Skip to content
Mappings
Essential EightASD ISM

Essential Eight to ASD ISM

Every Essential Eight requirement, across all maturity levels, with the ASD ISM controls that implement the same mitigation. Both frameworks come from ASD, so the relationships here are unusually direct.

Essential Eight controlsASD ISM controls
Essential Eight controls mapped (100%)
152 of 152
Control-to-control relationships
1,218
Distinct ASD ISM controls reached
318 of 1,143

152 of the 152 Essential Eight controls (100%) have at least one ASD ISM counterpart, giving 1,218 control-to-control relationships across 318 distinct ASD ISM controls. Coverage runs one way: nearly every Essential Eight requirement has ISM controls behind it, while most of the ISM sits outside the Essential Eight entirely.

These relationships are generated from the Control Stack catalogue and reviewed for topic fidelity, then labelled with how the two controls relate rather than asserted as equivalent. Where no counterpart exists, the row says so plainly instead of stretching for a match. Some rows are read from the other framework’s own mappings, so the wording of those summaries leads with that side.

Control Stack is a free Australian reference covering 1,484 cyber security controls: all 1,143 ASD ISM controls, 152 Essential Eight controls across three maturity levels, all 93 ISO/IEC 27001:2022 Annex A controls, 58 ASD Essentials for enterprise IT actions and all 38 ISO/IEC 42001:2023 Annex A controls. Every one of them is cross-mapped between the five frameworks and readable in full without an account.

Reviewed 16 September 2026 · Maps the ASD Essential Eight Maturity Model to the September 2026 ASD ISM

Control by control

What the labels mean

One card per Essential Eight control, grouped by strategy, with every ASD ISM control mapped to it, strongest relationship first.

Showing all 152 Essential Eight controls

Application control

19 controls, 19 mapped

E8-AC-ML1.1ML112 ASD ISM controls

Application control is implemented on workstations

E8-AC-ML1.2ML114 ASD ISM controls

Application control is applied to user profiles and temporary folders

E8-AC-ML1.3ML117 ASD ISM controls

Ensure only approved applications and scripts can run

E8-AC-ML2.1ML210 ASD ISM controls

Application control is implemented on internet-facing servers

E8-AC-ML2.2ML210 ASD ISM controls

Application control excludes user profiles and temporary folders

E8-AC-ML2.3ML26 ASD ISM controls

Microsoft's recommended application blocklist is implemented

E8-AC-ML2.4ML26 ASD ISM controls

Annual validation of application control rulesets

E8-AC-ML2.5ML211 ASD ISM controls

Allowed and blocked application control events are centrally logged

E8-AC-ML2.6ML210 ASD ISM controls

Event logs are protected from unauthorised modification and deletion

E8-AC-ML2.7ML27 ASD ISM controls

Event logs from internet-facing servers are analysed to detect cyber security events

