swap_horizFree crosswalk tool

Essential Eight to ASD ISM

Every Essential Eight requirement, across all maturity levels, with the ASD ISM controls that implement the same mitigation. Both frameworks come from ASD, so the relationships here are unusually direct.

listEssential Eight controls shieldASD ISM controls

149 of the 149 Essential Eight controls (100%) have at least one ASD ISM counterpart, giving 1,200 control-to-control relationships across 318 distinct ASD ISM controls. Coverage runs one way: nearly every Essential Eight requirement has ISM controls behind it, while most of the ISM sits outside the Essential Eight entirely.

These relationships are generated from the Control Stack catalogue and reviewed for topic fidelity, then labelled with how the two controls relate rather than asserted as equivalent. Where no counterpart exists, the row says so plainly instead of stretching for a match. Some rows are read from the other framework’s own mappings, so the wording of those summaries leads with that side.

Control Stack is a free Australian reference covering 1,423 cyber security controls: all 1,143 ASD ISM controls, 149 Essential Eight controls across all four maturity levels, all 93 ISO/IEC 27001:2022 Annex A controls and all 38 ISO/IEC 42001:2023 Annex A controls. Every one of them is cross-mapped between the four frameworks and readable in full without an account.

Reviewed 16 September 2026 · Maps the ASD Essential Eight Maturity Model to the September 2026 ASD ISM

Essential Eight to ASD ISM

Essential Eight control	Group	ASD ISM counterparts
E8-AC-ML1.1 Application control is implemented on workstations.	Application control	ISM-0843Equivalent Ensure Workstation Security with Application Control ISM-0846Supports Users Cannot Disable, Bypass or Be Exempted From Application Control ISM-0955Partially overlaps Implementing Application Control Measures ISM-1235Partially overlaps Restrict User Application Extensions ISM-1490Partially overlaps Implement Application Control on Internet-Facing Servers ISM-1491Partially overlaps Block Unprivileged Users From Running Script Execution Engines ISM-1493Supports Maintain and Verify Software Registers ISM-1544Supports Implement Microsoft's Application Blocklist ISM-1656Partially overlaps Implement Application Control on Secure Servers ISM-1657Partially meets Restrict Application Execution to Approved Set ISM-1658Broader than Restrict Execution of Drivers via Application Control ISM-2149Depends on Develop, Enforce and Maintain an Authorised RMM and Remote Access Tool List
E8-AC-ML1.2 Application control is applied to user profiles and temporary folders	Application control	ISM-0382Partially overlaps Prevent Unprivileged Human Users Uninstalling or Disabling Approved Applications ISM-0843Partially meets Ensure Workstation Security with Application Control ISM-0846Supports Users Cannot Disable, Bypass or Be Exempted From Application Control ISM-0955Partially overlaps Implementing Application Control Measures ISM-1392Supports Restrict File Modifications via Path Rules ISM-1491Depends on Block Unprivileged Users From Running Script Execution Engines ISM-1544Supports Implement Microsoft's Application Blocklist ISM-1592Partially overlaps Restrict Unprivileged Users From Installing Unapproved Applications ISM-1635Partially meets System Owners Implement Security Controls for Each System and Environment ISM-1657Partially meets Restrict Application Execution to Approved Set ISM-1658Partially overlaps Restrict Execution of Drivers via Application Control ISM-1746Supports Restrict File System Permission Changes ISM-1870Equivalent Implement Application Control for User Profiles and Folders ISM-1871Partially overlaps Implement Application Control Exclusions for System Areas
E8-AC-ML1.3 Ensure only approved applications and scripts can run	Application control	ISM-0341Partially overlaps Disable Automatic Execution for Removable Media ISM-0843Partially overlaps Ensure Workstation Security with Application Control ISM-0846Depends on Users Cannot Disable, Bypass or Be Exempted From Application Control ISM-0863Partially meets Prevent Installation of Unapproved Mobile Apps ISM-0955Supports Implementing Application Control Measures ISM-1235Partially overlaps Restrict User Application Extensions ISM-1392Supports Restrict File Modifications via Path Rules ISM-1471Supports Utilise Publisher and Product Names in App Control ISM-1491Partially meets Block Unprivileged Users From Running Script Execution Engines ISM-1592Partially overlaps Restrict Unprivileged Users From Installing Unapproved Applications ISM-1622Partially overlaps Ensure PowerShell Uses Constrained Language Mode ISM-1657Equivalent Restrict Application Execution to Approved Set ISM-1658Broader than Restrict Execution of Drivers via Application Control ISM-1668Partially overlaps Prevent Microsoft Office from Creating Executable Files ISM-1870Depends on Implement Application Control for User Profiles and Folders ISM-2115Partially overlaps Restrict Server Application Extensions to an Approved Set ISM-2149Partially overlaps Develop, Enforce and Maintain an Authorised RMM and Remote Access Tool List
E8-AC-ML2.1 Application control is implemented on internet-facing servers	Application control	ISM-0955Supports Implementing Application Control Measures ISM-1392Depends on Restrict File Modifications via Path Rules ISM-1490Equivalent Implement Application Control on Internet-Facing Servers ISM-1656Partially overlaps Implement Application Control on Secure Servers ISM-1657Partially overlaps Restrict Application Execution to Approved Set ISM-1658Partially overlaps Restrict Execution of Drivers via Application Control ISM-1746Depends on Restrict File System Permission Changes ISM-1871Partially overlaps Implement Application Control Exclusions for System Areas ISM-2115Partially overlaps Restrict Server Application Extensions to an Approved Set ISM-2149Depends on Develop, Enforce and Maintain an Authorised RMM and Remote Access Tool List
E8-AC-ML2.2 Application control excludes user profiles and temporary folders	Application control	ISM-0843Partially meets Ensure Workstation Security with Application Control ISM-0846Partially overlaps Users Cannot Disable, Bypass or Be Exempted From Application Control ISM-0955Partially overlaps Implementing Application Control Measures ISM-1392Depends on Restrict File Modifications via Path Rules ISM-1490Depends on Implement Application Control on Internet-Facing Servers ISM-1544Supports Implement Microsoft's Application Blocklist ISM-1656Depends on Implement Application Control on Secure Servers ISM-1657Partially overlaps Restrict Application Execution to Approved Set ISM-1746Depends on Restrict File System Permission Changes ISM-1871Equivalent Implement Application Control Exclusions for System Areas
E8-AC-ML2.3 Microsoft's recommended application blocklist is implemented	Application control	ISM-0843Partially meets Ensure Workstation Security with Application Control ISM-0955Depends on Implementing Application Control Measures ISM-1544Equivalent Implement Microsoft's Application Blocklist ISM-1601Partially overlaps Implement Microsoft Attack Surface Reduction Rules ISM-1657Partially meets Restrict Application Execution to Approved Set ISM-1659Partially overlaps Implement Microsoft's Vulnerable Driver Blocklist
E8-AC-ML2.4 Annual validation of application control rulesets	Application control	ISM-0843Supports Ensure Workstation Security with Application Control ISM-0955Supports Implementing Application Control Measures ISM-1582Equivalent Annual Validation of Application Control Rulesets ISM-1657Depends on Restrict Application Execution to Approved Set ISM-1658Depends on Restrict Execution of Drivers via Application Control ISM-1676Partially overlaps Validate Microsoft Office Trusted Publishers List At Least Annually
