Comparison
Essential Eight vs ISO 27001: a technical baseline vs a whole security programme
ISO/IEC 27001:2022 · ASD Essential Eight · data 2026-10-27
The Australian Signals Directorate's Essential Eight is a prioritised set of eight mitigation strategies (patching applications and operating systems, multi-factor authentication, restricting administrative privileges, application control, restricting Microsoft Office macros, user application hardening and regular backups), each defined at Maturity Levels One to Three by specific controls in the Information Security Manual (ISM). Australian Government entities must implement it under the Protective Security Policy Framework, and it's widely expected of their suppliers.
ISO/IEC 27001 is a full management system, internationally recognised and certifiable. The two aren't alternatives. The Essential Eight is a technical baseline focused on preventing intrusions and limiting their impact, while ISO 27001 is a framework for running all of information security.
Going from ISO to the Essential Eight, every E8 control is mapped or loosely related. But many are only loosely related, because ASD's controls are far more specific than Annex A. ISO says manage technical vulnerabilities; the Essential Eight says patch internet-facing services within 48 hours when an exploit exists, and specifies how Office macros, browsers and PowerShell must be configured at each maturity level. Expect real technical work, especially at ML2 and ML3.
Going from the Essential Eight to ISO, most of ISO is unmatched: governance, supplier management, legal and compliance controls, physical security, people controls and the ISMS itself are outside the Essential Eight's scope. ASD publishes no crosswalk between the two, so Essential Eight matches here are ControlMapping editorial.
Key takeaways
- Use the Essential Eight to set concrete technical targets inside an ISO 27001 ISMS.
- Pick a target maturity level per strategy; ML2 is the common expectation for government work.
- Essential Eight compliance isn't certifiable; assessments follow ASD's Essential Eight assessment process guide.
Of 126 ASD Essential Eight requirements, 57 map to something in ISO 27001, 69 are only loosely related, and 0 have no mapping in our data.
Essential Eight here means the ISM controls ASD tags for Maturity Levels One to Three; each row shows its levels (ML1–ML3). ASD publishes no crosswalk to other frameworks, so every match is ControlMapping editorial.
Check these: only loosely related (a shared CSF outcome, not a mapping) (69)
| Essential Eight | Requirement | Match | ISO 27001 | Evidence |
|---|---|---|---|---|
| Patch applications · 6 | ||||
| ISM-0304 | ML3 Applications other than office productivity suites, web browsers and their extensions… | A.5.9A.8.7A.8.8 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| ISM-1690 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… | A.5.9A.8.7A.8.8 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| ISM-1692 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… | A.5.9A.8.7A.8.8 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| ISM-1700 | ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office… | A.5.9A.8.7A.8.8 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| ISM-1901 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when… | A.5.9A.8.7A.8.8 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| ISM-1905 | ML1, ML2, ML3 Online services that are no longer supported by vendors are removed | A.5.9A.8.7A.8.8 | Only shares CSF PR.PS-02, ID.RA-01: related, not a mapping | |
| Patch operating systems · 10 | ||||
| ISM-1407 | ML3 The latest release, or the previous release, of operating systems are used | A.5.9A.8.1A.8.7+1 | Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1694 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… | A.5.9A.8.1A.8.7+1 | Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1696 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… | A.5.9A.8.1A.8.7+1 | Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1697 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… | A.5.9A.8.1A.8.7+1 | Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1703 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers | A.5.9A.8.1A.8.7+1 | Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1879 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release… | A.5.9A.8.1A.8.7+1 | Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1900 | ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware | A.5.9A.8.1A.8.7+1 | Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1902 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of… | A.5.9A.8.1A.8.7+1 | Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1903 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release… | A.5.9A.8.1A.8.7+1 | Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping | |
