EvidenceSheet
All frameworks

ACSC Essential Eight Maturity Model (November 2023): the evidence behind each requirement

152 requirements. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Each row is an ISM control the maturity model requires, with the maturity levels named in its text. Pick your target maturity level and use the rows for it.

Restrict administrative privileges

ADMIN-ISM-0109Event logs from workstations are analysed in a timely manner to detect cyber security events easyADMIN-ISM-0123Cyber security incidents are reported to the Chief Information Security Officer, or one of their delegates… easyADMIN-ISM-0140Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered hardADMIN-ISM-0445Privileged users are assigned a dedicated privileged user account to be used solely for duties requiring… easyADMIN-ISM-1175Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from… easyADMIN-ISM-1228Cyber security events are analysed in a timely manner to identify cyber security incidents easyADMIN-ISM-1380Privileged users use separate privileged and unprivileged operating environments hardADMIN-ISM-1387Administrative activities are conducted through jump servers easyADMIN-ISM-1507Requests for privileged access to systems, applications and data repositories are validated when first… easyADMIN-ISM-1508Privileged access to systems, applications and data repositories is limited to only what is required for… hardADMIN-ISM-1509Privileged access events are centrally logged easyADMIN-ISM-1647Privileged access to systems, applications and data repositories is disabled after 12 months unless… hardADMIN-ISM-1648Privileged access to systems and applications is disabled after 45 days of inactivity hardADMIN-ISM-1649Just-in-time administration is used for administering systems and applications easyADMIN-ISM-1650Privileged user account and security group management events are centrally logged easyADMIN-ISM-1685Credentials for break glass accounts, local administrator accounts and service accounts are long, unique… easyADMIN-ISM-1686Credential Guard functionality is enabled easyADMIN-ISM-1687Privileged operating environments are not virtualised within unprivileged operating environments hardADMIN-ISM-1688Unprivileged user accounts cannot logon to privileged operating environments easyADMIN-ISM-1689Privileged user accounts (excluding local administrator accounts) cannot logon to unprivileged operating… easyADMIN-ISM-1815Event logs are protected from unauthorised modification and deletion easyADMIN-ISM-1819Following the identification of a cyber security incident, the cyber security incident response plan is… hardADMIN-ISM-1861Local Security Authority protection functionality is enabled easyADMIN-ISM-1883Privileged user accounts explicitly authorised to access online services are strictly limited to only what is… easyADMIN-ISM-1896Memory integrity functionality is enabled easyADMIN-ISM-1897Remote Credential Guard functionality is enabled easyADMIN-ISM-1898Secure Admin Workstations are used in the performance of administrative activities easyADMIN-ISM-1906Event logs from internet-facing servers are analysed in a timely manner to detect cyber security events hardADMIN-ISM-1907Event logs from non-internet-facing servers are analysed in a timely manner to detect cyber security events easy

Application control

APP-ISM-0109Event logs from workstations are analysed in a timely manner to detect cyber security events hardAPP-ISM-0123Cyber security incidents are reported to the Chief Information Security Officer, or one of their delegates… hardAPP-ISM-0140Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered hardAPP-ISM-0843Application control is implemented on workstations easyAPP-ISM-1228Cyber security events are analysed in a timely manner to identify cyber security incidents easyAPP-ISM-1490Application control is implemented on internet-facing servers hardAPP-ISM-1544Microsoft’s recommended application blocklist is implemented hardAPP-ISM-1582Application control rulesets are validated on an annual or more frequent basis easyAPP-ISM-1656Application control is implemented on non-internet-facing servers hardAPP-ISM-1657Application control restricts the execution of executables, software libraries, scripts, installers, compiled… hardAPP-ISM-1658Application control restricts the execution of drivers to an organisation-approved set hardAPP-ISM-1659Microsoft’s vulnerable driver blocklist is implemented easyAPP-ISM-1660Allowed and blocked application control events are centrally logged easyAPP-ISM-1815Event logs are protected from unauthorised modification and deletion easyAPP-ISM-1819Following the identification of a cyber security incident, the cyber security incident response plan is… hardAPP-ISM-1870Application control is applied to user profiles and temporary folders used by operating systems, web browsers… hardAPP-ISM-1871Application control is applied to all locations other than user profiles and temporary folders used by… hardAPP-ISM-1906Event logs from internet-facing servers are analysed in a timely manner to detect cyber security events easyAPP-ISM-1907Event logs from non-internet-facing servers are analysed in a timely manner to detect cyber security events easy