E8-AC-ML2.5 Allowed and blocked application control events are centrally logged	Application control	ISM-0580Supports Develop, Implement and Maintain a Security Monitoring Policy ISM-0670Partially meets Central Logging of CDS Security Events ISM-0955Depends on Implementing Application Control Measures ISM-0988Depends on Ensure Accurate Time Source for Event Logs ISM-1405Depends on Implement a Centralised Event Logging Facility ISM-1660Equivalent Central Logging of Application Events ISM-1976Partially overlaps Central Logging of Security Events on macOS ISM-1977Partially overlaps Central Logging of Linux System Events ISM-1978Partially overlaps Centralised Logging for Server Application Events ISM-1979Partially overlaps Central Logging for Security Events on Servers ISM-1983Partially overlaps Log Events Sent to Centralised Facility Quickly
E8-AC-ML2.6 Event logs are protected from unauthorised modification and deletion	Application control	ISM-0580Supports Develop, Implement and Maintain a Security Monitoring Policy ISM-0582Partially overlaps Central Logging of Windows Security Events ISM-1405Supports Implement a Centralised Event Logging Facility ISM-1624Broader than Protect PowerShell Script Block Logs ISM-1660Depends on Central Logging of Application Events ISM-1815Equivalent Protect Event Logs from Unauthorised Access ISM-1976Partially overlaps Central Logging of Security Events on macOS ISM-1985Partially overlaps Protect Event Logs from Unauthorised Access ISM-1989Depends on Ensure Event Logs Meet Retention Requirements ISM-2052Partially overlaps Ensure Event Logs Protect Sensitive Data
E8-AC-ML2.7 Event logs from internet-facing servers are analysed to detect cyber security events	Application control	ISM-0120Depends on Access to Tools for Detecting Security Events ISM-0580Supports Develop, Implement and Maintain a Security Monitoring Policy ISM-1906Equivalent Timely Analysis of Internet-Facing Server Logs ISM-1910Depends on Log Network API Calls for Data Protection ISM-1960Partially overlaps Timely Analysis of Event Logs for Cyber security ISM-1978Depends on Centralised Logging for Server Application Events ISM-1986Partially overlaps Timely Analysis of Critical Server Event Logs
E8-AC-ML2.8 Cyber security events are analysed in a timely manner	Application control	ISM-0120Depends on Access to Tools for Detecting Security Events ISM-1228Equivalent Analyse Cyber Security Events Promptly ISM-1526Depends on System Owners Continuously Monitor Security and Manage Threats, Risks and Controls ISM-1906Partially meets Timely Analysis of Internet-Facing Server Logs ISM-1907Partially meets Timely Analysis of Non-Internet-Server Logs ISM-1960Depends on Timely Analysis of Event Logs for Cyber security ISM-1961Broader than Timely Analysis of Network Device Event Logs ISM-1986Partially meets Timely Analysis of Critical Server Event Logs ISM-1987Partially meets Timely Analysis of Security Event Logs ISM-2116Depends on Use Cyber Threat Intelligence for Event Detection
E8-AC-ML2.9 Cyber security incidents are reported promptly to CISO	Application control	ISM-0123Equivalent Report Cyber Security Incidents Promptly ISM-0125Depends on Maintaining a Cyber Security Incident Register ISM-0140Partially overlaps Prompt Reporting of Cyber Incidents to ASD ISM-0142Broader than Report Cryptographic Equipment Compromises Promptly ISM-0714Partially meets Appoint a CISO to Lead Cyber Security Across IT and OT ISM-0733Supports Ensure CISO Awareness of Cyber Incidents ISM-1618Supports CISO's Role in Cyber Security Incident Response ISM-1803Partially overlaps Document and Report Cyber Security Incidents ISM-1819Partially overlaps Enact Cyber Security Incident Response Plans
E8-AC-ML2.10 Report cyber security incidents to ASD quickly	Application control	ISM-0043Depends on Cyber Security Incident Response Plan Requirements ISM-0140Equivalent Prompt Reporting of Cyber Incidents to ASD ISM-0142Partially overlaps Report Cryptographic Equipment Compromises Promptly
E8-AC-ML2.11 Cyber security incident response plan is enacted after incident identification	Application control	ISM-0043Depends on Cyber Security Incident Response Plan Requirements ISM-0576Depends on Develop and Maintain Cyber Security Incident Plans ISM-1731Depends on Plan and Coordinate Intrusion Remediation From Trusted Separate Systems ISM-1819Equivalent Enact Cyber Security Incident Response Plans
E8-AC-ML3.1 Application control is implemented on non-internet-facing servers	Application control	ISM-0955Broader than Implementing Application Control Measures ISM-1490Partially overlaps Implement Application Control on Internet-Facing Servers ISM-1493Depends on Maintain and Verify Software Registers ISM-1544Supports Implement Microsoft's Application Blocklist ISM-1656Equivalent Implement Application Control on Secure Servers ISM-1657Partially overlaps Restrict Application Execution to Approved Set ISM-1658Partially overlaps Restrict Execution of Drivers via Application Control ISM-1871Partially overlaps Implement Application Control Exclusions for System Areas ISM-1926Supports Restrict Identity Servers to Their Designed Role Only
E8-AC-ML3.2 Application control restricts driver execution to an approved set	Application control	ISM-0955Partially overlaps Implementing Application Control Measures ISM-1392Supports Restrict File Modifications via Path Rules ISM-1656Broader than Implement Application Control on Secure Servers ISM-1657Partially meets Restrict Application Execution to Approved Set ISM-1658Equivalent Restrict Execution of Drivers via Application Control ISM-1746Supports Restrict File System Permission Changes
E8-AC-ML3.3 Microsoft's vulnerable driver blocklist is implemented	Application control	ISM-0298Partially overlaps Centralised System Patch and Update Management ISM-1492Partially overlaps Enable Exploit Protection in Operating Systems ISM-1659Equivalent Implement Microsoft's Vulnerable Driver Blocklist ISM-1697Depends on Apply Non-Critical Patches Within One Month ISM-1703Partially overlaps Regular Vulnerability Scanning for Missing Patches
E8-AC-ML3.4 Event logs from non-internet-facing servers are analysed	Application control	ISM-0580Depends on Develop, Implement and Maintain a Security Monitoring Policy ISM-1228Broader than Analyse Cyber Security Events Promptly ISM-1830Depends on Central Logging of Security Events for Microsoft AD Infrastructure Servers ISM-1906Partially overlaps Timely Analysis of Internet-Facing Server Logs ISM-1907Equivalent Timely Analysis of Non-Internet-Server Logs ISM-1911Depends on Centralised Logging of Software Errors and Usage ISM-1960Partially overlaps Timely Analysis of Event Logs for Cyber security ISM-1961Partially overlaps Timely Analysis of Network Device Event Logs ISM-1986Partially overlaps Timely Analysis of Critical Server Event Logs ISM-2051Depends on Ensure Event Logs for Cyber security Event Detection ISM-2129Depends on Centrally Log WMI Activity and Event Subscriptions
E8-AC-ML3.5 Workstation event logs are promptly analysed for security events	Application control	ISM-0109Equivalent Timely Analysis of Workstation Event Logs ISM-1228Partially meets Analyse Cyber Security Events Promptly ISM-1889Depends on Central Logging of Command Line Events ISM-1987Partially meets Timely Analysis of Security Event Logs ISM-2051Depends on Ensure Event Logs for Cyber security Event Detection ISM-2125Partially overlaps Independently Log and Analyse All Service Provider System Access
E8-AH-ML1.1 Disable or remove Internet Explorer 11	User application hardening	ISM-0380Partially meets Disable Unneeded OS Accounts and Services ISM-1470Partially meets Disable Unneeded Accounts, Components, Services and Application Functionality ISM-1654Equivalent Disable or Remove Internet Explorer 11 ISM-1798Partially meets Develop Secure Configuration Guidelines for Software ISM-1809Depends on Compensating Controls for Unsupported Systems Pending Removal or Replacement ISM-1858Partially meets Implement Strict IT Equipment Hardening Guidelines ISM-1915Partially meets Ensure User Application Configurations are Approved ISM-2110Partially meets Hardening User Applications with ASD and Vendor Guidance