E8-AC-ML2.8ML210 ASD ISM controls

Cyber security events are analysed in a timely manner

E8-AC-ML2.9ML29 ASD ISM controls

Cyber security incidents are reported promptly to CISO

E8-AC-ML3.1ML39 ASD ISM controls

Application control is implemented on non-internet-facing servers

E8-AC-ML3.4ML311 ASD ISM controls

Event logs from non-internet-facing servers are analysed

Patch applications

14 controls, 14 mapped

E8-PA-ML1.1ML17 ASD ISM controls

Automated asset discovery at least fortnightly

E8-PA-ML1.2ML18 ASD ISM controls

Up-to-date vulnerability scanner used for scanning activities

E8-PA-ML1.4ML113 ASD ISM controls

Weekly scanning for missing patches or updates in key software

E8-PA-ML1.5ML18 ASD ISM controls

Apply critical online service patches within 48 hours

E8-PA-ML1.6ML19 ASD ISM controls

Apply non-critical patches for online services within two weeks

E8-PA-ML1.7ML18 ASD ISM controls

Patch office, browser, email, PDF and security software within two weeks

E8-PA-ML1.9ML19 ASD ISM controls

Removal of unsupported software and applications

E8-PA-ML2.1ML26 ASD ISM controls

Fortnightly vulnerability scanning for non-core applications

E8-PA-ML2.2ML28 ASD ISM controls

Timely patching of non-critical application vulnerabilities

E8-PA-ML3.1ML311 ASD ISM controls

Patch critical vulnerabilities in applications within 48 hours

E8-PA-ML3.2ML37 ASD ISM controls

Apply patches for non-critical vulnerabilities within two weeks

Configure macro settings

11 controls, 11 mapped

E8-RM-ML1.2ML18 ASD ISM controls

Block Microsoft Office macros from the internet

E8-RM-ML1.4ML113 ASD ISM controls

Prevent users from changing Microsoft Office macro security settings

E8-RM-ML3.1ML311 ASD ISM controls

Restrict Microsoft Office macros to only trusted or sandboxed environments

E8-RM-ML3.3ML36 ASD ISM controls

Only privileged users can modify content in Trusted Locations

User application hardening

27 controls, 27 mapped

E8-AH-ML1.1ML18 ASD ISM controls

Disable or remove Internet Explorer 11

E8-AH-ML1.4ML17 ASD ISM controls

Web browser security settings locked down to users

E8-AH-ML2.1ML28 ASD ISM controls

Web browsers are hardened with the most restrictive guidance

E8-AH-ML2.2ML211 ASD ISM controls

Block Microsoft Office from creating child processes

E8-AH-ML2.3ML27 ASD ISM controls

Block Microsoft Office from creating executable content

E8-AH-ML2.4ML26 ASD ISM controls

Block Microsoft Office from injecting code into other processes

E8-AH-ML2.5ML29 ASD ISM controls

Configure Microsoft Office to prevent activation of OLE packages

E8-AH-ML2.6ML28 ASD ISM controls

Office productivity suites are hardened using ASD and vendor guidance

E8-AH-ML2.7ML211 ASD ISM controls

Office productivity suite settings are immutable by users

E8-AH-ML2.9ML210 ASD ISM controls

Ensure PDF software is securely configured using guidance

E8-AH-ML2.10ML27 ASD ISM controls

PDF software security settings cannot be changed by users

E8-AH-ML2.11ML210 ASD ISM controls

Centrally log PowerShell module, script block, and transcription events

E8-AH-ML2.12ML214 ASD ISM controls

Command line process creation logging is centralised

E8-AH-ML2.13ML29 ASD ISM controls

Protect event logs from unauthorised changes or deletion

E8-AH-ML2.14ML214 ASD ISM controls

Timely analysis of event logs from internet-facing servers

E8-AH-ML2.15ML211 ASD ISM controls

Timely analysis of cyber security events to identify incidents

E8-AH-ML2.16ML214 ASD ISM controls

Cyber security incidents must be reported immediately to the CISO

E8-AH-ML3.2ML311 ASD ISM controls

Ensure Windows PowerShell 2.0 is disabled or removed

E8-AH-ML3.3ML38 ASD ISM controls

PowerShell is configured to use Constrained Language Mode

E8-AH-ML3.4ML39 ASD ISM controls

Analyse event logs from non-internet-facing servers for cyber threats

E8-AH-ML3.5ML311 ASD ISM controls

Timely analysis of workstation event logs for cyber security

Restrict admin privileges

29 controls, 29 mapped

E8-RA-ML1.1ML111 ASD ISM controls

Validating privileged access requests upon initial request

E8-RA-ML1.2ML111 ASD ISM controls

Dedicated privileged user accounts for privileged duties

E8-RA-ML1.3ML17 ASD ISM controls

Prevent privileged user accounts from accessing internet, email and web services

E8-RA-ML1.4ML111 ASD ISM controls

Limit privileged user accounts to essential online service access

E8-RA-ML1.5ML18 ASD ISM controls

Privileged users use separate privileged and unprivileged environments

