Skip to content
Mappings
Essential EightASD Essentials

Essential Eight to ASD Essentials

Every Essential Eight requirement, at every maturity level, with the ASD Essentials actions ASD links it to. Use it to see where your Essential Eight work already counts toward the Essentials.

Essential Eight controlsASD Essentials actions
Essential Eight controls mapped (93%)
141 of 152
Relationships
209
Distinct ASD Essentials actions reached
35 of 58

141 of the 152 Essential Eight controls (93%) have at least one ASD Essentials counterpart, giving 209 relationships across 35 distinct ASD Essentials actions. The other 23 of the 58 actions have no Essential Eight requirement behind them: that is where the Essentials goes beyond the Essential Eight.

These links are ASD's own. Its Assessment evidence guide for enterprise IT lists Essential Eight requirements as potential evidence sources for each action, and Control Stack matches each one to its Essential Eight control. ASD treats a listed requirement as a starting point for evidence, not proof that the action achieves its outcome.

Control Stack is a free Australian reference covering 1,484 cyber security controls: all 1,143 ASD ISM controls, 152 Essential Eight controls across all four maturity levels, all 93 ISO/IEC 27001:2022 Annex A controls, 58 ASD Essentials for enterprise IT actions and all 38 ISO/IEC 42001:2023 Annex A controls. Every one of them is cross-mapped between the five frameworks and readable in full without an account.

Reviewed 16 October 2026 · Maps the ASD Essential Eight Maturity Model to ASD Essentials for enterprise IT, using ASD's own references

Control by control

What the labels mean

One card per Essential Eight control, grouped by strategy, with every ASD Essentials action mapped to it, strongest relationship first.

Showing all 152 Essential Eight controls

Application control

19 controls, 18 mapped

Patch applications

14 controls, 12 mapped

Configure macro settings

11 controls, 10 mapped

User application hardening

27 controls, 26 mapped

Restrict admin privileges

29 controls, 27 mapped

E8-RA-ML3.1ML34 ASD Essentials actions

Limit privileged access to what is necessary for duties

Patch operating systems

17 controls, 16 mapped

Multi-factor authentication

24 controls, 23 mapped

Regular backups

11 controls, 9 mapped

How to use this mapping

Read it in whichever direction you are being assessed. If Essential Eight is your primary framework, use the cards to find the ASD Essentials actions that cover the same ground, so evidence you already hold can be reused instead of rebuilt. If ASD Essentials is what you are being held to, search for a ASD Essentials ID to see which Essential Eight controls contribute. A mapping means the two controls address related risk, not that satisfying one satisfies the other, so always read the relationship label before relying on it.

What the relationship labels mean

Read each row as the Essential Eight control, then the label, then the ASD Essentials action.

Partially overlaps
The two share ground, but neither contains the other. 209 pairings on this page
Essential EightASD EssentialsTransition guideAll mappings

Frequently asked questions

Is this mapping official?

Yes. The links come from ASD's Assessment evidence guide for enterprise IT, which lists Essential Eight requirements as potential evidence sources for each action. ASD treats them as a starting point for evidence, not proof that an action achieves its outcome.

How is this different from the transition guide?

The transition guide works at strategy level: ASD's tables map each of the eight strategies to principles and actions, with ASD's advice on moving across. This page works at requirement level, showing each Essential Eight requirement at each maturity level against the actions ASD links it to.

If we meet an Essential Eight requirement, is the linked action done?

Not necessarily. The Essentials applies each action in every domain it covers and rates whether it achieves its outcome there, so Essential Eight evidence helps but rarely covers an action in full. Check the action page for the domains it applies to and ASD’s indicators of good practice.