E8-AH-ML1.2 Web browsers must not execute Java content from the internet	User application hardening	ISM-0961Broader than Restrict Active Content with Web Filters ISM-0963Partially overlaps Implementing Web Content Filters for Safety ISM-1486Equivalent Restrict Java Processing in Web Browsers ISM-1585Depends on Lock Web Browser Security Settings Against Human User Changes ISM-2110Partially meets Hardening User Applications with ASD and Vendor Guidance
E8-AH-ML1.3 Web browsers block web ads from the internet	User application hardening	ISM-0963Partially meets Implementing Web Content Filters for Safety ISM-1485Equivalent Prevent Web Browsers from Processing Ads
E8-AH-ML1.4 Web browser security settings locked down to users	User application hardening	ISM-0382Partially overlaps Prevent Unprivileged Human Users Uninstalling or Disabling Approved Applications ISM-1235Partially overlaps Restrict User Application Extensions ISM-1412Partially meets Web Browser Hardening with Strict Guidelines ISM-1486Supports Restrict Java Processing in Web Browsers ISM-1585Equivalent Lock Web Browser Security Settings Against Human User Changes ISM-1748Partially overlaps Lock Email Client Security Settings Against User Changes ISM-1825Partially overlaps Lock Security Product Settings Against Changes by Human Users
E8-AH-ML2.1 Web browsers are hardened with the most restrictive guidance	User application hardening	ISM-1235Partially overlaps Restrict User Application Extensions ISM-1246Broader than Apply Strict Server Application Hardening Guidelines ISM-1412Equivalent Web Browser Hardening with Strict Guidelines ISM-1470Partially overlaps Disable Unneeded Accounts, Components, Services and Application Functionality ISM-1485Broader than Prevent Web Browsers from Processing Ads ISM-1486Broader than Restrict Java Processing in Web Browsers ISM-1585Supports Lock Web Browser Security Settings Against Human User Changes ISM-1858Broader than Implement Strict IT Equipment Hardening Guidelines
E8-AH-ML2.2 Block Microsoft Office from creating child processes	User application hardening	ISM-0843Partially meets Ensure Workstation Security with Application Control ISM-0955Partially meets Implementing Application Control Measures ISM-1601Equivalent Implement Microsoft Attack Surface Reduction Rules ISM-1667Equivalent Prevent Child Processes in Microsoft Office ISM-1668Partially overlaps Prevent Microsoft Office from Creating Executable Files ISM-1669Partially overlaps Prevent Microsoft Office from Injecting Code ISM-1670Partially overlaps Prevent PDF Applications from Creating Child Processes ISM-1673Partially overlaps Prevent Win32 API Calls by Office Macros ISM-1858Partially meets Implement Strict IT Equipment Hardening Guidelines ISM-1859Partially meets Hardening Office Productivity Suites ISM-2110Partially meets Hardening User Applications with ASD and Vendor Guidance
E8-AH-ML2.3 Block Microsoft Office from creating executable content	User application hardening	ISM-1667Partially overlaps Prevent Child Processes in Microsoft Office ISM-1668Equivalent Prevent Microsoft Office from Creating Executable Files ISM-1669Partially overlaps Prevent Microsoft Office from Injecting Code ISM-1672Partially overlaps Enable Antivirus Scanning for Office Macros ISM-1673Partially overlaps Prevent Win32 API Calls by Office Macros ISM-1823Depends on Lock Office Productivity Suite Security Settings Against User Changes ISM-1969Partially overlaps Preventing Accidental Execution of Malicious Code
E8-AH-ML2.4 Block Microsoft Office from injecting code into other processes	User application hardening	ISM-1601Equivalent Implement Microsoft Attack Surface Reduction Rules ISM-1667Partially overlaps Prevent Child Processes in Microsoft Office ISM-1668Partially overlaps Prevent Microsoft Office from Creating Executable Files ISM-1669Equivalent Prevent Microsoft Office from Injecting Code ISM-1673Partially overlaps Prevent Win32 API Calls by Office Macros ISM-1858Partially meets Implement Strict IT Equipment Hardening Guidelines
E8-AH-ML2.5 Configure Microsoft Office to prevent activation of OLE packages	User application hardening	ISM-0289Partially overlaps Implement and Manage Evaluated Products Correctly ISM-1542Equivalent Disable OLE in Microsoft Office for Security ISM-1601Depends on Implement Microsoft Attack Surface Reduction Rules ISM-1667Partially overlaps Prevent Child Processes in Microsoft Office ISM-1668Partially overlaps Prevent Microsoft Office from Creating Executable Files ISM-1673Partially overlaps Prevent Win32 API Calls by Office Macros ISM-1913Depends on Develop and Maintain Approved IT Configurations ISM-1915Depends on Ensure User Application Configurations are Approved ISM-2110Partially meets Hardening User Applications with ASD and Vendor Guidance
E8-AH-ML2.6 Office productivity suites are hardened using ASD and vendor guidance	User application hardening	ISM-0289Partially overlaps Implement and Manage Evaluated Products Correctly ISM-1235Broader than Restrict User Application Extensions ISM-1246Partially meets Apply Strict Server Application Hardening Guidelines ISM-1668Broader than Prevent Microsoft Office from Creating Executable Files ISM-1823Depends on Lock Office Productivity Suite Security Settings Against User Changes ISM-1858Partially meets Implement Strict IT Equipment Hardening Guidelines ISM-1859Equivalent Hardening Office Productivity Suites ISM-1915Partially meets Ensure User Application Configurations are Approved
E8-AH-ML2.7 Office productivity suite settings are immutable by users	User application hardening	ISM-0382Partially overlaps Prevent Unprivileged Human Users Uninstalling or Disabling Approved Applications ISM-1489Partially overlaps Lock Microsoft Office Macro Security Settings Against User Changes ISM-1542Supports Disable OLE in Microsoft Office for Security ISM-1669Broader than Prevent Microsoft Office from Injecting Code ISM-1748Partially overlaps Lock Email Client Security Settings Against User Changes ISM-1823Equivalent Lock Office Productivity Suite Security Settings Against User Changes ISM-1824Partially overlaps Lock PDF Application Security Settings Against User Changes ISM-1825Partially overlaps Lock Security Product Settings Against Changes by Human Users ISM-1858Partially meets Implement Strict IT Equipment Hardening Guidelines ISM-1859Partially meets Hardening Office Productivity Suites ISM-1915Depends on Ensure User Application Configurations are Approved
E8-AH-ML2.8 Block PDF software from creating child processes	User application hardening	ISM-1670Equivalent Prevent PDF Applications from Creating Child Processes
E8-AH-ML2.9 Ensure PDF software is securely configured using guidance.	User application hardening	ISM-0289Partially overlaps Implement and Manage Evaluated Products Correctly ISM-1246Partially meets Apply Strict Server Application Hardening Guidelines ISM-1406Depends on Use SOEs for Workstations and Servers ISM-1470Partially overlaps Disable Unneeded Accounts, Components, Services and Application Functionality ISM-1670Broader than Prevent PDF Applications from Creating Child Processes ISM-1824Partially overlaps Lock PDF Application Security Settings Against User Changes ISM-1858Partially meets Implement Strict IT Equipment Hardening Guidelines ISM-1859Partially overlaps Hardening Office Productivity Suites ISM-1860Equivalent Harden PDF Applications Using ASD Guidance ISM-1915Partially meets Ensure User Application Configurations are Approved
E8-AH-ML2.10 PDF software security settings cannot be changed by users	User application hardening	ISM-1489Partially overlaps Lock Microsoft Office Macro Security Settings Against User Changes ISM-1823Partially overlaps Lock Office Productivity Suite Security Settings Against User Changes ISM-1824Equivalent Lock PDF Application Security Settings Against User Changes ISM-1825Partially meets Lock Security Product Settings Against Changes by Human Users ISM-1858Partially meets Implement Strict IT Equipment Hardening Guidelines ISM-1915Depends on Ensure User Application Configurations are Approved ISM-2110Partially meets Hardening User Applications with ASD and Vendor Guidance
