ASD Essential Eight
The Australian Signals Directorate's prioritized baseline of eight cyber mitigations, implemented through maturity levels zero to three. Independent assessment may be required by policy or contract, but the model is not a universal certification scheme.
Maturity Model (November 2023) · Australian Signals Directorate — Australian Cyber Security Centre · published 2023-11-27
00Answer
01Standing
Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.
ASD Essential Eight is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.
ASD publishes the maturity model and OSCAL-aligned ISM profiles. Pin the November 2023 model and Australian Government reuse terms before normalization.
02Registry record
- Registry status
- Planned · namedTracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented.
- Control units
- 8Eight mitigation strategies in the Essential Eight. This is not a count of maturity-level requirement statements or ISM controls.
- Control families
- Application control · Patch applications · Configure Microsoft Office macro settings · User application hardening · Restrict administrative privileges · Patch operating systems · Multi-factor authentication · Regular backups
- Applies to
- government · critical infrastructure · all sectors · AU
- Verification
- Primary — the issuing body's own page was read and states this version. checked 2026-08-30
03Version ledger
| Maturity Model (November 2023) | Current edition | 2023-11-27 |
06Related frameworks
- ISO 223012019 (Amd 1:2024)
Also applies to all sectors · The certifiable business continuity management system standard for preparing for, responding to, and recovering from disruption. Tracking it does not claim that ControlFrame or any customer holds ISO 22301 certification.
- UK Cyber EssentialsRequirements for IT infrastructure v3.3
Also applies to all sectors · The UK government-backed certification scheme for five foundational technical controls. Cyber Essentials is questionnaire-based; Cyber Essentials Plus adds independent technical verification. Tracking the requirements does not claim either certificate.
Also applies to government · The FBI's security requirements for any agency or vendor that touches criminal justice information — the gate for public-safety software.
Also applies to all sectors · The widely used internal-control framework for operations, reporting, and compliance, including internal control over financial reporting. It supplies evaluation criteria; it is not a certification and SOX does not create a fixed IT-control catalog.