (editorial pick)
Para 25	Response plans cover all stages and escalation	Editorial	ISM-1819	Same topic: Incident Response (editorial pick)
Para 26	Review and test response plans annually	Editorial	ISM-1819	Same topic: Incident Response (editorial pick)
Testing control effectiveness · 2
Para 27	Systematic testing programme for control effectiveness	Editorial	ISM-1698 ISM-1699 ISM-1701+3	Same topic: Vulnerability Mgmt (editorial pick)
Para 30	Testing by skilled, functionally independent specialists	Editorial	ISM-1698 ISM-1699 ISM-1701+3	Same topic: Vulnerability Mgmt (editorial pick)
APRA notification · 2
Para 35	Notify APRA of material incidents within 72 hours	Editorial	ISM-0123 ISM-0140	Same topic: Reporting (editorial pick)
Para 36	Notify APRA of material control weaknesses within 10 business days	Editorial	ISM-0123 ISM-0140	Same topic: Reporting (editorial pick)

Have CPS 234 → need Essential Eight

126 reqs

9 mapped · · 89 no mapping Open in gap view →

Of 126 ASD Essential Eight requirements, 9 map to something in CPS 234, 28 are only loosely related, and 89 have no mapping in our data.

Essential Eight here means the ISM controls ASD tags for Maturity Levels One to Three; each row shows its levels (ML1–ML3). ASD publishes no crosswalk to other frameworks, so every match is ControlMapping editorial.

Likely new work: Essential Eight requirements with no mapping to CPS 234 (89)

