Essential Eight requirements matrix

This is the reference table behind the Essential Eight guide. Every requirement below is drawn from the Essential Eight Maturity Model (November 2023), which is the current release. There has been no revision since 27 November 2023.

Requirements are cumulative: Maturity Level Two includes everything at Level One unless a row supersedes it. A dash means the requirement does not exist at that level. Information Security Manual (ISM) control identifiers come from ASD's own Essential Eight to ISM mapping of October 2024.

Every row has a stable anchor, so you can link to a single requirement rather than to the page.

How to read a maturity level

Before the tables, three rules that change what the numbers mean.

A level is all-or-nothing within a strategy

From the Assessment Process Guide:

If one of the controls specified for a mitigation strategy is assessed as 'ineffective', the system owner cannot claim to have met the requirements for that maturity level.

There is no partial credit and no averaging inside a strategy.

Your overall level is your weakest strategy

If maturity differs between strategies, the organisation's overall maturity is the level of its least mature strategy. Seven strategies at Level Two and one at Level Zero is an organisation at Level Zero.

Declining a whole strategy scores Level Zero

ASD addresses risk acceptance directly:

Note, system owners that seek to use risk acceptance without compensating controls, or risk transference (e.g. by sourcing cyber insurance), as justification for not implementing an entire mitigation strategy, such as application control or multi-factor authentication, will be considered to have not protected themselves against a specific class of cyber threat and will subsequently be assessed as Maturity Level Zero for both that mitigation strategy and their overall Essential Eight implementation.

Compensating controls are permitted, but the bar is that they "provide an equivalent level of protection" to the specific requirement being compensated for. Exceptions must be documented, approved, and should not run beyond one year.

1. Patch applications

What counts as "critical". ASD's guidance is that vendors assess a vulnerability as critical where, for example, "it facilitates authentication bypasses that grant privileged access or facilitates remote code execution without user interaction". Where a vendor gives no rating, ASD suggests considering the Common Vulnerability Scoring System (CVSS) score and the US Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities Catalog.

How the 48-hour requirement is triggered. For vulnerabilities rated critical by the vendor, the model measures 48 hours from the release of a patch, update or other vendor mitigation. When a working exploit is the trigger, ASD's FAQ says the requirement relates to "the announcement of a working exploit or that exploitation is already occurring, whichever occurs first".

Full detail: patch applications.

2. Patch operating systems

Note the direction of travel. The November 2023 update relaxed the workstation and non-internet-facing timeframe from two weeks to one month. The associated scanning moved from weekly to fortnightly. ASD called this a counter-balance to the tightening elsewhere. Guides claiming this got stricter are quoting the pre-2023 model.

Full detail: patch operating systems.

3. Multi-factor authentication

What does not count as a factor. ASD is specific: security questions are not a recognised memorised secret; "Trusted Signals" cannot be a primary factor; and biometrics can only be a secondary factor unlocking something you have. Also, "remember this computer" fails the definition outright, because the token verifies the browser rather than the user. And multi-step authentication is not a substitute for multi-factor.

Phishing-resistant means smart cards, security keys, Windows Hello for Business or passkeys, not SMS or voice calls. ASD prefers FIDO2 Level 2 certification over Level 1.

Full detail: multi-factor authentication.

4. Restrict administrative privileges

Online-service administration is an explicit exception. The internet restriction excludes accounts authorised to access online services. ASD's Assessment Process Guide gives privileged accounts used to manage cloud services as an example. The authorisation must be explicit and access limited to what the account needs.

Full detail: restrict administrative privileges.

5. Application control

What application control is not. ASD says none of the following satisfies the strategy:

• providing a portal for installing approved applications
• using web or email content filtering to stop downloads
• checking an application's reputation with a cloud service before execution
• using a next-generation firewall to identify traffic by application

Full detail: application control.

6. Restrict Microsoft Office macros

A removal, not an addition. ASD deleted the macro execution event logging requirement in the November 2023 update. It cited a lack of native support in Microsoft Windows, and "advice from incident responders and threat hunters that such events provide limited benefit". Any guide still listing it is quoting a superseded model.

Full detail: restrict Microsoft Office macros.

7. User application hardening

Java is not JavaScript. ASD answers this directly: blocking web browsers from processing Java from the internet does not include JavaScript. This strategy also applies to servers, not only workstations.

Full detail: user application hardening.

8. Regular backups

There is no retention number here. Not three months, not thirty days. The "at least three months" figure comes from the separate 2017 Strategies to Mitigate Cyber Security Incidents, which also describes backups as "stored disconnected". The current maturity model instead uses a business-criticality and continuity test.

Full detail: regular backups.

Evidence assessors evaluate

The requirements above are what must be true. The Assessment Process Guide governs how that gets tested, and it ranks evidence in four tiers:

ASD is direct about the implication: "Conducting assessments using interviews, reports and screenshots will always be inferior to conducting assessments using scripts and tools."

Each control is then given one of seven outcomes: not assessed, effective, alternate control, ineffective, no visibility, not implemented, or not applicable.

Audit findings show the difference between documenting a control and demonstrating that it works. The ANAO found entities that "relied on documenting policies and procedures to achieve compliance" rather than implementing the strategies. The WA Auditor General found seven of ten audited entities had overstated their own maturity.

You can score yourself against these requirements, but the result is only as strong as the evidence used. ASD ranks tool-based testing above interviews, reports and statements of intent.