E8-AH-ML2.11 Centrally log PowerShell module, script block, and transcription events	User application hardening	ISM-0580Supports Develop, Implement and Maintain a Security Monitoring Policy ISM-0582Partially overlaps Central Logging of Windows Security Events ISM-0988Depends on Ensure Accurate Time Source for Event Logs ISM-1405Depends on Implement a Centralised Event Logging Facility ISM-1621Depends on Disable or Remove Windows PowerShell 2.0 ISM-1623Equivalent Centralised Logging of PowerShell Activities ISM-1624Partially overlaps Protect PowerShell Script Block Logs ISM-1889Partially overlaps Central Logging of Command Line Events ISM-1983Partially overlaps Log Events Sent to Centralised Facility Quickly ISM-2159Partially overlaps Centrally Log Agentic AI Tool Invocations, External Requests and Outputs
E8-AH-ML2.12 Command line process creation logging is centralised	User application hardening	ISM-0580Supports Develop, Implement and Maintain a Security Monitoring Policy ISM-0582Partially meets Central Logging of Windows Security Events ISM-0585Supports Capture Detailed Information in Event Logs ISM-0670Partially meets Central Logging of CDS Security Events ISM-1228Supports Analyse Cyber Security Events Promptly ISM-1405Partially meets Implement a Centralised Event Logging Facility ISM-1607Partially overlaps Integrity Monitoring and Logging for Isolation Mechanism ISM-1623Partially overlaps Centralised Logging of PowerShell Activities ISM-1889Equivalent Central Logging of Command Line Events ISM-1907Supports Timely Analysis of Non-Internet-Server Logs ISM-1976Supports Central Logging of Security Events on macOS ISM-1977Supports Central Logging of Linux System Events ISM-1983Depends on Log Events Sent to Centralised Facility Quickly ISM-1986Supports Timely Analysis of Critical Server Event Logs
E8-AH-ML2.13 Protect event logs from unauthorised changes or deletion	User application hardening	ISM-0138Supports Maintaining Integrity of Evidence in Investigations ISM-0582Partially overlaps Central Logging of Windows Security Events ISM-1509Depends on Log Privileged Access Events Centrally for Monitoring ISM-1624Partially meets Protect PowerShell Script Block Logs ISM-1815Equivalent Protect Event Logs from Unauthorised Access ISM-1985Partially meets Protect Event Logs from Unauthorised Access ISM-1989Supports Ensure Event Logs Meet Retention Requirements ISM-2125Partially overlaps Independently Log and Analyse All Service Provider System Access ISM-2132Partially overlaps Central Logging of Certificate Enrolment Requests, Template and AD CS Configuration Changes
E8-AH-ML2.14 Timely Analysis of Event Logs from Internet-Facing Servers	User application hardening	ISM-0580Supports Develop, Implement and Maintain a Security Monitoring Policy ISM-1228Partially meets Analyse Cyber Security Events Promptly ISM-1906Equivalent Timely Analysis of Internet-Facing Server Logs ISM-1907Partially overlaps Timely Analysis of Non-Internet-Server Logs ISM-1960Partially overlaps Timely Analysis of Event Logs for Cyber security ISM-1961Partially overlaps Timely Analysis of Network Device Event Logs ISM-1963Partially overlaps Central Logging of Events on Internet-Facing Devices ISM-1978Depends on Centralised Logging for Server Application Events ISM-1983Depends on Log Events Sent to Centralised Facility Quickly ISM-1986Partially overlaps Timely Analysis of Critical Server Event Logs ISM-1987Partially overlaps Timely Analysis of Security Event Logs ISM-2051Depends on Ensure Event Logs for Cyber security Event Detection ISM-2125Partially overlaps Independently Log and Analyse All Service Provider System Access ISM-2129Depends on Centrally Log WMI Activity and Event Subscriptions
E8-AH-ML2.15 Timely Analysis of Cyber Security Events to Identify Incidents	User application hardening	ISM-0109Depends on Timely Analysis of Workstation Event Logs ISM-0120Depends on Access to Tools for Detecting Security Events ISM-0634Depends on Central Logging for Gateway Security Events ISM-1030Depends on Deploy NIDS/NIPS for Gateway Traffic Monitoring ISM-1228Equivalent Analyse Cyber Security Events Promptly ISM-1526Depends on System Owners Continuously Monitor Security and Manage Threats, Risks and Controls ISM-1683Depends on Central Logging of Multi-factor Authentication Events ISM-1830Depends on Central Logging of Security Events for Microsoft AD Infrastructure Servers ISM-1911Depends on Centralised Logging of Software Errors and Usage ISM-1986Partially meets Timely Analysis of Critical Server Event Logs ISM-2117Depends on AI Models Augment Cyber Security Event Detection
E8-AH-ML2.16 Cyber security incidents must be reported immediately to the CISO	User application hardening	ISM-0043Partially meets Cyber Security Incident Response Plan Requirements ISM-0123Equivalent Report Cyber Security Incidents Promptly ISM-0125Supports Maintaining a Cyber Security Incident Register ISM-0140Partially overlaps Prompt Reporting of Cyber Incidents to ASD ISM-0141Supports Report Cyber Incidents Promptly to Designated Contacts ISM-0142Partially overlaps Report Cryptographic Equipment Compromises Promptly ISM-0576Partially meets Develop and Maintain Cyber Security Incident Plans ISM-0714Broader than Appoint a CISO to Lead Cyber Security Across IT and OT ISM-0733Equivalent Ensure CISO Awareness of Cyber Incidents ISM-1088Partially overlaps Report Potential Compromises of Mobile Devices Overseas ISM-1618Partially overlaps CISO's Role in Cyber Security Incident Response ISM-1803Partially overlaps Document and Report Cyber Security Incidents ISM-1819Partially overlaps Enact Cyber Security Incident Response Plans ISM-1881Supports Timely Reporting of Cyber Incidents Without Data Breach
E8-AH-ML2.17 Report cyber security incidents to ASD promptly	User application hardening	ISM-0043Partially meets Cyber Security Incident Response Plan Requirements ISM-0123Supports Report Cyber Security Incidents Promptly ISM-0140Equivalent Prompt Reporting of Cyber Incidents to ASD
E8-AH-ML2.18 Cyber incident response plan is enacted after identification	User application hardening	ISM-0043Depends on Cyber Security Incident Response Plan Requirements ISM-0123Partially overlaps Report Cyber Security Incidents Promptly ISM-0576Depends on Develop and Maintain Cyber Security Incident Plans ISM-1618Partially overlaps CISO's Role in Cyber Security Incident Response ISM-1819Equivalent Enact Cyber Security Incident Response Plans
E8-AH-ML3.1 .NET Framework 3.5, 3.0, 2.0 is disabled or removed	User application hardening	ISM-1246Partially overlaps Apply Strict Server Application Hardening Guidelines ISM-1409Partially meets Implement Restrictive OS Hardening Guidelines ISM-1470Partially meets Disable Unneeded Accounts, Components, Services and Application Functionality ISM-1621Partially overlaps Disable or Remove Windows PowerShell 2.0 ISM-1655Equivalent Ensure .NET Framework 3.5 is Disabled or Removed
E8-AH-ML3.2 Ensure Windows PowerShell 2.0 is disabled or removed	User application hardening	ISM-0380Partially meets Disable Unneeded OS Accounts and Services ISM-1246Partially overlaps Apply Strict Server Application Hardening Guidelines ISM-1247Partially meets Disable or Remove Unneeded Server Features ISM-1409Partially meets Implement Restrictive OS Hardening Guidelines ISM-1470Partially meets Disable Unneeded Accounts, Components, Services and Application Functionality ISM-1584Depends on Prevent Unauthorised Changes to Security Settings ISM-1621Equivalent Disable or Remove Windows PowerShell 2.0 ISM-1622Supports Ensure PowerShell Uses Constrained Language Mode ISM-1655Partially overlaps Ensure .NET Framework 3.5 is Disabled or Removed ISM-1858Partially meets Implement Strict IT Equipment Hardening Guidelines ISM-1914Partially meets Ensure Operating Systems Have Approved Configurations