| ISM-1904 | ML3 Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release… | A.5.9A.8.1A.8.7+1 | Only shares CSF PR.PS-02, PR.PS-03: related, not a mapping | |
| Multi-factor authentication · 9 | ||||
| ISM-1505 | ML3 Multi-factor authentication is used to authenticate human users of data repositories | A.5.15A.5.16A.5.17+2 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1680 | ML1, ML2, ML3 Multi-factor authentication (where available) is used to authenticate human users to… | A.5.15A.5.16A.5.17+2 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1681 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate customers to online customer… | A.5.15A.5.16A.5.17+2 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1682 | ML2, ML3 Multi-factor authentication used for authenticating human users of systems is… | A.5.15A.5.16A.5.17+2 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1873 | ML2 Multi-factor authentication used for authenticating customers of online customer services provides a… | A.5.15A.5.16A.5.17+2 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1874 | ML3 Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant | A.5.15A.5.16A.5.17+2 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1892 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that… | A.5.15A.5.16A.5.17+2 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1893 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online customer services that process… | A.5.15A.5.16A.5.17+2 | Only shares CSF PR.AA-03: related, not a mapping | |
| ISM-1894 | ML3 Multi-factor authentication used for authenticating human users of data repositories is… | A.5.15A.5.16A.5.17+2 | Only shares CSF PR.AA-03: related, not a mapping | |
| Restrict administrative privileges · 11 | ||||
| ISM-1649 | ML3 Just-in-time administration is used for the administration of systems and their resources | A.5.1A.5.3A.5.14+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1650 | ML2, ML3 Privileged user account and security group management events are centrally logged | A.5.1A.5.3A.5.14+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1685 | ML2, ML3 Credentials for break glass accounts, local administrator accounts and service accounts… | A.5.1A.5.3A.5.14+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1686 | ML3 Credential Guard functionality is enabled | A.5.1A.5.3A.5.14+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1687 | ML2, ML3 Privileged operating environments are not virtualised within unprivileged operating… | A.5.1A.5.3A.5.14+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1688 | ML1, ML2, ML3 Unprivileged user accounts cannot be used to log on to privileged operating environments | A.5.1A.5.3A.5.14+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1689 | ML1, ML2, ML3 Privileged user accounts (excluding local administrator accounts) cannot be used to log… | A.5.1A.5.3A.5.14+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1861 | ML3 Local Security Authority protection functionality is enabled | A.5.1A.5.3A.5.14+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1883 | ML1, ML2, ML3 Privileged user accounts explicitly authorised to access online services are strictly… | A.5.1A.5.3A.5.14+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1897 | ML3 Remote Credential Guard functionality is enabled | A.5.1A.5.3A.5.14+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| ISM-1898 | ML3 Secure Admin Workstations are used in the performance of administrative activities | A.5.1A.5.3A.5.14+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| Application control · 5 | ||||
| ISM-1582 | ML2, ML3 Application control rulesets are validated at least annually | A.8.1A.8.7A.8.19 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1656 | ML3 Application control is implemented on non-internet-facing servers | A.8.1A.8.7A.8.19 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1658 | ML3 Application control restricts the execution of drivers to an organisation-approved set | A.8.1A.8.7A.8.19 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1659 | ML3 Microsoft’s vulnerable driver blocklist is implemented | A.8.1A.8.7A.8.19 | Only shares CSF PR.PS-05: related, not a mapping | |
| ISM-1871 | ML2, ML3 Application control is applied to all locations other than user profiles and temporary… | A.8.1A.8.7A.8.19 | Only shares CSF PR.PS-05: related, not a mapping | |
| Restrict Microsoft Office macros · 10 | ||||