E8-RA-ML1.6ML16 ASD ISM controls

Unprivileged user accounts restricted from logging on to privileged environments

E8-RA-ML1.7ML17 ASD ISM controls

Prevent privileged user accounts from logging on to unprivileged environments

E8-RA-ML2.1ML26 ASD ISM controls

Disable privileged access after 12 months without revalidation

E8-RA-ML2.4ML26 ASD ISM controls

Conduct administrative activities through jump servers

E8-RA-ML2.5ML218 ASD ISM controls

Long, unique, and managed credentials for admin accounts

E8-RA-ML2.6ML214 ASD ISM controls

Privileged access events are centrally logged

E8-RA-ML2.7ML210 ASD ISM controls

Centrally log privileged user account and security group management events

E8-RA-ML2.9ML212 ASD ISM controls

Event logs are analysed promptly for security events

E8-RA-ML2.10ML29 ASD ISM controls

Timely analysis of cyber security events to identify incidents

E8-RA-ML2.11ML211 ASD ISM controls

Report cyber incidents to the CISO promptly

E8-RA-ML2.13ML27 ASD ISM controls

Enact cyber incident response plan after an incident is identified

E8-RA-ML3.1ML325 ASD ISM controls

Limit privileged access to what is necessary for duties

E8-RA-ML3.2ML37 ASD ISM controls

Use secure admin workstations for administrative tasks

E8-RA-ML3.6ML36 ASD ISM controls

Enable Credential Guard for secure credential storage

E8-RA-ML3.8ML38 ASD ISM controls

Timely analysis of event logs from non-internet-facing servers

E8-RA-ML3.9ML38 ASD ISM controls

Timely analysis of workstation event logs for security events

Patch operating systems

17 controls, 17 mapped

E8-PO-ML1.1ML19 ASD ISM controls

Automated bi-weekly asset discovery for vulnerability scanning

E8-PO-ML1.2ML110 ASD ISM controls

Use a vulnerability scanner with an updated database

E8-PO-ML1.3ML111 ASD ISM controls

Use a daily vulnerability scanner for internet-facing systems

E8-PO-ML1.5ML116 ASD ISM controls

Apply critical patches to internet-facing OS within 48 hours

E8-PO-ML1.6ML16 ASD ISM controls

Timely application of non-critical patches for internet-facing OS vulnerabilities

E8-PO-ML1.7ML17 ASD ISM controls

One-month operating system patching for workstations, non-internet-facing servers and network devices

E8-PO-ML1.8ML19 ASD ISM controls

Replace unsupported operating systems

E8-PO-ML3.1ML36 ASD ISM controls

Vulnerability scanner used fortnightly to identify missing driver patches

E8-PO-ML3.2ML38 ASD ISM controls

At least fortnightly use of a vulnerability scanner for firmware

E8-PO-ML3.3ML313 ASD ISM controls

Apply critical patches to non-internet-facing OS within 48 hours

E8-PO-ML3.4ML310 ASD ISM controls

Non-critical OS patches applied within one month if no exploits exist

E8-PO-ML3.5ML38 ASD ISM controls

Apply critical driver patches within 48 hours

E8-PO-ML3.7ML37 ASD ISM controls

Apply critical firmware patches within 48 hours

E8-PO-ML3.8ML38 ASD ISM controls

Firmware vulnerabilities patched within one month if non-critical and no exploits

Multi-factor authentication

24 controls, 24 mapped

E8-MF-ML1.1ML111 ASD ISM controls

Require multi-factor authentication for sensitive online services

E8-MF-ML1.2ML17 ASD ISM controls

Multi-factor authentication for third-party services handling sensitive data

E8-MF-ML1.4ML18 ASD ISM controls

Use multi-factor authentication for online services handling customer data

E8-MF-ML1.5ML19 ASD ISM controls

Multi-factor authentication for third-party services with sensitive customer data

E8-MF-ML1.6ML19 ASD ISM controls

Multi-factor authentication for customer access to online services handling sensitive data

E8-MF-ML1.7ML113 ASD ISM controls

Multi-factor authentication combines two factors like a device and a PIN

E8-MF-ML2.2ML27 ASD ISM controls

Use multi-factor authentication for unprivileged user access

E8-MF-ML2.3ML215 ASD ISM controls

Multi-factor authentication online services must be phishing-resistant

E8-MF-ML2.5ML211 ASD ISM controls

Multi-factor authentication used for system access is phishing-resistant

E8-MF-ML2.6ML211 ASD ISM controls

MFA success and failure events are centrally logged

E8-MF-ML2.7ML26 ASD ISM controls

Protect event logs from unauthorised changes

E8-MF-ML2.8ML212 ASD ISM controls

Timely analysis of event logs from internet-facing servers

E8-MF-ML2.9ML210 ASD ISM controls

Cyber security events are analysed to identify incidents timely

E8-MF-ML2.10ML27 ASD ISM controls

Report cyber security incidents to the Chief Information Security Officer promptly