E8-AH-ML3.3 PowerShell is configured to use Constrained Language Mode	User application hardening	ISM-0380Partially meets Disable Unneeded OS Accounts and Services ISM-1246Partially overlaps Apply Strict Server Application Hardening Guidelines ISM-1409Partially meets Implement Restrictive OS Hardening Guidelines ISM-1491Partially overlaps Block Unprivileged Users From Running Script Execution Engines ISM-1621Depends on Disable or Remove Windows PowerShell 2.0 ISM-1622Equivalent Ensure PowerShell Uses Constrained Language Mode ISM-1798Partially meets Develop Secure Configuration Guidelines for Software ISM-1858Partially meets Implement Strict IT Equipment Hardening Guidelines
E8-AH-ML3.4 Analyse event logs from non-internet-facing servers for cyber threats	User application hardening	ISM-0120Depends on Access to Tools for Detecting Security Events ISM-0988Depends on Ensure Accurate Time Source for Event Logs ISM-1228Partially meets Analyse Cyber Security Events Promptly ISM-1907Equivalent Timely Analysis of Non-Internet-Server Logs ISM-1979Depends on Central Logging for Security Events on Servers ISM-1986Partially overlaps Timely Analysis of Critical Server Event Logs ISM-2125Partially overlaps Independently Log and Analyse All Service Provider System Access ISM-2129Depends on Centrally Log WMI Activity and Event Subscriptions ISM-2132Depends on Central Logging of Certificate Enrolment Requests, Template and AD CS Configuration Changes
E8-AH-ML3.5 Timely Analysis of Workstation Event Logs for Cyber security	User application hardening	ISM-0109Equivalent Timely Analysis of Workstation Event Logs ISM-0120Depends on Access to Tools for Detecting Security Events ISM-0580Depends on Develop, Implement and Maintain a Security Monitoring Policy ISM-1228Broader than Analyse Cyber Security Events Promptly ISM-1906Partially overlaps Timely Analysis of Internet-Facing Server Logs ISM-1907Partially overlaps Timely Analysis of Non-Internet-Server Logs ISM-1960Partially overlaps Timely Analysis of Event Logs for Cyber security ISM-1961Partially overlaps Timely Analysis of Network Device Event Logs ISM-1986Partially overlaps Timely Analysis of Critical Server Event Logs ISM-1987Partially overlaps Timely Analysis of Security Event Logs ISM-2051Depends on Ensure Event Logs for Cyber security Event Detection
E8-MF-ML1.1 Require multi-factor authentication for sensitive online services	Multi-factor authentication	ISM-1401Supports Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1504Equivalent Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1505Partially overlaps Multi-factor Authentication for Human Users of Data Repositories ISM-1546Partially meets Ensure User Authentication Before System Access ISM-1679Partially overlaps Multi-factor Authentication for Third-party Services Handling Sensitive Data ISM-1681Partially overlaps Mandating Multi-Factor Authentication for Customer Services ISM-1682Partially meets Phishing-resistant multi-factor authentication for human users of systems ISM-1872Supports Phishing-Resistant Multi-Factor Authentication for Human Users of Online Services ISM-1892Broader than Multi-Factor Authentication for Organisation Users of Online Customer Services ISM-1893Partially overlaps Multi-Factor Authentication for Third-Party Services Holding Sensitive Customer Data ISM-1919Depends on Disable Authentication Protocols That Cannot Support Multi-Factor Authentication
E8-MF-ML1.2 Multi-factor authentication for third-party services handling sensitive data	Multi-factor authentication	ISM-1401Partially meets Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1504Partially overlaps Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1679Equivalent Multi-factor Authentication for Third-party Services Handling Sensitive Data ISM-1680Partially overlaps Multi-Factor Authentication for Human Users of Third-Party Services Holding Non-Sensitive Data ISM-1681Partially overlaps Mandating Multi-Factor Authentication for Customer Services ISM-1893Partially overlaps Multi-Factor Authentication for Third-Party Services Holding Sensitive Customer Data ISM-1919Depends on Disable Authentication Protocols That Cannot Support Multi-Factor Authentication
E8-MF-ML1.3 Use multi-factor authentication for non-sensitive third-party services	Multi-factor authentication	ISM-1401Depends on Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1505Partially overlaps Multi-factor Authentication for Human Users of Data Repositories ISM-1680Equivalent Multi-Factor Authentication for Human Users of Third-Party Services Holding Non-Sensitive Data ISM-1919Supports Disable Authentication Protocols That Cannot Support Multi-Factor Authentication
E8-MF-ML1.4 Use multi-factor authentication for online services handling customer data	Multi-factor authentication	ISM-1401Partially meets Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1504Partially overlaps Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1505Partially overlaps Multi-factor Authentication for Human Users of Data Repositories ISM-1681Partially overlaps Mandating Multi-Factor Authentication for Customer Services ISM-1682Supports Phishing-resistant multi-factor authentication for human users of systems ISM-1892Equivalent Multi-Factor Authentication for Organisation Users of Online Customer Services ISM-1893Partially overlaps Multi-Factor Authentication for Third-Party Services Holding Sensitive Customer Data ISM-1919Depends on Disable Authentication Protocols That Cannot Support Multi-Factor Authentication
E8-MF-ML1.5 Multi-factor authentication for third-party services with sensitive customer data	Multi-factor authentication	ISM-0974Partially overlaps Multi-Factor Authentication for Unprivileged Human Users of Systems ISM-1401Depends on Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1504Partially overlaps Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1679Equivalent Multi-factor Authentication for Third-party Services Handling Sensitive Data ISM-1680Partially overlaps Multi-Factor Authentication for Human Users of Third-Party Services Holding Non-Sensitive Data ISM-1681Partially overlaps Mandating Multi-Factor Authentication for Customer Services ISM-1892Partially overlaps Multi-Factor Authentication for Organisation Users of Online Customer Services ISM-1893Equivalent Multi-Factor Authentication for Third-Party Services Holding Sensitive Customer Data ISM-1919Supports Disable Authentication Protocols That Cannot Support Multi-Factor Authentication
E8-MF-ML1.6 Multi-factor authentication for customer access to online services handling sensitive data	Multi-factor authentication	ISM-1401Depends on Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1504Partially overlaps Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1681Equivalent Mandating Multi-Factor Authentication for Customer Services ISM-1873Supports Enhance Security with Phishing-Resistant MFA ISM-1874Partially overlaps Phishing-Resistant Multi-Factor Authentication for Customers ISM-1892Equivalent Multi-Factor Authentication for Organisation Users of Online Customer Services ISM-1893Partially overlaps Multi-Factor Authentication for Third-Party Services Holding Sensitive Customer Data ISM-1919Depends on Disable Authentication Protocols That Cannot Support Multi-Factor Authentication ISM-1920Partially overlaps Blocking MFA Self-Enrolment From Untrustworthy Devices
E8-MF-ML1.7 Multi-factor authentication combines two factors like a device and a PIN	Multi-factor authentication	ISM-0974Partially meets Multi-Factor Authentication for Unprivileged Human Users of Systems ISM-1173Partially meets Multi-Factor Authentication for Privileged Human Users of Systems ISM-1401Equivalent Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1504Partially meets Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1505Partially meets Multi-factor Authentication for Human Users of Data Repositories ISM-1546Partially meets Ensure User Authentication Before System Access ISM-1560Broader than Ensure Strong Passwords for SECRET System Authentication ISM-1679Partially meets Multi-factor Authentication for Third-party Services Handling Sensitive Data ISM-1680Partially meets Multi-Factor Authentication for Human Users of Third-Party Services Holding Non-Sensitive Data ISM-1681Partially meets Mandating Multi-Factor Authentication for Customer Services ISM-1872Partially overlaps Phishing-Resistant Multi-Factor Authentication for Human Users of Online Services ISM-1893Partially meets Multi-Factor Authentication for Third-Party Services Holding Sensitive Customer Data ISM-1919Depends on Disable Authentication Protocols That Cannot Support Multi-Factor Authentication