| ISM-1487 | ML3 Only privileged human users responsible for checking that Microsoft Office macros are… | A.6.7A.8.1A.8.7+4 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1489 | ML1, ML2, ML3 Microsoft Office macro security settings cannot be changed by human users | A.6.7A.8.1A.8.7+4 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1671 | ML1, ML2, ML3 Microsoft Office macros are disabled for human users that do not have a demonstrated… | A.6.7A.8.1A.8.7+4 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1672 | ML1, ML2, ML3 Microsoft Office macro antivirus scanning is enabled | A.6.7A.8.1A.8.7+4 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1673 | ML2, ML3 Microsoft Office macros are blocked from making Win32 API calls | A.6.7A.8.1A.8.7+4 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1674 | ML3 Only Microsoft Office macros running from within a sandboxed environment, a Trusted… | A.6.7A.8.1A.8.7+4 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1675 | ML3 Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled… | A.6.7A.8.1A.8.7+4 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1676 | ML3 Microsoft Office’s list of trusted publishers is validated at least annually | A.6.7A.8.1A.8.7+4 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1890 | ML3 Microsoft Office macros are checked to ensure they are free of malicious code before… | A.6.7A.8.1A.8.7+4 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| ISM-1891 | ML3 Microsoft Office macros digitally signed by signatures other than V3 signatures cannot… | A.6.7A.8.1A.8.7+4 | Only shares CSF PR.PS-01, PR.PS-05: related, not a mapping | |
| User application hardening · 13 | ||||
| ISM-1485 | ML1, ML2, ML3 Web browsers do not process web advertisements from the internet | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1486 | ML1, ML2, ML3 Web browsers do not process Java from the internet | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1542 | ML2, ML3 Microsoft Office is configured to prevent activation of Object Linking and Embedding… | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1622 | ML3 PowerShell is configured to use Constrained Language Mode | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1655 | ML3 .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1667 | ML2, ML3 Microsoft Office is blocked from creating child processes | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1668 | ML2, ML3 Microsoft Office is blocked from creating executable content | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1669 | ML2, ML3 Microsoft Office is blocked from injecting code into other processes | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1670 | ML2, ML3 PDF applications are blocked from creating child processes | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1823 | ML2, ML3 Office productivity suite security settings cannot be changed by human users | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1824 | ML2, ML3 PDF application security settings cannot be changed by human users | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1889 | ML2, ML3 Command line process creation events are centrally logged | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| ISM-1896 | ML3 Memory integrity functionality is enabled | A.6.7A.8.8A.8.9+1 | Only shares CSF PR.PS-01: related, not a mapping | |
| Regular backups · 5 | ||||
| ISM-1705 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) cannot access… | A.8.13 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1706 | ML3 Privileged user accounts (excluding backup administrator accounts) cannot access their… | A.8.13 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1708 | ML3 Backup administrator accounts are prevented from modifying and deleting backups during… | A.8.13 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1812 | ML1, ML2, ML3 Unprivileged user accounts cannot access backups belonging to other user accounts | A.8.13 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
| ISM-1813 | ML3 Unprivileged user accounts cannot access their own backups | A.8.13 | Only shares CSF PR.DS-11, RC.RP-03: related, not a mapping | |
Mapped (57)
| Essential Eight | Requirement | Match | ISO 27001 | Evidence |
|---|---|---|---|---|
| Patch applications · 6 | ||||
| ISM-1691 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release | Editorial | A.8.8 | Same topic: Patch Management (editorial pick) |
| ISM-1693 | ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in applications other… | Editorial | A.8.8 | Same topic: Patch Management (editorial pick) |
| ISM-1698 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online… | Editorial | A.8.8 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1699 | ML1, ML2, ML3 A vulnerability scanner is used at least weekly to identify missing patches or updates… | Editorial | A.8.8 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1704 | ML1, ML2, ML3 Office productivity suites, web browsers and their extensions, email clients, PDF… | Editorial | A.8.8 | Same topic: Patch Management (editorial pick) |
