COMPLIANCE365

Essential Eight · ASD Essentials · Provisional · 15 October 2026

Essential Eight to Essentials: a provisional mapping

ASD published the Essentials on 15 October 2026. This is where we expect each Essential Eight strategy to sit in it, the outcome it will be measured against, and the evidence that shows it working. It is our reading, in our own words: ASD's principle and action references will be added once checked against the enterprise IT chapter.

Book a 30-min callRead the transition guide

How to read this page

  • Confirmed by ASD: the chapters (enterprise IT, cloud, operational technology), the three layers (principles, actions, domains), and reporting area by area with evidence-backed effectiveness ratings instead of one maturity level.
  • Our provisional reading: the likely area and expected outcome for each strategy. Check them against the chapter before relying on them with an auditor or a customer.
  • Unchanged: where a contract, insurer or the PSPF names the Essential Eight, the Essential Eight is still what you are assessed against.

At a glance

All eight strategies carry into the enterprise IT chapter. Patching, administrative privileges and backups are also expected to reappear in the cloud chapter.

Essential Eight strategyLikely Essentials areaAlso in
Patch applicationsInternet-facing systems; workstations; serversCloud (customer-managed software)
Patch operating systemsInternet-facing systems; workstations; serversCloud (VM images), operational technology
Multi-factor authenticationIdentity servicesCloud
Restrict administrative privilegesIdentity services; privileged accessCloud (IAM roles), operational technology
Application controlWorkstations; internet-facing serversOperational technology
Restrict Microsoft Office macrosWorkstations (office productivity)—
User application hardeningWorkstations (browsers, office, PDF)—
Regular backupsBackup and recoveryCloud, operational technology

Strategy by strategy

The biggest change is the evidence. The Essentials rates how effective each area is, so the evidence has to show a control working, not just configured. The Maturity Level Two summaries are ours, from the Essential Eight Maturity Model (November 2023); check the exact wording there.

Patch applications

Internet-facing systems; workstations; servers · also Cloud (customer-managed software)

Expected outcome provisional
Known vulnerabilities are fixed or mitigated quickly, fastest where systems face the internet or an exploit exists, and unsupported software is removed.
Maturity Level Two today
Internet-facing services patched within two weeks, or 48 hours if an exploit exists; office suites, browsers, email clients, PDF and security software within two weeks; other applications within one month; vulnerability scanning on a schedule; unsupported applications removed.
Evidence that it works
Time to patch per asset group against the target, and how many assets are outside it.
Where it sits in Microsoft 365
Defender Vulnerability Management exposure and remediation reports.
ASD reference
To be added from the enterprise IT chapter

Patch operating systems

Internet-facing systems; workstations; servers · also Cloud (VM images), operational technology

Expected outcome provisional
Operating systems stay supported and current, with internet-facing systems patched first.
Maturity Level Two today
Internet-facing servers and network devices patched within two weeks, or 48 hours if an exploit exists; workstations and other servers within one month; unsupported operating systems replaced.
Evidence that it works
Time to patch for operating systems, plus the count of unsupported versions.
Where it sits in Microsoft 365
Intune update rings and feature update reports; Defender device inventory.
ASD reference
To be added from the enterprise IT chapter

Multi-factor authentication

Identity services · also Cloud

Expected outcome provisional
Every sign-in to organisational and online services is protected by strong, phishing-resistant authentication, with exceptions known and justified.
Maturity Level Two today
MFA for users of online services and for privileged users, with stronger requirements on the methods accepted (see the maturity model for the exact wording).
Evidence that it works
Share of sign-ins covered, accounts excluded and why, failed and blocked attempts.
Where it sits in Microsoft 365
Entra Conditional Access, authentication methods and sign-in logs.
ASD reference
To be added from the enterprise IT chapter

Restrict administrative privileges

Identity services; privileged access · also Cloud (IAM roles), operational technology

Expected outcome provisional
Privileged access is limited, time-bound, separated from everyday use and logged.
Maturity Level Two today
Access validated when requested and revalidated; privileged accounts cannot use web or email; privileged access removed after inactivity; separate privileged environments; unique local administrator passwords; privileged events logged.
Evidence that it works
Count of standing admin accounts, stale accounts removed, logged elevations.
Where it sits in Microsoft 365
Entra Privileged Identity Management, access reviews, Windows LAPS, Defender for Identity.
ASD reference
To be added from the enterprise IT chapter

