You can track the Essential Eight in spreadsheets with a matrix of eight strategies against your systems and a target maturity level for each. It breaks when asset counts grow and evidence goes stale. Automate the evidence for patching, admin privileges and backups first, and keep judgment calls in human hands.
What is the Essential Eight?
The Australian Signals Directorate publishes the Essential Eight as eight mitigation strategies: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups. A maturity model has levels One to Three, with Level Zero where Level One is not met. ASD advises choosing a target level, reaching the same level across all eight, then moving up, using a risk based approach. Search results cite an assessment process guide updated October 2024 and a model released November 2023. Our direct fetch of the ASD pages timed out, so confirm the current model version on cyber.gov.au.
A spreadsheet that works
Sheet 1, Scope. Systems and user groups in scope, with owner and environment type.
Sheet 2, Matrix. Rows are the eight strategies. For each, record the target maturity level, the current level you can prove, the requirement text you are measuring against, the tool or setting that implements it, and the evidence link. Colour is fine, but the evidence link is what matters.
Sheet 3, Assets. One row per device or server group: operating system, patch status, application control mode, admin accounts, backup coverage, last verified date.
Sheet 4, Exceptions. Any system that cannot meet a requirement, the reason, a compensating control, an owner and an expiry date.
Sheet 5, Actions. Gaps with owner, date and status.
What goes well by hand?
Choosing the target level, scoping, deciding exceptions and writing the narrative. These are judgment calls and belong to people.
Where does it break?
- Patch timelines. The model sets time based expectations for patching, and proving them needs data from every asset. Hand collected data goes stale in days.
- Admin privilege lists. Privileged accounts change constantly. A monthly export is a snapshot, not a control.
- Application control. Rules and exceptions live in the tooling, and copying them into cells invites mismatch.
- Backup proof. A line that says "backups run" is not a restore test with a date.
- Level consistency. One unpatched system quietly drops your overall level, and a sheet will not tell you.
When to automate
Automate when you have more than a few dozen endpoints or several cloud accounts, when evidence refresh takes more time than fixing, or when assessors or customers ask for current numbers. Start with the strategies that produce data automatically: patch status, privileged account lists, MFA enforcement and backup job results.
An interim routine for spreadsheet teams
Weekly: pull patch status and update the Assets sheet.
Monthly: export admin accounts and review them, check backup restore logs, review exceptions near expiry.
Quarterly: test a restore, review application control rules and macro policy, reassess the target level.
Mistakes to avoid
- Declaring a maturity level with no evidence per strategy.
- Counting a strategy as met when it covers only part of the estate.
- Exceptions with no expiry.
- Never testing a restore.
What to do
- Pick a target maturity level and write the scope.
- Build the five sheets with an evidence link per strategy.
- Populate the Assets sheet from system exports, not memory.
- Record each exception with a compensating control and expiry.
- Run the weekly, monthly and quarterly routine for two cycles.
- Measure hours spent on evidence versus fixing.
- Move patch, privilege, MFA and backup evidence to automation first.
Quick check
What are the eight strategies?
Patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.
Should I aim for the same level across all eight?
ASD advises reaching the same maturity level across all eight before aiming higher, using a risk based approach.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits. Patch, privilege and backup data are exactly the facts that go stale in a sheet.
Technical evidence comes from your real code and dependencies, through scans, SBOMs and reachability, which helps with application patching and knowing what software you run. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and set the approval level. Essential Eight assessments are done by assessors you choose, not by Safeguard. Safeguard helps prepare and keep evidence ready.
Want to see it on your own stack? Book a call.
Sources
Last reviewed: 18 October 2026.