| ISM-1876 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of… | Editorial | A.8.8 | Same topic: Patch Management (editorial pick) |
| Patch applications & Patch operating systems · 2 | ||||
| ISM-1807 | ML1, ML2, ML3 An automated method of asset discovery is used at least fortnightly to support the… | Editorial | A.5.9A.5.11A.7.14+1 | Same topic: Asset Management (editorial pick) |
| ISM-1808 | ML1, ML2, ML3 A vulnerability scanner with an up-to-date vulnerability database is used for… | Editorial | A.8.8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Patch operating systems · 5 | ||||
| ISM-1501 | ML1, ML2, ML3 Operating systems that are no longer supported by vendors are replaced | Editorial | A.8.8 | Same topic: Patch Management (editorial pick) |
| ISM-1695 | ML1, ML2 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release | Editorial | A.8.8 | Same topic: Patch Management (editorial pick) |
| ISM-1701 | ML1, ML2, ML3 A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in… | Editorial | A.8.8 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1702 | ML1, ML2, ML3 A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of… | Editorial | A.8.8 | Same topic: Vulnerability Mgmt (editorial pick) |
| ISM-1877 | ML1, ML2, ML3 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours… | Editorial | A.8.8 | Same topic: Patch Management (editorial pick) |
| Multi-factor authentication · 7 | ||||
| ISM-0974 | ML2, ML3 Multi-factor authentication is used to authenticate unprivileged human users of systems | Editorial | A.8.5 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1173 | ML2, ML3 Multi-factor authentication is used to authenticate privileged human users of systems | Editorial | A.8.5 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1401 | ML1, ML2, ML3 Multi-factor authentication uses either: something people have and something people… | Editorial | A.8.5 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1504 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to their organisation’s online services that process… | Editorial | A.8.5 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1679 | ML1, ML2, ML3 Multi-factor authentication is used to authenticate human users to third-party online services that process, store or… | Editorial | A.8.5 | Same topic: Multi-Factor Auth (editorial pick) |
| ISM-1683 | ML2, ML3 Successful and unsuccessful multi-factor authentication events are centrally logged | Editorial | A.8.15A.8.17 | Same topic: Logging & Audit (editorial pick) |
| ISM-1872 | ML2, ML3 Multi-factor authentication used for authenticating human users of online services is… | Editorial | A.8.5 | Same topic: Multi-Factor Auth (editorial pick) |
| Restrict administrative privileges · 9 | ||||
| ISM-0445 | ML1, ML2, ML3 Privileged human users are assigned a dedicated privileged user account to be used… | Editorial | A.8.2A.8.18 | Same topic: Privileged Access (editorial pick) |
| ISM-1175 | ML1, ML2, ML3 Privileged user accounts (excluding those explicitly authorised to access online… | Editorial | A.8.2A.8.18 | Same topic: Privileged Access (editorial pick) |
| ISM-1380 | ML1, ML2, ML3 Privileged human users use separate privileged and unprivileged operating environments | Editorial | A.8.2A.8.18 | Same topic: Privileged Access (editorial pick) |
| ISM-1387 | ML2, ML3 Administrative activities are conducted through jump servers | Editorial | A.8.2A.8.18 | Same topic: Privileged Access (editorial pick) |
| ISM-1507 | ML1, ML2, ML3 Requests for privileged access to systems and their resources are validated when first… | Editorial | A.8.2A.8.18 | Same topic: Privileged Access (editorial pick) |
| ISM-1508 | ML3 Privileged access to systems and their resources is limited to only what is required… | Editorial | A.8.2A.8.18 | Same topic: Privileged Access (editorial pick) |
| ISM-1509 | ML2, ML3 Privileged access events are centrally logged | Editorial | A.8.15A.8.17 | Same topic: Logging & Audit (editorial pick) |
| ISM-1647 | ML2, ML3 Privileged access to systems and their resources are disabled after 12 months unless… | Editorial | A.8.2A.8.18 | Same topic: Privileged Access (editorial pick) |
| ISM-1648 | ML2, ML3 Privileged access to systems and their resources are disabled after 45 days of inactivity | Editorial | A.8.2A.8.18 | Same topic: Privileged Access (editorial pick) |
| Application control · 6 | ||||
| ISM-0843 | ML1, ML2, ML3 Application control is implemented on workstations | Editorial | A.8.1A.8.7A.8.19 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1490 | ML2, ML3 Application control is implemented on internet-facing servers | Editorial | A.8.1A.8.7A.8.19 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1544 | ML2, ML3 Microsoft’s recommended application blocklist is implemented | Editorial | A.8.1A.8.7A.8.19 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1657 | ML1, ML2, ML3 Application control restricts the execution of executables, libraries, scripts… | Editorial | A.8.1A.8.7A.8.19 | Same topic: Endpoint Protection (editorial pick) |
