Framework
ASD Essential Eight
What it is
The Australian Signals Directorate's eight prioritised mitigation strategies, with a Maturity Model from Level One to Level Three. The requirements are controls in ASD's Information Security Manual (ISM); ControlMapping lists the ISM controls tagged for the Essential Eight.
Who needs it
Mandatory for Australian Government non-corporate Commonwealth entities (target Maturity Level Two); widely used by Australian organisations and asked for by insurers. See the Essential Eight guide.
How it's assessed
No certificate. Assessed against ASD's Essential Eight Assessment Process Guide, internally or by third-party assessors, one strategy and level at a time.
Read the guide: The Essential Eight: a practical guide →
The eight strategies, by maturity level
Patch applicationsPatch operating systemsMulti-factor authenticationRestrict administrative privilegesApplication controlRestrict Microsoft Office macrosUser application hardeningRegular backups
126
ISM controls
57
Mapped to another framework
32%
Topics covered (16/50)
Essential Eight here means the ISM controls ASD tags for Maturity Levels One to Three; each row shows its levels (ML1–ML3). ASD publishes no crosswalk to other frameworks, so every match is ControlMapping editorial.
Comparisons
Requirements
| ID | Requirement | Topics | Mapped in |
|---|---|---|---|
| Patch applications · 12 | |||
| ISM-0304 | Applications other than office productivity suites, web browsers and their extensions… | — | |
| ISM-1690 | Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… | — | |
| ISM-1691 | Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release | Patch Management | 10 of 13 |
| ISM-1692 | Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… | — | |
| ISM-1693 | Patches, updates or other vendor mitigations for vulnerabilities in applications other… | Patch Management | 10 of 13 |
| ISM-1698 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online… | Vulnerability Mgmt | 13 of 13 |
| ISM-1699 | A vulnerability scanner is used at least weekly to identify missing patches or updates… | Vulnerability Mgmt | 13 of 13 |
| ISM-1700 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office… | — | |
| ISM-1704 | Office productivity suites, web browsers and their extensions, email clients, PDF… | Patch Management | 10 of 13 |
| ISM-1876 | Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of… | Patch Management | 10 of 13 |
| ISM-1901 | Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when… | — | |
| ISM-1905 | Online services that are no longer supported by vendors are removed | — | |
| Patch applications & Patch operating systems · 2 | |||
| ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | Asset Management, Vulnerability Mgmt | 13 of 13 |
| ISM-1808 | A vulnerability scanner with an up-to-date vulnerability database is used for… | Vulnerability Mgmt | 13 of 13 |
| Patch operating systems · 15 | |||
| ISM-1407 | The latest release, or the previous release, of operating systems are used | — | |
| ISM-1501 | Operating systems that are no longer supported by vendors are replaced | Patch Management | 10 of 13 |
| ISM-1694 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… | — | |
| ISM-1695 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release | Patch Management | 10 of 13 |
| ISM-1696 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of… | — | |
| ISM-1697 | Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release… | — | |
| ISM-1701 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in… | Vulnerability Mgmt | 13 of 13 |
| ISM-1702 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of… | Vulnerability Mgmt | 13 of 13 |
| ISM-1703 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers | — | |
| ISM-1877 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours… | Patch Management | 10 of 13 |
| ISM-1879 | Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release… | — | |
| ISM-1900 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware | — | |
| ISM-1902 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of… | — | |
| ISM-1903 | Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release… | — | |
| ISM-1904 | Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release… | — | |
| Multi-factor authentication · 16 | |||
| ISM-0974 | Multi-factor authentication is used to authenticate unprivileged human users of systems | Multi-Factor Auth | 10 of 13 |
| ISM-1173 | Multi-factor authentication is used to authenticate privileged human users of systems | Multi-Factor Auth | 10 of 13 |
| ISM-1401 | Multi-factor authentication uses either: something people have and something people… | Multi-Factor Auth | 10 of 13 |
| ISM-1504 | Multi-factor authentication is used to authenticate human users to their organisation’s online services that process… | Multi-Factor Auth | 10 of 13 |
| ISM-1505 | Multi-factor authentication is used to authenticate human users of data repositories | — | |
| ISM-1679 | Multi-factor authentication is used to authenticate human users to third-party online services that process, store or… | Multi-Factor Auth | 10 of 13 |
| ISM-1680 | Multi-factor authentication (where available) is used to authenticate human users to… | — | |
| ISM-1681 | Multi-factor authentication is used to authenticate customers to online customer… | — | |