E8-MF-ML2.1 Multi-factor authentication for privileged users of systems	Multi-factor authentication	ISM-1173Equivalent Multi-Factor Authentication for Privileged Human Users of Systems ISM-1401Depends on Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1919Supports Disable Authentication Protocols That Cannot Support Multi-Factor Authentication
E8-MF-ML2.2 Use multi-factor authentication for unprivileged user access	Multi-factor authentication	ISM-0974Equivalent Multi-Factor Authentication for Unprivileged Human Users of Systems ISM-1401Supports Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1505Partially overlaps Multi-factor Authentication for Human Users of Data Repositories ISM-1682Partially overlaps Phishing-resistant multi-factor authentication for human users of systems ISM-1854Partially overlaps Human Users Authenticate to MFDs Before Printing, Scanning or Copying ISM-1893Partially overlaps Multi-Factor Authentication for Third-Party Services Holding Sensitive Customer Data ISM-2077Supports Avoid Email for Out-of-Band Authentication
E8-MF-ML2.3 Multi-factor authentication online services must be phishing-resistant	Multi-factor authentication	ISM-0555Partially overlaps Ensure Authentication for IP Telephony Actions ISM-1173Partially overlaps Multi-Factor Authentication for Privileged Human Users of Systems ISM-1401Partially overlaps Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1504Depends on Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1680Supports Multi-Factor Authentication for Human Users of Third-Party Services Holding Non-Sensitive Data ISM-1682Broader than Phishing-resistant multi-factor authentication for human users of systems ISM-1872Equivalent Phishing-Resistant Multi-Factor Authentication for Human Users of Online Services ISM-1874Partially overlaps Phishing-Resistant Multi-Factor Authentication for Customers ISM-1892Partially overlaps Multi-Factor Authentication for Organisation Users of Online Customer Services ISM-1893Supports Multi-Factor Authentication for Third-Party Services Holding Sensitive Customer Data ISM-1894Partially overlaps Phishing-Resistant Multi-Factor Authentication for Human Users of Data Repositories ISM-1919Depends on Disable Authentication Protocols That Cannot Support Multi-Factor Authentication ISM-1920Supports Blocking MFA Self-Enrolment From Untrustworthy Devices ISM-2011Partially overlaps Disabling Weaker MFA Options When Phishing-Resistant MFA Is Used ISM-2077Supports Avoid Email for Out-of-Band Authentication
E8-MF-ML2.5 Multi-factor authentication used for system access is phishing-resistant	Multi-factor authentication	ISM-0974Supports Multi-Factor Authentication for Unprivileged Human Users of Systems ISM-1173Partially overlaps Multi-Factor Authentication for Privileged Human Users of Systems ISM-1401Partially meets Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1505Partially overlaps Multi-factor Authentication for Human Users of Data Repositories ISM-1680Partially overlaps Multi-Factor Authentication for Human Users of Third-Party Services Holding Non-Sensitive Data ISM-1682Equivalent Phishing-resistant multi-factor authentication for human users of systems ISM-1872Partially overlaps Phishing-Resistant Multi-Factor Authentication for Human Users of Online Services ISM-1893Supports Multi-Factor Authentication for Third-Party Services Holding Sensitive Customer Data ISM-1894Partially overlaps Phishing-Resistant Multi-Factor Authentication for Human Users of Data Repositories ISM-2011Depends on Disabling Weaker MFA Options When Phishing-Resistant MFA Is Used ISM-2077Supports Avoid Email for Out-of-Band Authentication
E8-MF-ML2.6 MFA success and failure events are centrally logged	Multi-factor authentication	ISM-0580Supports Develop, Implement and Maintain a Security Monitoring Policy ISM-0585Partially overlaps Capture Detailed Information in Event Logs ISM-1405Partially meets Implement a Centralised Event Logging Facility ISM-1504Depends on Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1505Depends on Multi-factor Authentication for Human Users of Data Repositories ISM-1509Partially overlaps Log Privileged Access Events Centrally for Monitoring ISM-1683Equivalent Central Logging of Multi-factor Authentication Events ISM-1892Depends on Multi-Factor Authentication for Organisation Users of Online Customer Services ISM-1895Partially overlaps Log Single-factor Authentication Events ISM-1976Partially overlaps Central Logging of Security Events on macOS ISM-1977Partially overlaps Central Logging of Linux System Events
E8-MF-ML2.7 Protect event logs from unauthorised changes	Multi-factor authentication	ISM-0580Supports Develop, Implement and Maintain a Security Monitoring Policy ISM-1607Depends on Integrity Monitoring and Logging for Isolation Mechanism ISM-1624Partially overlaps Protect PowerShell Script Block Logs ISM-1815Equivalent Protect Event Logs from Unauthorised Access ISM-1830Partially overlaps Central Logging of Security Events for Microsoft AD Infrastructure Servers ISM-1989Depends on Ensure Event Logs Meet Retention Requirements
E8-MF-ML2.8 Timely analysis of event logs from internet-facing servers	Multi-factor authentication	ISM-0580Supports Develop, Implement and Maintain a Security Monitoring Policy ISM-0634Partially overlaps Central Logging for Gateway Security Events ISM-0988Depends on Ensure Accurate Time Source for Event Logs ISM-1030Partially overlaps Deploy NIDS/NIPS for Gateway Traffic Monitoring ISM-1228Broader than Analyse Cyber Security Events Promptly ISM-1405Depends on Implement a Centralised Event Logging Facility ISM-1906Equivalent Timely Analysis of Internet-Facing Server Logs ISM-1907Partially overlaps Timely Analysis of Non-Internet-Server Logs ISM-1961Partially overlaps Timely Analysis of Network Device Event Logs ISM-1978Depends on Centralised Logging for Server Application Events ISM-1986Partially overlaps Timely Analysis of Critical Server Event Logs ISM-1987Partially meets Timely Analysis of Security Event Logs
E8-MF-ML2.9 Cyber security events are analysed to identify incidents timely	Multi-factor authentication	ISM-1213Depends on Enhanced Monitoring After Intrusion Remediation Until Eradication Is Confirmed ISM-1228Equivalent Analyse Cyber Security Events Promptly ISM-1526Depends on System Owners Continuously Monitor Security and Manage Threats, Risks and Controls ISM-1536Depends on Central Logging of Software Database Queries and Errors ISM-1906Depends on Timely Analysis of Internet-Facing Server Logs ISM-1907Partially meets Timely Analysis of Non-Internet-Server Logs ISM-1960Partially meets Timely Analysis of Event Logs for Cyber security ISM-1961Partially meets Timely Analysis of Network Device Event Logs ISM-1986Partially meets Timely Analysis of Critical Server Event Logs ISM-1987Partially meets Timely Analysis of Security Event Logs
E8-MF-ML2.10 Report cyber security incidents to the Chief Information Security Officer promptly	Multi-factor authentication	ISM-0043Supports Cyber Security Incident Response Plan Requirements ISM-0123Equivalent Report Cyber Security Incidents Promptly ISM-0140Partially overlaps Prompt Reporting of Cyber Incidents to ASD ISM-0142Broader than Report Cryptographic Equipment Compromises Promptly ISM-0252Depends on Annual Cyber Security Awareness for Personnel ISM-0733Equivalent Ensure CISO Awareness of Cyber Incidents ISM-1803Partially overlaps Document and Report Cyber Security Incidents