| ISM-1660 | ML2, ML3 Allowed and blocked application control events are centrally logged | Editorial | A.8.15A.8.17 | Same topic: Logging & Audit (editorial pick) |
| ISM-1870 | ML1, ML2, ML3 Application control is applied to user profiles and temporary folders used by operating… | Editorial | A.8.1A.8.7A.8.19 | Same topic: Endpoint Protection (editorial pick) |
| Restrict Microsoft Office macros · 1 | ||||
| ISM-1488 | ML1, ML2, ML3 Microsoft Office macros in files originating from the internet are blocked | Editorial | A.5.14A.8.1A.8.7+1 | Same topic: Email Security, Endpoint Protection (editorial pick) |
| User application hardening · 7 | ||||
| ISM-1412 | ML2, ML3 Web browsers are hardened using ASD and vendor hardening guidance, with the most… | Editorial | A.8.9 | Same topic: Secure Config (editorial pick) |
| ISM-1585 | ML1, ML2, ML3 Web browser security settings cannot be changed by human users | Editorial | A.8.9 | Same topic: Secure Config (editorial pick) |
| ISM-1621 | ML3 Windows PowerShell 2.0 is disabled or removed | Editorial | A.8.9 | Same topic: Secure Config (editorial pick) |
| ISM-1623 | ML2, ML3 PowerShell module logging, script block logging and transcription events are centrally… | Editorial | A.8.15A.8.17 | Same topic: Logging & Audit (editorial pick) |
| ISM-1654 | ML1, ML2, ML3 Internet Explorer 11 is disabled or removed | Editorial | A.8.9 | Same topic: Secure Config (editorial pick) |
| ISM-1859 | ML2, ML3 Office productivity suites are hardened using ASD and vendor hardening guidance, with… | Editorial | A.8.9 | Same topic: Secure Config (editorial pick) |
| ISM-1860 | ML2, ML3 PDF applications are hardened using ASD and vendor hardening guidance, with the most… | Editorial | A.8.9 | Same topic: Secure Config (editorial pick) |
| Regular backups · 6 | ||||
| ISM-1511 | ML1, ML2, ML3 Backups of data, applications and settings are performed and retained in accordance… | Editorial | A.8.13 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1515 | ML1, ML2, ML3 Restoration of data, applications and settings from backups to a common point in time… | Editorial | A.5.30A.8.13A.8.14 | Same topic: Disaster Recovery, Backup & Recovery (editorial pick) |
| ISM-1707 | ML2, ML3 Privileged user accounts (excluding backup administrator accounts) are prevented from… | Editorial | A.8.13 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1810 | ML1, ML2, ML3 Backups of data, applications and settings are synchronised to enable restoration to a… | Editorial | A.8.13 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1811 | ML1, ML2, ML3 Backups of data, applications and settings are retained in a secure and resilient manner | Editorial | A.8.13 | Same topic: Backup & Recovery (editorial pick) |
| ISM-1814 | ML1, ML2, ML3 Unprivileged user accounts are prevented from modifying and deleting backups | Editorial | A.8.13 | Same topic: Backup & Recovery (editorial pick) |
| Logging and incident response (all strategies) · 8 | ||||
| ISM-0109 | ML3 Event logs from workstations are analysed in a timely manner to detect cyber security… | Editorial | A.8.16 | Same topic: Cont. Monitoring (editorial pick) |
| ISM-0123 | ML2, ML3 Cyber security incidents are reported to the chief information security officer, or one… | Editorial | A.5.5A.6.8 | Same topic: Reporting (editorial pick) |
| ISM-0140 | ML2, ML3 Cyber security incidents are reported to ASD as soon as possible after they occur or… | Editorial | A.5.5A.6.8 | Same topic: Reporting (editorial pick) |
| ISM-1228 | ML2, ML3 Cyber security events are analysed in a timely manner to identify cyber security incidents | Editorial | A.5.25A.8.16 | Same topic: SIEM / SOC, Anomaly Detection (editorial pick) |
| ISM-1815 | ML2, ML3 Event logs are protected from unauthorised modification and deletion | Editorial | A.8.15A.8.17 | Same topic: Logging & Audit (editorial pick) |
| ISM-1819 | ML2, ML3 Following the identification of a cyber security incident, the cyber security incident… | Editorial | A.5.24A.5.25A.5.26 | Same topic: Incident Response (editorial pick) |
| ISM-1906 | ML2, ML3 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… | Editorial | A.5.25A.8.16 | Same topic: SIEM / SOC, Cont. Monitoring (editorial pick) |
| ISM-1907 | ML3 Event logs from non-internet-facing servers are analysed in a timely manner to detect… | Editorial | A.8.16 | Same topic: Cont. Monitoring (editorial pick) |
Of 123 ISO/IEC 27001:2022 requirements, 23 map to something in Essential Eight, 39 are only loosely related, and 61 have no mapping in our data.