| ISM-1682 | Multi-factor authentication used for authenticating human users of systems is… | — | |
| ISM-1683 | Successful and unsuccessful multi-factor authentication events are centrally logged | Logging & Audit | 10 of 13 |
| ISM-1872 | Multi-factor authentication used for authenticating human users of online services is… | Multi-Factor Auth | 10 of 13 |
| ISM-1873 | Multi-factor authentication used for authenticating customers of online customer services provides a… | — | |
| ISM-1874 | Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant | — | |
| ISM-1892 | Multi-factor authentication is used to authenticate human users to their organisation’s online customer services that… | — | |
| ISM-1893 | Multi-factor authentication is used to authenticate human users to third-party online customer services that process… | — | |
| ISM-1894 | Multi-factor authentication used for authenticating human users of data repositories is… | — | |
| Restrict administrative privileges · 20 | |||
| ISM-0445 | Privileged human users are assigned a dedicated privileged user account to be used… | Privileged Access | 10 of 13 |
| ISM-1175 | Privileged user accounts (excluding those explicitly authorised to access online… | Privileged Access | 10 of 13 |
| ISM-1380 | Privileged human users use separate privileged and unprivileged operating environments | Privileged Access | 10 of 13 |
| ISM-1387 | Administrative activities are conducted through jump servers | Privileged Access | 10 of 13 |
| ISM-1507 | Requests for privileged access to systems and their resources are validated when first… | Privileged Access | 10 of 13 |
| ISM-1508 | Privileged access to systems and their resources is limited to only what is required… | Privileged Access | 10 of 13 |
| ISM-1509 | Privileged access events are centrally logged | Logging & Audit | 10 of 13 |
| ISM-1647 | Privileged access to systems and their resources are disabled after 12 months unless… | Privileged Access | 10 of 13 |
| ISM-1648 | Privileged access to systems and their resources are disabled after 45 days of inactivity | Privileged Access | 10 of 13 |
| ISM-1649 | Just-in-time administration is used for the administration of systems and their resources | — | |
| ISM-1650 | Privileged user account and security group management events are centrally logged | — | |
| ISM-1685 | Credentials for break glass accounts, local administrator accounts and service accounts… | — | |
| ISM-1686 | Credential Guard functionality is enabled | — | |
| ISM-1687 | Privileged operating environments are not virtualised within unprivileged operating… | — | |
| ISM-1688 | Unprivileged user accounts cannot be used to log on to privileged operating environments | — | |
| ISM-1689 | Privileged user accounts (excluding local administrator accounts) cannot be used to log… | — | |
| ISM-1861 | Local Security Authority protection functionality is enabled | — | |
| ISM-1883 | Privileged user accounts explicitly authorised to access online services are strictly… | — | |
| ISM-1897 | Remote Credential Guard functionality is enabled | — | |
| ISM-1898 | Secure Admin Workstations are used in the performance of administrative activities | — | |
| Application control · 11 | |||
| ISM-0843 | Application control is implemented on workstations | Endpoint Protection | 10 of 13 |
| ISM-1490 | Application control is implemented on internet-facing servers | Endpoint Protection | 10 of 13 |
| ISM-1544 | Microsoft’s recommended application blocklist is implemented | Endpoint Protection | 10 of 13 |
| ISM-1582 | Application control rulesets are validated at least annually | — | |
| ISM-1656 | Application control is implemented on non-internet-facing servers | — | |
| ISM-1657 | Application control restricts the execution of executables, libraries, scripts… | Endpoint Protection | 10 of 13 |
| ISM-1658 | Application control restricts the execution of drivers to an organisation-approved set | — | |
| ISM-1659 | Microsoft’s vulnerable driver blocklist is implemented | — | |
| ISM-1660 | Allowed and blocked application control events are centrally logged | Logging & Audit | 10 of 13 |
| ISM-1870 | Application control is applied to user profiles and temporary folders used by operating… | Endpoint Protection | 10 of 13 |
| ISM-1871 | Application control is applied to all locations other than user profiles and temporary… | — | |
| Restrict Microsoft Office macros · 11 | |||
| ISM-1487 | Only privileged human users responsible for checking that Microsoft Office macros are… | — | |
| ISM-1488 | Microsoft Office macros in files originating from the internet are blocked | Endpoint Protection, Email Security | 10 of 13 |
| ISM-1489 | Microsoft Office macro security settings cannot be changed by human users | — | |
| ISM-1671 | Microsoft Office macros are disabled for human users that do not have a demonstrated… | — | |
| ISM-1672 | Microsoft Office macro antivirus scanning is enabled | — | |
| ISM-1673 | Microsoft Office macros are blocked from making Win32 API calls | — | |
| ISM-1674 | Only Microsoft Office macros running from within a sandboxed environment, a Trusted… | — | |
| ISM-1675 | Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled… | — | |
| ISM-1676 | Microsoft Office’s list of trusted publishers is validated at least annually | — | |