Regular backups

BACKUP-ISM-1511Backups of data, applications and settings are performed and retained in accordance with business criticality… hardBACKUP-ISM-1515Restoration of data, applications and settings from backups to a common point in time is tested as part of… hardBACKUP-ISM-1705Privileged user accounts (excluding backup administrator accounts) cannot access backups belonging to other… easyBACKUP-ISM-1706Privileged user accounts (excluding backup administrator accounts) cannot access their own backups easyBACKUP-ISM-1707Privileged user accounts (excluding backup administrator accounts) are prevented from modifying and deleting… hardBACKUP-ISM-1708Backup administrator accounts are prevented from modifying and deleting backups during their retention period easyBACKUP-ISM-1810Backups of data, applications and settings are synchronised to enable restoration to a common point in time hardBACKUP-ISM-1811Backups of data, applications and settings are retained in a secure and resilient manner easyBACKUP-ISM-1812Unprivileged user accounts cannot access backups belonging to other user accounts hardBACKUP-ISM-1813Unprivileged user accounts cannot access their own backups easyBACKUP-ISM-1814Unprivileged user accounts are prevented from modifying and deleting backups hard

Restrict Microsoft Office macros

MACRO-ISM-1487Only privileged users responsible for checking that Microsoft Office macros are free of malicious code can… easyMACRO-ISM-1488Microsoft Office macros in files originating from the internet are blocked hardMACRO-ISM-1489Microsoft Office macro security settings cannot be changed by users easyMACRO-ISM-1671Microsoft Office macros are disabled for users that do not have a demonstrated business requirement easyMACRO-ISM-1672Microsoft Office macro antivirus scanning is enabled easyMACRO-ISM-1673Microsoft Office macros are blocked from making Win32 API calls easyMACRO-ISM-1674Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location or that are… hardMACRO-ISM-1675Microsoft Office macros digitally signed by an untrusted publisher cannot be enabled via the Message Bar or… hardMACRO-ISM-1676Microsoft Office’s list of trusted publishers is validated on an annual or more frequent basis hardMACRO-ISM-1890Microsoft Office macros are checked to ensure they are free of malicious code before being digitally signed… hardMACRO-ISM-1891Microsoft Office macros digitally signed by signatures other than V3 signatures cannot be enabled via the… hard

Multi-factor authentication

MFA-ISM-0109Event logs from workstations are analysed in a timely manner to detect cyber security events easyMFA-ISM-0123Cyber security incidents are reported to the Chief Information Security Officer, or one of their delegates… hardMFA-ISM-0140Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered hardMFA-ISM-0974Multi-factor authentication is used to authenticate unprivileged users of systems easyMFA-ISM-1173Multi-factor authentication is used to authenticate privileged users of systems easyMFA-ISM-1228Cyber security events are analysed in a timely manner to identify cyber security incidents easyMFA-ISM-1401Multi-factor authentication uses either: something users have and something users know, or something users… hardMFA-ISM-1504Multi-factor authentication is used to authenticate users to their organisation’s online services that… hardMFA-ISM-1505Multi-factor authentication is used to authenticate users of data repositories easyMFA-ISM-1679Multi-factor authentication is used to authenticate users to third-party online services that process, store… easyMFA-ISM-1680Multi-factor authentication (where available) is used to authenticate users to third-party online services… hardMFA-ISM-1681Multi-factor authentication is used to authenticate customers to online customer services that process, store… hardMFA-ISM-1682Multi-factor authentication used for authenticating users of systems is phishing-resistant easyMFA-ISM-1683Successful and unsuccessful multi-factor authentication events are centrally logged easyMFA-ISM-1815Event logs are protected from unauthorised modification and deletion easyMFA-ISM-1819Following the identification of a cyber security incident, the cyber security incident response plan is… easyMFA-ISM-1872Multi-factor authentication used for authenticating users of online services is phishing-resistant easyMFA-ISM-1873Multi-factor authentication used for authenticating customers of online customer services provides a… hardMFA-ISM-1874Multi-factor authentication used for authenticating customers of online customer services is… easyMFA-ISM-1892Multi-factor authentication is used to authenticate users to their organisation’s online customer services… easyMFA-ISM-1893Multi-factor authentication is used to authenticate users to third-party online customer services that… easyMFA-ISM-1894Multi-factor authentication used for authenticating users of data repositories is phishing-resistant easyMFA-ISM-1906Event logs from internet-facing servers are analysed in a timely manner to detect cyber security events easyMFA-ISM-1907Event logs from non-internet-facing servers are analysed in a timely manner to detect cyber security events hard