E8-MF-ML2.11 Report cyber security incidents to ASD immediately	Multi-factor authentication	ISM-0043Partially meets Cyber Security Incident Response Plan Requirements ISM-0123Partially overlaps Report Cyber Security Incidents Promptly ISM-0140Equivalent Prompt Reporting of Cyber Incidents to ASD ISM-0141Partially overlaps Report Cyber Incidents Promptly to Designated Contacts ISM-0142Partially overlaps Report Cryptographic Equipment Compromises Promptly ISM-1228Depends on Analyse Cyber Security Events Promptly
E8-MF-ML2.12 Cyber security incident response plan enacted after incident identification	Multi-factor authentication	ISM-0043Depends on Cyber Security Incident Response Plan Requirements ISM-0123Supports Report Cyber Security Incidents Promptly ISM-0576Depends on Develop and Maintain Cyber Security Incident Plans ISM-1618Partially overlaps CISO's Role in Cyber Security Incident Response ISM-1784Depends on Annual Testing of Cyber Incident Response Plan ISM-1805Broader than Develop a Denial of Service Response Plan ISM-1819Equivalent Enact Cyber Security Incident Response Plans
E8-MF-ML3.1 Multi-factor authentication is used to authenticate users of data repositories	Multi-factor authentication	ISM-0974Partially overlaps Multi-Factor Authentication for Unprivileged Human Users of Systems ISM-1173Partially overlaps Multi-Factor Authentication for Privileged Human Users of Systems ISM-1401Depends on Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1504Partially meets Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1505Equivalent Multi-factor Authentication for Human Users of Data Repositories ISM-1872Supports Phishing-Resistant Multi-Factor Authentication for Human Users of Online Services ISM-1894Supports Phishing-Resistant Multi-Factor Authentication for Human Users of Data Repositories ISM-1919Depends on Disable Authentication Protocols That Cannot Support Multi-Factor Authentication ISM-1920Supports Blocking MFA Self-Enrolment From Untrustworthy Devices
E8-MF-ML3.2 Phishing-resistant multi-factor authentication for online customer services	Multi-factor authentication	ISM-1401Partially overlaps Multi-Factor Authentication Combines Possession With Knowledge or Inherence ISM-1546Partially meets Ensure User Authentication Before System Access ISM-1680Partially overlaps Multi-Factor Authentication for Human Users of Third-Party Services Holding Non-Sensitive Data ISM-1681Broader than Mandating Multi-Factor Authentication for Customer Services ISM-1682Partially meets Phishing-resistant multi-factor authentication for human users of systems ISM-1872Partially meets Phishing-Resistant Multi-Factor Authentication for Human Users of Online Services ISM-1873Equivalent Enhance Security with Phishing-Resistant MFA ISM-1874Equivalent Phishing-Resistant Multi-Factor Authentication for Customers ISM-2011Depends on Disabling Weaker MFA Options When Phishing-Resistant MFA Is Used ISM-2077Partially overlaps Avoid Email for Out-of-Band Authentication
E8-MF-ML3.3 Phishing-resistant multi-factor authentication for data repositories	Multi-factor authentication	ISM-1504Partially overlaps Multi-Factor Authentication for Human Users of Sensitive Data Online Services ISM-1505Partially meets Multi-factor Authentication for Human Users of Data Repositories ISM-1679Partially overlaps Multi-factor Authentication for Third-party Services Handling Sensitive Data ISM-1682Partially meets Phishing-resistant multi-factor authentication for human users of systems ISM-1872Partially overlaps Phishing-Resistant Multi-Factor Authentication for Human Users of Online Services ISM-1894Equivalent Phishing-Resistant Multi-Factor Authentication for Human Users of Data Repositories ISM-2011Depends on Disabling Weaker MFA Options When Phishing-Resistant MFA Is Used ISM-2077Supports Avoid Email for Out-of-Band Authentication
E8-MF-ML3.4 Analyse event logs from non-internet-facing servers timely to detect security events	Multi-factor authentication	ISM-0120Depends on Access to Tools for Detecting Security Events ISM-1228Broader than Analyse Cyber Security Events Promptly ISM-1830Depends on Central Logging of Security Events for Microsoft AD Infrastructure Servers ISM-1906Partially overlaps Timely Analysis of Internet-Facing Server Logs ISM-1907Equivalent Timely Analysis of Non-Internet-Server Logs ISM-1911Depends on Centralised Logging of Software Errors and Usage ISM-1961Partially overlaps Timely Analysis of Network Device Event Logs ISM-1979Depends on Central Logging for Security Events on Servers ISM-1986Partially overlaps Timely Analysis of Critical Server Event Logs ISM-1987Partially overlaps Timely Analysis of Security Event Logs
E8-MF-ML3.5 Timely analysis of workstation event logs for cyber security events	Multi-factor authentication	ISM-0109Equivalent Timely Analysis of Workstation Event Logs ISM-0120Depends on Access to Tools for Detecting Security Events ISM-0582Depends on Central Logging of Windows Security Events ISM-1228Depends on Analyse Cyber Security Events Promptly ISM-1405Depends on Implement a Centralised Event Logging Facility ISM-1976Depends on Central Logging of Security Events on macOS ISM-1983Depends on Log Events Sent to Centralised Facility Quickly ISM-2051Depends on Ensure Event Logs for Cyber security Event Detection
E8-PA-ML1.1 Automated asset discovery at least fortnightly	Patch applications	ISM-0336Partially overlaps Develop and Maintain Networked IT Equipment Register ISM-1163Depends on Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1702Supports Regularly Scan for Missing Security Patches ISM-1703Supports Regular Vulnerability Scanning for Missing Patches ISM-1752Supports Fortnightly Vulnerability Scanning for Non-Workstations ISM-1807Equivalent Automated Asset Discovery for Vulnerability Scanning ISM-1966Supports CISO Manages and Verifies System Register
E8-PA-ML1.2 Up-to-date vulnerability scanner used for scanning activities	Patch applications	ISM-1163Partially meets Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1693Supports Timely Application of Patches to Mitigate Vulnerabilities ISM-1698Partially meets Daily Vulnerability Scanning for Missing Updates ISM-1699Partially meets Weekly Vulnerability Scanning for Software Updates ISM-1700Partially meets Regular Vulnerability Scanning for Applications ISM-1701Partially meets Daily Vulnerability Scanning for Internet-Facing Systems ISM-1703Partially meets Regular Vulnerability Scanning for Missing Patches ISM-1808Equivalent Vulnerability Scanning with Updated Tools
E8-PA-ML1.3 Daily vulnerability scanning for missing patches in online services	Patch applications	ISM-0298Supports Centralised System Patch and Update Management ISM-1143Supports Develop and Maintain Patch Management Procedures ISM-1698Equivalent Daily Vulnerability Scanning for Missing Updates ISM-1701Partially overlaps Daily Vulnerability Scanning for Internet-Facing Systems ISM-1808Depends on Vulnerability Scanning with Updated Tools
E8-PA-ML1.4 Weekly scanning for missing patches or updates in key software	Patch applications	ISM-0298Supports Centralised System Patch and Update Management ISM-1143Partially meets Develop and Maintain Patch Management Procedures ISM-1163Partially overlaps Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1467Supports Use Latest Releases of User Applications ISM-1526Partially meets System Owners Continuously Monitor Security and Manage Threats, Risks and Controls ISM-1691Supports Timely Vulnerability Patching in Software Tools ISM-1692Supports Quick Apply Critical Patches for Vulnerabilities ISM-1693Partially overlaps Timely Application of Patches to Mitigate Vulnerabilities ISM-1699Equivalent Weekly Vulnerability Scanning for Software Updates ISM-1700Partially overlaps Regular Vulnerability Scanning for Applications ISM-1703Partially overlaps Regular Vulnerability Scanning for Missing Patches ISM-1754Supports Timely Resolution of Identified Software Vulnerabilities ISM-1901Supports Timely Application of Non-Critical Security Patches