Likely new work: ISO 27001 requirements with no mapping to Essential Eight (61)
| ISO 27001 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 14 | ||||
| A.5.2 | Information security roles and responsibilities | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.4 | Management responsibilities | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.6 | Contact with special interest groups | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.7 | Threat intelligence | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.20 | Addressing information security within supplier agreements | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.21 | Managing information security in the ICT supply chain | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.23 | Information security for use of cloud services | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.32 | Intellectual property rights | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.33 | Protection of records | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.34 | Privacy and protection of PII | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.35 | Independent review of information security | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.36 | Compliance with policies, rules and standards for information security | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.5.37 | Documented operating procedures | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.6 People controls · 3 | ||||
| A.6.3 | Information security awareness, education and training | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.6.4 | Disciplinary process | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.6.6 | Confidentiality or non-disclosure agreements | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.7 Physical controls · 10 | ||||
| A.7.1 | Physical security perimeters | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.7.2 | Physical entry | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.7.3 | Securing offices, rooms and facilities | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.7.5 | Protecting against physical and environmental threats | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.7.6 | Working in secure areas | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.7.7 | Clear desk and clear screen | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.7.8 | Equipment siting and protection | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.7.9 | Security of assets off-premises | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.7.11 | Supporting utilities | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.7.12 | Cabling security | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8 Technological controls · 13 | ||||
| A.8.10 | Information deletion | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.11 | Data masking | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.12 | Data leakage prevention | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.21 | Security of network services | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.23 | Web filtering | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.25 | Secure development life cycle | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.28 | Secure coding | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.29 | Security testing in development and acceptance | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.30 | Outsourced development | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.31 | Separation of development, test and production environments | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.32 | Change management | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.33 | Test information | No mapping in our data | — | No mapping to Essential Eight in our data. |
| A.8.34 | Protection of information systems during audit testing | No mapping in our data | — | No mapping to Essential Eight in our data. |
| ISMS clauses 4–10 · 21 | ||||
| Clause 4.1 | Understanding the organization and its context | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 4.3 | Determining the scope of the ISMS | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 4.4 | Information security management system | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 5.1 | Leadership and commitment | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 5.3 | Organizational roles, responsibilities and authorities | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 6.1.3 | Information security risk treatment | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 6.2 | Information security objectives and planning to achieve them | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 6.3 | Planning of changes | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 7.1 | Resources | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 7.2 | Competence | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 7.3 | Awareness | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 7.5.1 | General | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 7.5.2 | Creating and updating | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 7.5.3 | Control of documented information | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 8.1 | Operational planning and control | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 8.2 | Information security risk assessment | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 8.3 | Information security risk treatment | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 9.2.1 | General | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 9.2.2 | Internal audit programme | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 10.1 | Continual improvement | No mapping in our data | — | No mapping to Essential Eight in our data. |
| Clause 10.2 | Nonconformity and corrective action | No mapping in our data | — | No mapping to Essential Eight in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (39)
| ISO 27001 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 15 | ||||
| A.5.1 | Policies for information security | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| A.5.3 | Segregation of duties | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| A.5.8 | Information security in project management | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.5.10 | Acceptable use of information and other associated assets | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| A.5.12 | Classification of information | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.5.13 | Labelling of information | ISM-1488ISM-1807 | Only shares CSF PR.DS-02, ID.AM-08: related, not a mapping | |
| A.5.15 | Access control | ISM-0445ISM-0974ISM-1173+5 | Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping | |
| A.5.16 | Identity management | ISM-0445ISM-0974ISM-1173+5 | Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping | |
| A.5.17 | Authentication information | ISM-0445ISM-0974ISM-1173+5 | Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping | |
| A.5.18 | Access rights | ISM-0445ISM-0974ISM-1173+5 | Only shares CSF PR.AA-05, PR.AA-03: related, not a mapping | |
| A.5.19 | Information security in supplier relationships | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.5.22 | Monitoring, review and change management of supplier services | ISM-1807 | Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping | |
| A.5.27 | Learning from information security incidents | ISM-1819 | Only shares CSF ID.IM-04, RS.MA-01, RS.MA-02: related, not a mapping | |
| A.5.28 | Collection of evidence | ISM-1819 | Only shares CSF RS.MA-01, RS.MA-02: related, not a mapping | |
| A.5.29 | Information security during disruption | ISM-1515 | Only shares CSF PR.IR-03: related, not a mapping | |
| A.6 People controls · 4 | ||||
| A.6.1 | Screening | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| A.6.2 | Terms and conditions of employment | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| A.6.5 | Responsibilities after termination or change of employment | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| A.6.7 | Remote working | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| A.7 Physical controls · 3 | ||||
| A.7.4 | Physical security monitoring | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-03: related, not a mapping | |
| A.7.10 | Storage media | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.7.13 | Equipment maintenance | ISM-1807 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.8 Technological controls · 8 | ||||
| A.8.3 | Information access restriction | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| A.8.4 | Access to source code | ISM-0445ISM-1175ISM-1380+5 | Only shares CSF PR.AA-05: related, not a mapping | |
| A.8.6 | Capacity management | ISM-0109ISM-0843ISM-1228+5 | Only shares CSF DE.CM-09: related, not a mapping | |
| A.8.20 | Networks security | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| A.8.22 | Segregation of networks | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| A.8.24 | Use of cryptography | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| A.8.26 | Application security requirements | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| A.8.27 | Secure system architecture and engineering principles | ISM-1515 | Only shares CSF PR.IR-03: related, not a mapping | |
| ISMS clauses 4–10 · 9 | ||||
| Clause 4.2 | Understanding the needs and expectations of interested parties | ISM-1488ISM-1515 | Only shares CSF PR.DS-02, PR.IR-03: related, not a mapping | |
