The Essential Eight does not include a dedicated software supply chain strategy, but four of its eight strategies touch it: patching applications, application control, restricting administrative privileges and regular backups. Dependency inventory and vulnerability response help you evidence the patching strategies, and little else maps cleanly.
What is the Essential Eight?
The Essential Eight is a baseline of eight mitigation strategies published by the Australian Signals Directorate. They are application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups. Organisations pick a target maturity level and move up progressively (ASD maturity model).
ASD advises achieving a maturity level as a package, rather than reaching a high level in a few strategies at the expense of others.
Which strategies touch the supply chain?
Be precise here, because stretching a mapping is how compliance claims go wrong.
Patch applications. This is the strongest link. The ASD material describes timelines such as 48 hours for critical vulnerabilities in internet-facing systems where vendors rate them critical or working exploits exist, and one month for workstations and non-internet-facing servers. Those timelines are written for deployed applications, so check the current text for scope. For software you build, the open source libraries inside it are your "applications" to patch. You cannot patch what you cannot list, so a dependency inventory is the prerequisite.
Application control. This strategy limits execution to an approved set of executables, libraries, scripts and installers. For build and developer machines, an approved package source list and pinned dependencies serve the same intent: only known code runs.
Restrict administrative privileges. Privileged users get a separate account used only for privileged duties. In a pipeline, that translates to scoped CI tokens and no standing admin credentials on build runners.
Regular backups. Unprivileged accounts must not modify or delete backups, and restoration is tested. For supply chain, a copy of your artifact registry and signing material belongs in scope.
What does not map?
Office macros, user application hardening for browsers and PDF readers, and multi-factor authentication are about endpoint and identity risk. Dependency scanning does not satisfy them. MFA matters for package registry and source control accounts, but that is an account control, not a supply chain tool.
Nor does the Essential Eight address provenance, build integrity or SBOM exchange. If a customer expects those, point to frameworks that cover them, such as NIST's SSDF, and say the Essential Eight is a different, narrower baseline.
How should you present evidence?
Assessors want to see that a control is implemented and operating. For patching, that means dated scan results, a list of applications in scope and a record of how fast critical findings were closed. Keep the raw export, not just a dashboard screenshot.
Do not claim that a tool makes you "Essential Eight compliant." ASD's maturity model is assessed against specific requirements, and a scanner covers some of them.
What to do
- Choose a target maturity level and confirm it with whoever assesses you.
- Build an inventory of applications and the libraries inside them, with an SBOM per build.
- Scan on a schedule and record the date a finding was opened and closed.
- Set internal deadlines that match or beat the patching timelines for your maturity level.
- Restrict build tokens and keep admin accounts separate.
- Back up your registry and signing keys, and test a restore.
- Write down what the Essential Eight does not cover and what you use instead.
Open the full walkthrough at /demos/framework-mapping.
Quick check
Does the Essential Eight require an SBOM?
Not that we found. An inventory of software helps you meet the patching strategies, but the model does not mandate SBOMs.
Which maturity level should we aim for?
ASD says level one may suit small to medium enterprises, level two large enterprises and level three critical infrastructure and high threat environments.
Sources
Last reviewed: 18 October 2026.