Essential Eight	Requirement	Match	CPS 234	Evidence
Multi-factor authentication · 16
ISM-0974	ML2, ML3 Multi-factor authentication is used to authenticate unprivileged human users of systems	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1173	ML2, ML3 Multi-factor authentication is used to authenticate privileged human users of systems	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1401	ML1, ML2, ML3 Multi-factor authentication uses either: something people have and something people…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1504	ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online services that process…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1505	ML3 Multi-factor authentication is used to authenticate human users of data repositories	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1679	ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online services that process, store or…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1680	ML1, ML2, ML3 Multi-factor authentication (where available) is used to authenticate human users to…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1681	ML1, ML2, ML3 Multi-factor authentication is used to authenticate customers to online customer…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1682	ML2, ML3 Multi-factor authentication used for authenticating human users of systems is…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1683	ML2, ML3 Successful and unsuccessful multi-factor authentication events are centrally logged	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1872	ML2, ML3 Multi-factor authentication used for authenticating human users of online services is…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1873	ML2 Multi-factor authentication used for authenticating customers of online customer services provides a…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1874	ML3 Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1892	ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1893	ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online customer services that process…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1894	ML3 Multi-factor authentication used for authenticating human users of data repositories is…	No mapping in our data	—	No mapping to CPS 234 in our data.
Restrict administrative privileges · 20
ISM-0445	ML1, ML2, ML3 Privileged human users are assigned a dedicated privileged user account to be used…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1175	ML1, ML2, ML3 Privileged user accounts (excluding those explicitly authorised to access online…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1380	ML1, ML2, ML3 Privileged human users use separate privileged and unprivileged operating environments	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1387	ML2, ML3 Administrative activities are conducted through jump servers	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1507	ML1, ML2, ML3 Requests for privileged access to systems and their resources are validated when first…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1508	ML3 Privileged access to systems and their resources is limited to only what is required…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1509	ML2, ML3 Privileged access events are centrally logged	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1647	ML2, ML3 Privileged access to systems and their resources are disabled after 12 months unless…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1648	ML2, ML3 Privileged access to systems and their resources are disabled after 45 days of inactivity	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1649	ML3 Just-in-time administration is used for the administration of systems and their resources	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1650	ML2, ML3 Privileged user account and security group management events are centrally logged	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1685	ML2, ML3 Credentials for break glass accounts, local administrator accounts and service accounts…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1686	ML3 Credential Guard functionality is enabled	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1687	ML2, ML3 Privileged operating environments are not virtualised within unprivileged operating…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1688	ML1, ML2, ML3 Unprivileged user accounts cannot be used to log on to privileged operating environments	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1689	ML1, ML2, ML3 Privileged user accounts (excluding local administrator accounts) cannot be used to log…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1861	ML3 Local Security Authority protection functionality is enabled	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1883	ML1, ML2, ML3 Privileged user accounts explicitly authorised to access online services are strictly…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1897	ML3 Remote Credential Guard functionality is enabled	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1898	ML3 Secure Admin Workstations are used in the performance of administrative activities	No mapping in our data	—	No mapping to CPS 234 in our data.
Application control · 11
ISM-0843	ML1, ML2, ML3 Application control is implemented on workstations	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1490	ML2, ML3 Application control is implemented on internet-facing servers	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1544	ML2, ML3 Microsoft’s recommended application blocklist is implemented	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1582	ML2, ML3 Application control rulesets are validated at least annually	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1656	ML3 Application control is implemented on non-internet-facing servers	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1657	ML1, ML2, ML3 Application control restricts the execution of executables, libraries, scripts…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1658	ML3 Application control restricts the execution of drivers to an organisation-approved set	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1659	ML3 Microsoft’s vulnerable driver blocklist is implemented	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1660	ML2, ML3 Allowed and blocked application control events are centrally logged	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1870	ML1, ML2, ML3 Application control is applied to user profiles and temporary folders used by operating…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1871	ML2, ML3 Application control is applied to all locations other than user profiles and temporary…	No mapping in our data	—	No mapping to CPS 234 in our data.
Restrict Microsoft Office macros · 10
ISM-1487	ML3 Only privileged human users responsible for checking that Microsoft Office macros are…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1489	ML1, ML2, ML3 Microsoft Office macro security settings cannot be changed by human users	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1671	ML1, ML2, ML3 Microsoft Office macros are disabled for human users that do not have a demonstrated…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1672	ML1, ML2, ML3 Microsoft Office macro antivirus scanning is enabled	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1673	ML2, ML3 Microsoft Office macros are blocked from making Win32 API calls	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1674	ML3 Only Microsoft Office macros running from within a sandboxed environment, a Trusted…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1675	ML3 Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1676	ML3 Microsoft Office’s list of trusted publishers is validated at least annually	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1890	ML3 Microsoft Office macros are checked to ensure they are free of malicious code before…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1891	ML3 Microsoft Office macros digitally signed by signatures other than V3 signatures cannot…	No mapping in our data	—	No mapping to CPS 234 in our data.
User application hardening · 20
ISM-1412	ML2, ML3 Web browsers are hardened using ASD and vendor hardening guidance, with the most…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1485	ML1, ML2, ML3 Web browsers do not process web advertisements from the internet	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1486	ML1, ML2, ML3 Web browsers do not process Java from the internet	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1542	ML2, ML3 Microsoft Office is configured to prevent activation of Object Linking and Embedding…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1585	ML1, ML2, ML3 Web browser security settings cannot be changed by human users	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1621	ML3 Windows PowerShell 2.0 is disabled or removed	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1622	ML3 PowerShell is configured to use Constrained Language Mode	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1623	ML2, ML3 PowerShell module logging, script block logging and transcription events are centrally…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1654	ML1, ML2, ML3 Internet Explorer 11 is disabled or removed	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1655	ML3 .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1667	ML2, ML3 Microsoft Office is blocked from creating child processes	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1668	ML2, ML3 Microsoft Office is blocked from creating executable content	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1669	ML2, ML3 Microsoft Office is blocked from injecting code into other processes	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1670	ML2, ML3 PDF applications are blocked from creating child processes	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1823	ML2, ML3 Office productivity suite security settings cannot be changed by human users	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1824	ML2, ML3 PDF application security settings cannot be changed by human users	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1859	ML2, ML3 Office productivity suites are hardened using ASD and vendor hardening guidance, with…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1860	ML2, ML3 PDF applications are hardened using ASD and vendor hardening guidance, with the most…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1889	ML2, ML3 Command line process creation events are centrally logged	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1896	ML3 Memory integrity functionality is enabled	No mapping in our data	—	No mapping to CPS 234 in our data.
Regular backups · 11
ISM-1511	ML1, ML2, ML3 Backups of data, applications and settings are performed and retained in accordance…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1515	ML1, ML2, ML3 Restoration of data, applications and settings from backups to a common point in time…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1705	ML2, ML3 Privileged user accounts (excluding backup administrator accounts) cannot access…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1706	ML3 Privileged user accounts (excluding backup administrator accounts) cannot access their…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1707	ML2, ML3 Privileged user accounts (excluding backup administrator accounts) are prevented from…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1708	ML3 Backup administrator accounts are prevented from modifying and deleting backups during…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1810	ML1, ML2, ML3 Backups of data, applications and settings are synchronised to enable restoration to a…	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1811	ML1, ML2, ML3 Backups of data, applications and settings are retained in a secure and resilient manner	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1812	ML1, ML2, ML3 Unprivileged user accounts cannot access backups belonging to other user accounts	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1813	ML3 Unprivileged user accounts cannot access their own backups	No mapping in our data	—	No mapping to CPS 234 in our data.
ISM-1814	ML1, ML2, ML3 Unprivileged user accounts are prevented from modifying and deleting backups	No mapping in our data	—	No mapping to CPS 234 in our data.
Logging and incident response (all strategies) · 1
ISM-1815	ML2, ML3 Event logs are protected from unauthorised modification and deletion	No mapping in our data	—	No mapping to CPS 234 in our data.