Patch applications

PATCHAPP-ISM-0304Applications other than office productivity suites, web browsers and their extensions, email clients, PDF… hardPATCHAPP-ISM-1690Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two… easyPATCHAPP-ISM-1691Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers… easyPATCHAPP-ISM-1692Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers… easyPATCHAPP-ISM-1693Patches, updates or other vendor mitigations for vulnerabilities in applications other than office… easyPATCHAPP-ISM-1698A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in… easyPATCHAPP-ISM-1699A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in… easyPATCHAPP-ISM-1700A vulnerability scanner is used at least fortnightly to identify missing patches or updates for… easyPATCHAPP-ISM-1704Office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash… hardPATCHAPP-ISM-1807An automated method of asset discovery is used at least fortnightly to support the detection of assets for… easyPATCHAPP-ISM-1808A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning… easyPATCHAPP-ISM-1876Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48… easyPATCHAPP-ISM-1901Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers… easyPATCHAPP-ISM-1905Online services that are no longer supported by vendors are removed hard

Patch operating systems

PATCHOS-ISM-1407The latest release, or the previous release, of operating systems are used hardPATCHOS-ISM-1501Operating systems that are no longer supported by vendors are replaced easyPATCHOS-ISM-1694Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing… easyPATCHOS-ISM-1695Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations… easyPATCHOS-ISM-1696Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations… easyPATCHOS-ISM-1697Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of… easyPATCHOS-ISM-1701A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in… easyPATCHOS-ISM-1702A vulnerability scanner is used at least fortnightly to identify missing patches or updates for… easyPATCHOS-ISM-1703A vulnerability scanner is used at least fortnightly to identify missing patches or updates for… easyPATCHOS-ISM-1807An automated method of asset discovery is used at least fortnightly to support the detection of assets for… hardPATCHOS-ISM-1808A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning… easyPATCHOS-ISM-1877Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing… easyPATCHOS-ISM-1879Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of… easyPATCHOS-ISM-1900A vulnerability scanner is used at least fortnightly to identify missing patches or updates for… hardPATCHOS-ISM-1902Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations… easyPATCHOS-ISM-1903Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of… easyPATCHOS-ISM-1904Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of… easy

User application hardening

UAH-ISM-0109Event logs from workstations are analysed in a timely manner to detect cyber security events easyUAH-ISM-0123Cyber security incidents are reported to the Chief Information Security Officer, or one of their delegates… easyUAH-ISM-0140Cyber security incidents are reported to ASD as soon as possible after they occur or are discovered hardUAH-ISM-1228Cyber security events are analysed in a timely manner to identify cyber security incidents easyUAH-ISM-1412Web browsers are hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking… easyUAH-ISM-1485Web browsers do not process web advertisements from the internet easyUAH-ISM-1486Web browsers do not process Java from the internet hardUAH-ISM-1542Microsoft Office is configured to prevent activation of Object Linking and Embedding packages hardUAH-ISM-1585Web browser security settings cannot be changed by users easyUAH-ISM-1621Windows PowerShell 2.0 is disabled or removed easyUAH-ISM-1622PowerShell is configured to use Constrained Language Mode easyUAH-ISM-1623PowerShell module logging, script block logging and transcription events are centrally logged easyUAH-ISM-1654Internet Explorer 11 is disabled or removed easyUAH-ISM-1655.NET Framework 3.5 (includes .NET 2.0 and 3.0) is disabled or removed hardUAH-ISM-1667Microsoft Office is blocked from creating child processes easyUAH-ISM-1668Microsoft Office is blocked from creating executable content easyUAH-ISM-1669Microsoft Office is blocked from injecting code into other processes easyUAH-ISM-1670PDF software is blocked from creating child processes hardUAH-ISM-1815Event logs are protected from unauthorised modification and deletion easyUAH-ISM-1819Following the identification of a cyber security incident, the cyber security incident response plan is… hardUAH-ISM-1823Office productivity suite security settings cannot be changed by users easyUAH-ISM-1824PDF software security settings cannot be changed by users easyUAH-ISM-1859Office productivity suites are hardened using ASD and vendor hardening guidance, with the most restrictive… easyUAH-ISM-1860PDF software is hardened using ASD and vendor hardening guidance, with the most restrictive guidance taking… easyUAH-ISM-1889Command line process creation events are centrally logged easyUAH-ISM-1906Event logs from internet-facing servers are analysed in a timely manner to detect cyber security events easyUAH-ISM-1907Event logs from non-internet-facing servers are analysed in a timely manner to detect cyber security events easy