| Clause 5.2 | Policy | ISM-1488 | Only shares CSF PR.DS-02: related, not a mapping | |
| Clause 6.1.1 | General | ISM-1515 | Only shares CSF PR.IR-03: related, not a mapping | |
| Clause 6.1.2 | Information security risk assessment | ISM-1698ISM-1699ISM-1701+3 | Only shares CSF ID.RA-08: related, not a mapping | |
| Clause 7.4 | Communication | ISM-0123ISM-0140 | Only shares CSF RS.CO-02: related, not a mapping | |
| Clause 9.1 | Monitoring, measurement, analysis and evaluation | ISM-0109ISM-1906ISM-1907 | Only shares CSF DE.CM-03: related, not a mapping | |
| Clause 9.3.1 | General | ISM-1412ISM-1485ISM-1486+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| Clause 9.3.2 | Management review inputs | ISM-1412ISM-1485ISM-1486+5 | Only shares CSF PR.PS-01: related, not a mapping | |
| Clause 9.3.3 | Management review results | ISM-1412ISM-1485ISM-1486+5 | Only shares CSF PR.PS-01: related, not a mapping | |
Mapped (23)
| ISO 27001 | Requirement | Match | Essential Eight | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 8 | ||||
| A.5.5 | Contact with authorities | Editorial | ISM-0123ISM-0140 | Same topic: Reporting (editorial pick) |
| A.5.9 | Inventory of information and other associated assets | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| A.5.11 | Return of assets | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| A.5.14 | Information transfer | Editorial | ISM-1488 | Same topic: Email Security (editorial pick) |
| A.5.24 | Information security incident management planning and preparation | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| A.5.25 | Assessment and decision on information security events | Editorial | ISM-1228ISM-1819ISM-1906 | Same topic: SIEM / SOC, Incident Response (editorial pick) |
| A.5.26 | Response to information security incidents | Editorial | ISM-1819 | Same topic: Incident Response (editorial pick) |
| A.5.30 | ICT readiness for business continuity | Editorial | ISM-1515 | Same topic: Disaster Recovery (editorial pick) |
| A.6 People controls · 1 | ||||
| A.6.8 | Information security event reporting | Editorial | ISM-0123ISM-0140 | Same topic: Reporting (editorial pick) |
| A.7 Physical controls · 1 | ||||
| A.7.14 | Secure disposal or re-use of equipment | Editorial | ISM-1807 | Same topic: Asset Management (editorial pick) |
| A.8 Technological controls · 13 | ||||
| A.8.1 | User endpoint devices | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| A.8.2 | Privileged access rights | Editorial | ISM-0445ISM-1175ISM-1380+5 | Same topic: Privileged Access (editorial pick) |
| A.8.5 | Secure authentication | Editorial | ISM-0974ISM-1173ISM-1401+3 | Same topic: Multi-Factor Auth (editorial pick) |
| A.8.7 | Protection against malware | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
| A.8.8 | Management of technical vulnerabilities | Editorial | ISM-1501ISM-1691ISM-1693+10 | Same topic: Patch Management (editorial pick) |
| A.8.9 | Configuration management | Editorial | ISM-1412ISM-1585ISM-1621+3 | Same topic: Secure Config (editorial pick) |
| A.8.13 | Information backup | Editorial | ISM-1511ISM-1515ISM-1707+3 | Same topic: Backup & Recovery (editorial pick) |
| A.8.14 | Redundancy of information processing facilities | Editorial | ISM-1515 | Same topic: Disaster Recovery (editorial pick) |
| A.8.15 | Logging | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| A.8.16 | Monitoring activities | Editorial | ISM-0109ISM-1228ISM-1906+1 | Same topic: Cont. Monitoring, Anomaly Detection, SIEM / SOC (editorial pick) |
| A.8.17 | Clock synchronization | Editorial | ISM-1509ISM-1623ISM-1660+2 | Same topic: Logging & Audit (editorial pick) |
| A.8.18 | Use of privileged utility programs | Editorial | ISM-0445ISM-1175ISM-1380+5 | Same topic: Privileged Access (editorial pick) |
| A.8.19 | Installation of software on operational systems | Editorial | ISM-0843ISM-1488ISM-1490+3 | Same topic: Endpoint Protection (editorial pick) |
By topic
Both cover (16):
Asset ManagementVulnerability MgmtMulti-Factor AuthBackup & RecoveryPrivileged AccessEndpoint ProtectionPatch ManagementSecure ConfigEmail SecurityCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCIncident ResponseReportingDisaster Recovery
Only ISO 27001 (34):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceRisk AssessmentBusiness EnvironmentData ClassificationThreat IntelligenceAccess ControlEncryptionData ProtectionFirewall / Net SegSecure DevelopmentWeb SecurityZero TrustMobile SecurityCloud SecurityDNS SecurityWAFDLPIntrusion DetectionForensicsCommunicationMitigationRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreAPI SecurityInsider ThreatVendor Risk MgmtPhysical Security
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.