Check these: only loosely related (a shared CSF outcome, not a mapping) (28)

Essential Eight	Requirement	Match	CPS 234	Evidence
Patch applications · 10
ISM-0304	ML3 Applications other than office productivity suites, web browsers and their extensions…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1690	ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1691	ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1692	ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1693	ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in applications other…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1700	ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1704	ML1, ML2, ML3 Office productivity suites, web browsers and their extensions, email clients, PDF…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1876	ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1901	ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1905	ML1, ML2, ML3 Online services that are no longer supported by vendors are removed	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
Patch operating systems · 13
ISM-1407	ML3 The latest release, or the previous release, of operating systems are used	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1501	ML1, ML2, ML3 Operating systems that are no longer supported by vendors are replaced	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1694	ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1695	ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1696	ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1697	ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1703	ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1877	ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1879	ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1900	ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1902	ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1903	ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
ISM-1904	ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release…	Loosely related	Para 17 Para 27 Para 30	Only shares CSF ID.RA-01: related, not a mapping
Restrict Microsoft Office macros · 1
ISM-1488	ML1, ML2, ML3 Microsoft Office macros in files originating from the internet are blocked	Loosely related	Para 21	Only shares CSF PR.DS-02: related, not a mapping
Logging and incident response (all strategies) · 4
ISM-0109	ML3 Event logs from workstations are analysed in a timely manner to detect cyber security…	Loosely related	Para 23	Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping
ISM-1228	ML2, ML3 Cyber security events are analysed in a timely manner to identify cyber security incidents	Loosely related	Para 23	Only shares CSF DE.AE-02: related, not a mapping
ISM-1906	ML2, ML3 Event logs from internet-facing servers are analysed in a timely manner to detect cyber…	Loosely related	Para 23	Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping
ISM-1907	ML3 Event logs from non-internet-facing servers are analysed in a timely manner to detect…	Loosely related	Para 23	Only shares CSF DE.AE-02, DE.CM-01: related, not a mapping

Mapped (9)

Essential Eight	Requirement	Match	CPS 234	Evidence
Patch applications · 2
ISM-1698	ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…	Editorial	Para 17 Para 27 Para 30	Same topic: Vulnerability Mgmt (editorial pick)
ISM-1699	ML1, ML2, ML3 A vulnerability scanner is used at least weekly to identify missing patches or updates…	Editorial	Para 17 Para 27 Para 30	Same topic: Vulnerability Mgmt (editorial pick)
Patch applications & Patch operating systems · 2
ISM-1807	ML1, ML2, ML3 An automated method of asset discovery is used at least fortnightly to support the…	Editorial	Para 17 Para 20 Para 27+1	Same topic: Vulnerability Mgmt, Asset Management (editorial pick)
ISM-1808	ML1, ML2, ML3 A vulnerability scanner with an up-to-date vulnerability database is used for…	Editorial	Para 17 Para 27 Para 30	Same topic: Vulnerability Mgmt (editorial pick)
Patch operating systems · 2
ISM-1701	ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in…	Editorial	Para 17 Para 27 Para 30	Same topic: Vulnerability Mgmt (editorial pick)
ISM-1702	ML1, ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of…	Editorial	Para 17 Para 27 Para 30	Same topic: Vulnerability Mgmt (editorial pick)
Logging and incident response (all strategies) · 3
ISM-0123	ML2, ML3 Cyber security incidents are reported to the chief information security officer, or one…	Editorial	Para 35 Para 36	Same topic: Reporting (editorial pick)
ISM-0140	ML2, ML3 Cyber security incidents are reported to ASD as soon as possible after they occur or…	Editorial	Para 35 Para 36	Same topic: Reporting (editorial pick)
ISM-1819	ML2, ML3 Following the identification of a cyber security incident, the cyber security incident…	Editorial	Para 23 Para 24 Para 25+1	Same topic: Incident Response (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.

Essential Eight vs CPS 234

Have Essential Eight → need CPS 234

Have CPS 234 → need Essential Eight

By topic