Scope the Essential Eight by listing the systems you will cover, picking one target maturity level for all eight strategies, and writing down every exclusion with a reason. Assessors expect the eight to be implemented and assessed as a package, so a vague boundary costs you time later.
What are the eight, and why does scope come first?
The Australian Signals Directorate (ASD) calls the Essential Eight its most effective prioritised mitigation strategies: application control, patch applications, Microsoft Office macro settings, user application hardening, restricted administrative privileges, patch operating systems, multi-factor authentication and regular backups.
Every one of them acts on a population: workstations, servers, network devices, user accounts, backup sets. If you have not agreed which population you mean, you cannot say whether a control is "effective". The 2022 assessment process guide makes scope the second of four assessment stages for exactly that reason, and it asks that the scope be written into the report.
Which systems belong inside the boundary?
Start from what an attacker would reach, not from your org chart. A workable first pass:
- Every corporate workstation and laptop that staff use to read mail and browse.
- Servers that hold business data or face the internet.
- Network devices that carry that traffic.
- Identity systems and the accounts that administer all of the above.
- Backup systems and the data they protect.
Then decide what is out. Typical candidates are a lab network, a guest Wi-Fi segment or an acquired company still on its own domain. ASD's guide says anything deemed out of scope should be documented with a justification, so "we did not get to it" is not an exclusion, it is a gap.
The guide also notes that the Essential Eight can be applied to non-Windows systems, but some strategies, or parts of them, may not apply or may not be the most effective choice. For Linux servers, cloud computing and enterprise mobility it points to alternative ASD guidance. Note those platforms in your scope document and say which guidance you followed for them.
How do you pick the target maturity level?
ASD defines Maturity Levels One to Three, plus Level Zero for "Level One not met". Each level is tied to a type of adversary. Level One targets people using commodity tradecraft, such as a public exploit against an unpatched internet-facing service or stolen, reused or guessed credentials. ASD's FAQ suggests Level One may suit small to medium organisations and Level Two larger ones, but it is guidance, not a rule.
Two points from the assessment guide matter for planning. First, assess one level at a time: if you have not shown Level One, do not start on Level Two. Second, the guidance for each level is cumulative, so Level Two assessors test what is added on top of Level One.
Independent certification is not required by ASD. A directive, regulator or customer contract may still require an assessment, so check your contracts before deciding how formal to be.
What will assessors treat as good evidence?
The guide ranks evidence in four grades. Testing a control with a simulated activity is excellent. Looking at live configuration through the system's interface is good. Reports or screenshots of configuration are fair. A policy or a verbal statement is poor. Scripts and tools that check many machines beat sampling by hand.
That ranking should shape your scope notes. For each in-scope population, write down how you will prove the control: which tool, which sample, which report.
What to do
- Write a one page boundary statement: business units, networks, platforms and account types that are in.
- List exclusions, each with a reason, an owner and a review date.
- Build an inventory of workstations, servers and network devices with operating system, owner and last seen date.
- Pick one target maturity level and write down why. Check the current maturity model on cyber.gov.au, because the model has been revised since the 2022 guide.
- Note any non-Windows platforms and name the guidance you will apply to them.
- For each strategy, name the tool or report that will give you good or excellent evidence.
- Get the boundary statement approved by someone with authority over the systems, and store it with a date.
Mistakes to avoid
Scoping only the corporate laptops and forgetting the servers. Treating exceptions as informal: ASD expects them approved through a formal process with compensating controls documented. Choosing Level Three because it sounds safer, then discovering you cannot evidence Level One.
Quick check
Can I implement only some of the Essential Eight?
ASD's guide says the eight are implemented and assessed as a package. You can sequence the work, but an assessment against a maturity level covers all eight.
Do I need certification?
ASD's FAQ says there is no requirement for independent certification. A contract or regulator can still require an assessment.
How Safeguard helps automate this
Scope documents go stale the day after they are signed. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence for in-scope systems is collected from connected systems and code instead of by screenshot, and monitoring runs between assessments. For the patching side of the eight, technical evidence comes from your real code and dependencies: scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. Safeguard helps you prepare and keep evidence ready; an independent assessor still does the assessment. Book a call to see how this maps to your scope.
Sources
- Essential Eight Assessment Process Guide 2022, reproduced by the WA Cyber Security Unit. The ASD pages on cyber.gov.au blocked our fetch, so details come from this reproduction.
- ASD Essential Eight Maturity Model and Maturity Model FAQ: maturity level descriptions and the certification statement, as shown in search results. Check the current text before relying on it.
Last reviewed: 18 October 2026.
