ASD Essential Eight Readiness Checklist

Only approved applications and code should run — this prevents malware and unauthorised software execution.

New software should be approved through a controlled, auditable process rather than broad exceptions.

Blocked executions should be logged, reviewed and used to tune allow-lists — not ignored.

High-risk applications must be patched quickly to reduce exposure to known exploits.

You must know what applications exist and which ones present the highest risk before you can patch them consistently.

Patch compliance evidence must be repeatable, consistent and easy to produce for auditors.

Macros are a common attack vector — blocking Internet-sourced macros by default is a baseline control.

Controls that are not consistently deployed provide no protection for unmanaged or unpatched devices.

Exceptions to macro controls should be rare, formally approved and periodically reviewed.

Reducing the browser attack surface limits options for drive-by and watering-hole attacks.

Blocking executable downloads for standard users removes a common malware delivery path.

Hardening controls can drift — periodic verification ensures they remain effective.

Limiting standing administrative access reduces the blast radius of credential compromise.

Regular access reviews ensure only authorised users retain administrative access over time.

Separating admin from day-to-day activity reduces risk of credential theft through phishing or malware.

Operating systems must be patched within defined timeframes to reduce exploit risk from known vulnerabilities.

Controlled rollout reduces operational risk from faulty patches affecting the entire fleet simultaneously.

Audit-ready OS patching evidence should be easy to produce on demand.

MFA is mandatory for high-risk access paths — the ACSC considers this non-negotiable.

Stronger MFA methods significantly reduce the risk of credential phishing and MFA fatigue attacks.

Emergency access must exist for resilience but be tightly controlled and alerted on.

Backups must cover critical services comprehensively to support timely recovery.

Immutable backups protect against ransomware and insider threats modifying or deleting backup data.

Backups that have never been tested cannot be relied upon for actual recovery.