Requirements & evidence
ASD Essential Eight
The Australian Signals Directorate's prioritized baseline of eight cyber mitigations, implemented through maturity levels zero to three. Independent assessment may be required by policy or contract, but the model is not a universal certification scheme.
- Edition on record
- Maturity Model (November 2023)
- Issuing authority
- Australian Signals Directorate — Australian Cyber Security Centre (opens in a new tab)
- Edition published
- Source last checked
Understand the scope
What the framework covers.
The library records this framework for government, critical infrastructure, all sectors, across AU. The issuing authority determines applicability; your assessment scope should identify the organization, systems, services, and edition being assessed.
Areas of requirement
- Application control
- Patch applications
- Configure Microsoft Office macro settings
- User application hardening
- Restrict administrative privileges
- Patch operating systems
- Multi-factor authentication
- Regular backups
8 source entries on record
Eight mitigation strategies in the Essential Eight. This is not a count of maturity-level requirement statements or ISM controls.
Source access and licensing
ASD publishes the maturity model and OSCAL-aligned ISM profiles. Pin the November 2023 model and Australian Government reuse terms before normalization.
Prepare with context
The evidence behind
the requirements.
Evidence needs to demonstrate how a requirement is met within the assessment scope. Keep the source requirement, collection context, responsible owner, review decision, and period of applicability together.
A framework-specific collection workflow has not been activated. The reference material on this page can inform scoping and preparation; it does not establish evidence collection or assessment readiness.
ControlFrame availability
Framework reference available
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
How availability is determined
ASD Essential Eight is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
Catalog status: Planned. Tracked metadata: we record the regime and its issuing authority for review. Registry presence does not mean automated monitoring is active. No control or requirement model is implemented.
Metadata only; mitigation requirements, maturity-level criteria, and ISM crosswalks are not ingested or released as a product module.
Follow the source
Editions and transitions.
These are the editions recorded in the library, checked August 30, 2026. Confirm the applicable edition with the authority before beginning an assessment.
- Maturity Model (November 2023)Current edition on record
Check the basis
Sources you can follow.
Verified against the issuing authority’s own publication. Source verification was recorded on August 30, 2026.
- Australian Signals Directorate — Australian Cyber Security Centre (opens in a new tab)
Issuing authority and framework publication.
Catalog provenance and record details
Framework record: asd-essential-eight-2023.
Source artifact: acquisition required.
Parsed catalog: Not ingested.
Control families as published: Application control · Patch applications · Configure Microsoft Office macro settings · User application hardening · Restrict administrative privileges · Patch operating systems · Multi-factor authentication · Regular backups.
Record last updated: August 30, 2026.
Common questions
A closer look.
What is ASD Essential Eight?
The Australian Signals Directorate's prioritized baseline of eight cyber mitigations, implemented through maturity levels zero to three. Independent assessment may be required by policy or contract, but the model is not a universal certification scheme.
Who does ASD Essential Eight apply to?
ASD Essential Eight applies to government, critical infrastructure, all sectors, AU, per Australian Signals Directorate — Australian Cyber Security Centre.
What is the current version of ASD Essential Eight?
The current edition is Maturity Model (November 2023), issued by Australian Signals Directorate — Australian Cyber Security Centre and published 2023-11-27. Source: https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model.
What does an assessment under ASD Essential Eight require?
8 control units are on record (Eight mitigation strategies in the Essential Eight. This is not a count of maturity-level requirement statements or ISM controls.), organized into 8 control families: Application control, Patch applications, Configure Microsoft Office macro settings, User application hardening, Restrict administrative privileges, Patch operating systems, Multi-factor authentication, Regular backups.
At a glance
ASD Essential Eight
Maturity Model (November 2023)
- Framework reference
- Authority and edition tracked
- Evidence preparation
- Framework reference available
- Source confidence
- Primary authority
A framework reference describes requirements. Evidence decisions belong to a scoped assessment and a named reviewer.
Make the requirements
part of the work.
Explore how ControlFrame can organize ASD Essential Eight requirements, evidence preparation, and review for your assessment scope.