An Essential Eight assessor asks for proof that each control is in place and working. Tested behaviour counts most, configuration views and exports count less, and a policy or verbal statement counts least. Collect evidence per mitigation strategy against the maturity level you are targeting.
What is the Essential Eight, briefly?
It is a baseline from the Australian Signals Directorate's cyber security centre. The eight mitigation strategies are patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening, and regular backups. A maturity model describes how well each is implemented.
The guidance itself says the Eight can help mitigate most cyber threats but will not mitigate all of them. Treat it as a floor.
How is evidence ranked?
The assessment process guide sorts evidence into four quality levels. At the top is testing a control with a simulated activity designed to confirm it is in place and effective. Below that sits reviewing configuration through the system interface, then reviewing exported copies such as reports or screenshots. At the bottom is a policy or verbal statement of intent. Assessors are told to use the highest quality evidence that is reasonably practicable.
That ordering should change how you prepare. A beautifully written patching policy is the weakest thing you can hand over. A live demonstration that an unapproved executable is blocked is the strongest.
What does an assessment look like?
The guide describes four stages: planning and preparation, setting the assessment boundary and approach, assessing the controls for each mitigation strategy, and writing the security assessment report. The boundary matters. Decide early which systems are in scope, because every later piece of evidence has to relate to them.
Where a strategy does not fit your environment, such as some Linux, cloud or mobile setups, the guide points you to other ASD guidance. If you rely on a compensating control, it must give equivalent protection to the recommended one.
What evidence fits each strategy?
These are practical suggestions for gathering proof, shaped by the maturity model wording. Check the current model for exact requirements.
- Patch applications: patch timing records. The model cited two weeks for office suites, browsers and extensions, email clients, PDF software and security products at Maturity Level Two, one month for other applications, and 48 hours at Level Three when a vulnerability is rated critical or an exploit exists. Show scanner output and deployment timestamps, not intent.
- Patch operating systems: the same idea, with an inventory so the assessor can see nothing in scope is missing.
- Multi-factor authentication: identity provider settings and a test login that fails without the second factor.
- Restrict administrative privileges: a list of privileged accounts, and evidence about unused ones. At Level Two the model flags privileged accounts not used within 45 days as candidates for disabling.
- Application control: a blocked test executable, and coverage for all locations on disk where path rules are used.
- Macros and user application hardening: policy exports plus a test file that behaves as the policy says.
- Regular backups: restore test records. The model expects restores to be tested at least annually and unprivileged users to be unable to modify or delete backups.
Where do software dependencies fit? Patching applications includes the software you build on. An accurate inventory of components, and dated records of when vulnerable ones were fixed, supports the patching evidence. A tool can help produce that inventory, but no tool makes you compliant, and Safeguard does not certify anyone against the Essential Eight.
What to do
- Pick the target maturity level and write the scope boundary down.
- For each strategy, list the best evidence you can realistically produce, aiming at tested behaviour first.
- Run the tests yourself before the assessor does, and keep the outputs.
- Export configurations with dates, so they can be tied to the assessment window.
- Keep patch records that show detection date, fix date and system.
- Schedule and record a backup restore test.
- Note any compensating control and why it is equivalent.
- Read the current assessment guide and maturity model, since versions change.
Quick check
Is a written policy enough evidence?
No. The guide ranks a policy or verbal statement of intent as the poorest evidence. Assessors are told to use the highest quality evidence reasonably practicable.
Does the Essential Eight stop every attack?
No. ASD says it can help mitigate most threats but will not mitigate all of them.
Sources
- Essential Eight assessment process guide, cyber.gov.au
- Essential Eight maturity model, cyber.gov.au
- Essential Eight explained, cyber.gov.au
Last reviewed: 18 October 2026.