Application control

Workstations; internet-facing servers · also Operational technology

Expected outcome provisional
Only approved code can run, and attempts to run anything else are blocked and seen.
Maturity Level Two today
On workstations and internet-facing servers; Microsoft's recommended block rules; rulesets validated at least annually; allowed and blocked events logged.
Evidence that it works
Blocked execution events reviewed; date the ruleset was last validated.
Where it sits in Microsoft 365
App Control for Business (WDAC) through Intune; Defender advanced hunting.
ASD reference
To be added from the enterprise IT chapter

Restrict Microsoft Office macros

Workstations (office productivity)

Expected outcome provisional
Untrusted macros cannot run, and the macros that are allowed are controlled and logged.
Maturity Level Two today
Macros blocked unless needed and blocked from the internet; macros scanned; Win32 API calls from macros blocked; users cannot change settings; macro events logged.
Evidence that it works
Users with macros enabled and why; blocked macro events.
Where it sits in Microsoft 365
Intune Office policies; attack surface reduction rules.
ASD reference
To be added from the enterprise IT chapter

User application hardening

Workstations (browsers, office, PDF)

Expected outcome provisional
Everyday applications are configured to resist exploitation, and users cannot weaken them.
Maturity Level Two today
Browsers do not run web ads or Java from the internet; Office and PDF software blocked from creating child processes or injecting code; vendor hardening guidance applied; users cannot change settings.
Evidence that it works
Hardening baseline compliance per device; attack surface reduction rule hits.
Where it sits in Microsoft 365
Intune security baselines; attack surface reduction rules in Defender.
ASD reference
To be added from the enterprise IT chapter

Regular backups

Backup and recovery · also Cloud, operational technology

Expected outcome provisional
Important data and systems can be restored to a known point, restores are tested, and backups cannot be changed or deleted by an attacker.
Maturity Level Two today
Backups made and kept according to business criticality, synchronised to a common point and stored securely; restoration tested; accounts other than backup administrators cannot reach or change other accounts' backups.
Evidence that it works
Last restore test date and result; immutability or access restrictions shown.
Where it sits in Microsoft 365
Microsoft 365 Backup or Azure Backup reports; restore test records.
ASD reference
To be added from the enterprise IT chapter

Where an Essential Eight programme will have gaps

The Essential Eight was a set of mitigations for workstations and internet-facing servers, so expect the Essentials to ask for things a Maturity Level Two evidence pack never held. These are our expectations, not confirmed requirements.

Likely gapWhy we expect itWhere the evidence may already exist
Knowing what you have (asset inventory)Reporting area by area needs the assets in each area listedIntune, Entra and Defender device inventories; a maintained asset register
Logging and detection beyond admin and macro eventsEffectiveness is shown with evidence over timeDefender, Sentinel, Entra sign-in and audit logs
Cloud workloadsA separate cloud chapter now existsAzure Policy, Defender for Cloud, AWS Config
Operational technologyA separate OT chapter now exists; Essential Eight controls often cannot be applied to OTUsually none: OT is mostly new work
Service and workload identitiesIdentity is treated as its own area, not just staff MFAEntra workload identities, app registrations, key and secret expiry

Converting a Maturity Level Two evidence pack

Re-map first, and rebuild only where a gap shows. Keep the Essential Eight pack alongside, because contracts and the PSPF still name it.

  1. Pick the chapters. Enterprise IT for almost everyone; add cloud or OT where those workloads are in scope.
  2. List the areas. Take the chapter's domains and list which of your assets sit in each.
  3. Re-file the evidence. Move each piece of evidence under the area it supports. One piece can support several areas.
  4. Show it working. For each area, add a measure over time (patch age, MFA coverage, blocked executions, last restore test) rather than a single screenshot.
  5. Rate each area. Give an effectiveness rating per area as the chapter defines it, with the evidence behind it.
  6. Log the gaps. Anything the chapter asks for that the pack does not cover becomes an action with an owner and a date.

Checkpoint already collects most of the Microsoft 365 evidence above through its posture checks, so it can be regrouped by area rather than gathered again. See Checkpoint for the Essential Eight.

Essentials mapping alert

Get one email when we complete the Essential Eight to Essentials mapping

ASD published the Essentials on 15 October 2026. Our provisional mapping is out; we'll email you once when we add ASD's chapter references to it. One email, not a newsletter.

No spam. Unsubscribe any time. We never share your email.

Sources

Provisional mapping by Compliance365. Last reviewed 15 October 2026.

Want your evidence pack mapped for you?

A 30-minute call on how the Essentials affects your environment, and what it would take to re-map your Essential Eight evidence.

Book a callEssential Eight service
Microsoft Teams