| ISM-1890 | Microsoft Office macros are checked to ensure they are free of malicious code before… | — | |
| ISM-1891 | Microsoft Office macros digitally signed by signatures other than V3 signatures cannot… | — | |
| User application hardening · 20 | |||
| ISM-1412 | Web browsers are hardened using ASD and vendor hardening guidance, with the most… | Secure Config | 9 of 13 |
| ISM-1485 | Web browsers do not process web advertisements from the internet | — | |
| ISM-1486 | Web browsers do not process Java from the internet | — | |
| ISM-1542 | Microsoft Office is configured to prevent activation of Object Linking and Embedding… | — | |
| ISM-1585 | Web browser security settings cannot be changed by human users | Secure Config | 9 of 13 |
| ISM-1621 | Windows PowerShell 2.0 is disabled or removed | Secure Config | 9 of 13 |
| ISM-1622 | PowerShell is configured to use Constrained Language Mode | — | |
| ISM-1623 | PowerShell module logging, script block logging and transcription events are centrally… | Logging & Audit | 10 of 13 |
| ISM-1654 | Internet Explorer 11 is disabled or removed | Secure Config | 9 of 13 |
| ISM-1655 | .NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed | — | |
| ISM-1667 | Microsoft Office is blocked from creating child processes | — | |
| ISM-1668 | Microsoft Office is blocked from creating executable content | — | |
| ISM-1669 | Microsoft Office is blocked from injecting code into other processes | — | |
| ISM-1670 | PDF applications are blocked from creating child processes | — | |
| ISM-1823 | Office productivity suite security settings cannot be changed by human users | — | |
| ISM-1824 | PDF application security settings cannot be changed by human users | — | |
| ISM-1859 | Office productivity suites are hardened using ASD and vendor hardening guidance, with… | Secure Config | 9 of 13 |
| ISM-1860 | PDF applications are hardened using ASD and vendor hardening guidance, with the most… | Secure Config | 9 of 13 |
| ISM-1889 | Command line process creation events are centrally logged | — | |
| ISM-1896 | Memory integrity functionality is enabled | — | |
| Regular backups · 11 | |||
| ISM-1511 | Backups of data, applications and settings are performed and retained in accordance… | Backup & Recovery | 11 of 13 |
| ISM-1515 | Restoration of data, applications and settings from backups to a common point in time… | Backup & Recovery, Disaster Recovery | 11 of 13 |
| ISM-1705 | Privileged user accounts (excluding backup administrator accounts) cannot access… | — | |
| ISM-1706 | Privileged user accounts (excluding backup administrator accounts) cannot access their… | — | |
| ISM-1707 | Privileged user accounts (excluding backup administrator accounts) are prevented from… | Backup & Recovery | 11 of 13 |
| ISM-1708 | Backup administrator accounts are prevented from modifying and deleting backups during… | — | |
| ISM-1810 | Backups of data, applications and settings are synchronised to enable restoration to a… | Backup & Recovery | 11 of 13 |
| ISM-1811 | Backups of data, applications and settings are retained in a secure and resilient manner | Backup & Recovery | 11 of 13 |
| ISM-1812 | Unprivileged user accounts cannot access backups belonging to other user accounts | — | |
| ISM-1813 | Unprivileged user accounts cannot access their own backups | — | |
| ISM-1814 | Unprivileged user accounts are prevented from modifying and deleting backups | Backup & Recovery | 11 of 13 |
| Logging and incident response (all strategies) · 8 | |||
| ISM-0109 | Event logs from workstations are analysed in a timely manner to detect cyber security… | Cont. Monitoring | 10 of 13 |
| ISM-0123 | Cyber security incidents are reported to the chief information security officer, or one… | Reporting | 12 of 13 |
| ISM-0140 | Cyber security incidents are reported to ASD as soon as possible after they occur or… | Reporting | 12 of 13 |
| ISM-1228 | Cyber security events are analysed in a timely manner to identify cyber security incidents | Anomaly Detection, SIEM / SOC | 10 of 13 |
| ISM-1815 | Event logs are protected from unauthorised modification and deletion | Logging & Audit | 10 of 13 |
| ISM-1819 | Following the identification of a cyber security incident, the cyber security incident… | Incident Response | 12 of 13 |
| ISM-1906 | Event logs from internet-facing servers are analysed in a timely manner to detect cyber… | Cont. Monitoring, SIEM / SOC | 10 of 13 |
| ISM-1907 | Event logs from non-internet-facing servers are analysed in a timely manner to detect… | Cont. Monitoring | 10 of 13 |
Topic coverage
Topics with mapped Essential Eight requirements (16):
Asset ManagementVulnerability MgmtMulti-Factor AuthBackup & RecoveryPrivileged AccessEndpoint ProtectionPatch ManagementSecure ConfigEmail SecurityCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCIncident ResponseReportingDisaster Recovery
No mapping in our data No Essential Eight requirement (34):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceRisk AssessmentBusiness EnvironmentData ClassificationThreat IntelligenceAccess ControlEncryptionData ProtectionFirewall / Net SegSecure DevelopmentWeb SecurityZero TrustMobile SecurityCloud SecurityDNS SecurityWAFDLPIntrusion DetectionForensicsCommunicationMitigationRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreAPI SecurityInsider ThreatVendor Risk MgmtPhysical Security