You automate Essential Eight evidence by pulling it from the systems that enforce each control (patch tools, identity provider, backup console) on a schedule and storing it with a date. Screenshots taken the week before an assessment are the weak version. Exported settings and logs, collected every month, are the strong one.
What are we collecting evidence for?
The Essential Eight is the Australian Signals Directorate's baseline of eight mitigation strategies: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. The maturity model rates implementation from Level Zero to Level Three, and the assessment process guide describes how an assessor decides whether a strategy counts as implemented.
One detail from ASD's assessment guidance shapes everything below: for patch applications, assessors need all the controls in that strategy to be effective before it is claimed as implemented. Partial evidence does not add up to a pass. So collect evidence per control, not per tool.
One note before you build anything
ASD has released a successor framework, ASD Essentials, and a transition guide. Press coverage reports that the Essential Eight stays published alongside it for now, and that existing controls and evidence count toward the new framework, though ASD advises checking them rather than assuming they are equivalent. Collect evidence that is useful under either. Check cyber.gov.au for the current timeline before you plan a long project.
Which evidence can a machine collect?
Most of it. Think in three kinds.
Configuration exports. The setting that enforces the control, exported as it stands. Examples: the conditional access or MFA policy from your identity provider, the allow list from your application control tool, the macro policy from your device management console.
State reports. What is true across the fleet right now: patch compliance by device, accounts with administrative rights, backup job success by system.
Test results. ASD guidance says restoring from backups should be tested at least annually, so a dated restore test record is evidence a log cannot replace.
What does the evidence look like for each strategy?
- Patch applications and operating systems: scanner output showing what is installed, what is missing, and how old each gap is. Keep the report each month, not just the latest.
- Multi-factor authentication: the policy export plus a list of accounts exempt from it. ASD guidance says MFA must apply to re-authentication as well as sign in.
- Restrict administrative privileges: a dated list of privileged accounts with an owner and reason for each. ASD guidance expects privileged users to have a dedicated account used only for privileged work.
- Application control: the rule set, showing it covers executables, libraries, scripts and installers.
- Office macros and application hardening: the group policy or device management settings, exported.
- Regular backups: job logs, retention settings, proof that unprivileged accounts cannot change or delete backups, and the restore test record.
How do you keep it trustworthy?
Automation can produce a lot of files nobody can defend. A few habits keep it honest.
Store each export with a timestamp and the name of the job that produced it. Do not overwrite last month. Keep a short list of known exceptions with an owner and an expiry date, because an assessor will find them anyway. And have a person read a sample of the collected evidence each quarter. A job that quietly exports an empty file for six months is worse than no job.
Where your own software is in scope, dependency inventories and vulnerability scans can feed the patching evidence. Safeguard's CLI generates SBOMs and scans many package managers, and its compliance automation can gather scan results, but it does not make you compliant and does not certify anything. The assessment is still done against your environment.
What to do
- List each of the eight strategies and, for each control inside it, the system that enforces it.
- For each system, decide the export or report that proves the setting and the state.
- Schedule the export monthly and write it to a dated, access controlled folder or evidence store.
- Record exceptions with an owner and an expiry date.
- Add an annual backup restore test with a written result.
- Review a sample of the evidence every quarter and fix silent failures.
- Check cyber.gov.au for the current status of the Essential Eight and ASD Essentials.
Quick check
Is a screenshot enough evidence for an Essential Eight assessment?
It can support a claim, but it shows one moment and is easy to challenge. Dated exports and logs collected on a schedule are stronger because they show the control held over time.
Does automating evidence make an organisation compliant?
No. It makes the proof easier to produce and to trust. The controls still have to be in place and effective, and an assessor decides that.
Sources
- ASD Essential Eight maturity model
- ASD Essential Eight assessment process guide
- ASD Essential Eight maturity model FAQ
- ASD: Transitioning from the Essential Eight
- iTnews: ASD's Essential Eight replacement moves away from maturity ladder
Last reviewed: 18 October 2026.