E8-MF-ML2.12ML27 ASD ISM controls

Cyber security incident response plan enacted after incident identification

E8-MF-ML3.1ML39 ASD ISM controls

Multi-factor authentication is used to authenticate users of data repositories

E8-MF-ML3.2ML310 ASD ISM controls

Phishing-resistant multi-factor authentication for online customer services

E8-MF-ML3.3ML38 ASD ISM controls

Phishing-resistant multi-factor authentication for data repositories

E8-MF-ML3.4ML310 ASD ISM controls

Analyse event logs from non-internet-facing servers timely to detect security events

E8-MF-ML3.5ML38 ASD ISM controls

Timely analysis of workstation event logs for cyber security events

Regular backups

11 controls, 11 mapped

E8-RB-ML1.1ML17 ASD ISM controls

Backups aligned with business continuity needs

E8-RB-ML1.2ML17 ASD ISM controls

Ensure backups are synchronised for restoration to a common point in time

E8-RB-ML1.3ML18 ASD ISM controls

Backups retained securely and resiliently

E8-RB-ML1.4ML18 ASD ISM controls

Test backup restoration to a common point during disaster recovery

E8-RB-ML1.6ML17 ASD ISM controls

Prevent unprivileged user accounts from modifying and deleting backups

E8-RB-ML2.2ML29 ASD ISM controls

Privileged user accounts cannot modify or delete backups

E8-RB-ML3.2ML37 ASD ISM controls

Privileged user accounts cannot access their own backups

E8-RB-ML3.3ML36 ASD ISM controls

Backup administrators cannot modify or delete backups during retention

How to use this mapping

Read it in whichever direction you are being assessed. If Essential Eight is your primary framework, use the cards to find the ASD ISM controls that cover the same ground, so evidence you already hold can be reused instead of rebuilt. If ASD ISM is what you are being held to, search for a ASD ISM ID to see which Essential Eight controls contribute. A mapping means the two controls address related risk, not that satisfying one satisfies the other, so always read the relationship label before relying on it.

What the relationship labels mean

Read each row as the Essential Eight control, then the label, then the ASD ISM control.

Equivalent
Both controls ask for the same thing. Rare, and kept for genuinely matching requirements. 161 pairings on this page
Broader than
The source control covers everything the mapped control asks for, and more. 57 pairings on this page
Partially meets
The source control covers part of what the mapped control asks for. 159 pairings on this page
Partially overlaps
The two share ground, but neither contains the other. 456 pairings on this page
Supports
The source control helps achieve the mapped control. 148 pairings on this page
Depends on
The source control relies on the mapped control being in place. 237 pairings on this page
Essential EightASD ISMAll mappings

Frequently asked questions

How do the Essential Eight and the ASD ISM relate?

Both are published by the Australian Signals Directorate. The Essential Eight is a prioritised set of eight mitigation strategies drawn from ASD’s Strategies to Mitigate Cyber Security Incidents, and the ISM carries controls that implement those strategies in detail. This mapping shows which ISM controls sit behind each Essential Eight requirement.

If I reach Maturity Level Two, how much of the ISM have I covered?

A small share. The Essential Eight concentrates on eight technical areas, mostly patching, application control, macros, hardening, administrative privileges, multi-factor authentication and backups. The ISM spans governance, personnel security, physical security, cryptography, gateways, software development and data transfers as well, so most ISM controls have no Essential Eight counterpart at all.

Why are Essential Eight controls numbered by maturity level?

Control Stack renders the Essential Eight Maturity Model as separate, testable controls, one per requirement per level, using keys such as E8-AC-ML2.3. That makes each requirement individually trackable and lets a mapping point at the exact maturity level a given ISM control supports, rather than at a whole strategy.

Is this mapping official?

No. ASD does not publish a control-level crosswalk between the Essential Eight Maturity Model and the ISM. This mapping is produced by Control Stack from the control text of both and reviewed for topic fidelity. Use it for planning and evidence reuse rather than as an authoritative statement from ASD.