E8-PA-ML1.5 Apply Critical Online Service Patches Within 48 Hours	Patch applications	ISM-0298Depends on Centralised System Patch and Update Management ISM-1483Partially overlaps Use Latest Release of Internet-Facing Server Applications ISM-1698Depends on Daily Vulnerability Scanning for Missing Updates ISM-1754Partially meets Timely Resolution of Identified Software Vulnerabilities ISM-1876Equivalent Apply Critical Patches Within 48 Hours ISM-1877Partially overlaps Timely Application of Critical Security Patches ISM-1879Partially overlaps Timely Patching of Critical Driver Vulnerabilities ISM-1921Depends on Assess System Compromise Risks Often
E8-PA-ML1.6 Apply non-critical patches for online services within two weeks	Patch applications	ISM-0298Supports Centralised System Patch and Update Management ISM-1143Depends on Develop and Maintain Patch Management Procedures ISM-1163Partially meets Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1483Partially overlaps Use Latest Release of Internet-Facing Server Applications ISM-1690Equivalent Timely Application of Non-Critical Vulnerability Patches ISM-1694Partially overlaps Timely Application of Non-Critical Security Patches ISM-1697Partially overlaps Apply Non-Critical Patches Within One Month ISM-1698Depends on Daily Vulnerability Scanning for Missing Updates ISM-1876Partially overlaps Apply Critical Patches Within 48 Hours
E8-PA-ML1.8 Unsupported online services are removed by the organisation	Patch applications	ISM-0304Partially overlaps Remove Unsupported Applications for System Security ISM-1704Partially overlaps Remove Unsupported Software to Ensure Security ISM-1809Partially overlaps Compensating Controls for Unsupported Systems Pending Removal or Replacement ISM-1905Equivalent Remove Online Services No Longer Supported by Vendors ISM-1981Partially overlaps Replace Unsupportable Non-Internet Network Devices
E8-PA-ML1.9 Removal of unsupported software and applications	Patch applications	ISM-0304Partially overlaps Remove Unsupported Applications for System Security ISM-1247Partially overlaps Disable or Remove Unneeded Server Features ISM-1467Partially overlaps Use Latest Releases of User Applications ISM-1643Depends on Maintain Detailed Software Version and Patch Records ISM-1654Broader than Disable or Remove Internet Explorer 11 ISM-1704Equivalent Remove Unsupported Software to Ensure Security ISM-1809Partially overlaps Compensating Controls for Unsupported Systems Pending Removal or Replacement ISM-1848Partially overlaps Replace Unsupported Software-Based Isolation Mechanisms Sharing Physical Resources ISM-1981Partially overlaps Replace Unsupportable Non-Internet Network Devices
E8-PA-ML2.1 Fortnightly vulnerability scanning for non-core applications	Patch applications	ISM-0298Supports Centralised System Patch and Update Management ISM-1693Partially overlaps Timely Application of Patches to Mitigate Vulnerabilities ISM-1699Partially overlaps Weekly Vulnerability Scanning for Software Updates ISM-1700Equivalent Regular Vulnerability Scanning for Applications ISM-1703Partially overlaps Regular Vulnerability Scanning for Missing Patches ISM-2118Partially meets Conduct Vulnerability Assessments and Penetration Tests
E8-PA-ML2.2 Timely Patching of Non-Critical Application Vulnerabilities	Patch applications	ISM-0298Depends on Centralised System Patch and Update Management ISM-0304Partially overlaps Remove Unsupported Applications for System Security ISM-1143Depends on Develop and Maintain Patch Management Procedures ISM-1163Partially overlaps Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1606Partially overlaps Patch Isolation Mechanisms and Underlying Operating Systems Promptly ISM-1643Depends on Maintain Detailed Software Version and Patch Records ISM-1693Equivalent Timely Application of Patches to Mitigate Vulnerabilities ISM-1700Depends on Regular Vulnerability Scanning for Applications
E8-PA-ML3.1 Patch critical vulnerabilities in applications within 48 hours	Patch applications	ISM-0298Supports Centralised System Patch and Update Management ISM-1143Partially meets Develop and Maintain Patch Management Procedures ISM-1163Partially meets Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1366Partially overlaps Ensure Timely Security Updates for Mobile Devices ISM-1467Partially overlaps Use Latest Releases of User Applications ISM-1691Partially overlaps Timely Vulnerability Patching in Software Tools ISM-1692Equivalent Quick Apply Critical Patches for Vulnerabilities ISM-1699Depends on Weekly Vulnerability Scanning for Software Updates ISM-1754Partially meets Timely Resolution of Identified Software Vulnerabilities ISM-1901Partially overlaps Timely Application of Non-Critical Security Patches ISM-1921Supports Assess System Compromise Risks Often
E8-PA-ML3.2 Apply patches for non-critical vulnerabilities within two weeks	Patch applications	ISM-1467Partially overlaps Use Latest Releases of User Applications ISM-1643Depends on Maintain Detailed Software Version and Patch Records ISM-1691Partially overlaps Timely Vulnerability Patching in Software Tools ISM-1692Partially overlaps Quick Apply Critical Patches for Vulnerabilities ISM-1693Partially overlaps Timely Application of Patches to Mitigate Vulnerabilities ISM-1754Partially meets Timely Resolution of Identified Software Vulnerabilities ISM-1901Equivalent Timely Application of Non-Critical Security Patches
E8-PA-ML3.3 Remove unsupported applications excluding certain categories	Patch applications	ISM-0304Equivalent Remove Unsupported Applications for System Security ISM-1483Partially overlaps Use Latest Release of Internet-Facing Server Applications ISM-1493Depends on Maintain and Verify Software Registers ISM-1704Partially overlaps Remove Unsupported Software to Ensure Security ISM-1809Partially overlaps Compensating Controls for Unsupported Systems Pending Removal or Replacement
E8-PO-ML1.1 Automated bi-weekly asset discovery for vulnerability scanning	Patch operating systems	ISM-0336Supports Develop and Maintain Networked IT Equipment Register ISM-1163Broader than Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1493Supports Maintain and Verify Software Registers ISM-1696Supports Apply Critical Patches Within 48 Hours ISM-1697Depends on Apply Non-Critical Patches Within One Month ISM-1700Supports Regular Vulnerability Scanning for Applications ISM-1703Supports Regular Vulnerability Scanning for Missing Patches ISM-1807Equivalent Automated Asset Discovery for Vulnerability Scanning ISM-2118Partially meets Conduct Vulnerability Assessments and Penetration Tests
E8-PO-ML1.2 Use a vulnerability scanner with an updated database	Patch operating systems	ISM-1696Supports Apply Critical Patches Within 48 Hours ISM-1697Supports Apply Non-Critical Patches Within One Month ISM-1698Supports Daily Vulnerability Scanning for Missing Updates ISM-1699Partially meets Weekly Vulnerability Scanning for Software Updates ISM-1701Supports Daily Vulnerability Scanning for Internet-Facing Systems ISM-1702Supports Regularly Scan for Missing Security Patches ISM-1752Supports Fortnightly Vulnerability Scanning for Non-Workstations ISM-1808Equivalent Vulnerability Scanning with Updated Tools ISM-1879Supports Timely Patching of Critical Driver Vulnerabilities ISM-1900Depends on Fortnightly System Vulnerability Scanning
E8-PO-ML1.3 Use a daily vulnerability scanner for internet-facing systems	Patch operating systems	ISM-0298Supports Centralised System Patch and Update Management ISM-1163Partially meets Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1694Supports Timely Application of Non-Critical Security Patches ISM-1698Partially overlaps Daily Vulnerability Scanning for Missing Updates ISM-1701Equivalent Daily Vulnerability Scanning for Internet-Facing Systems ISM-1702Partially overlaps Regularly Scan for Missing Security Patches ISM-1703Partially overlaps Regular Vulnerability Scanning for Missing Patches ISM-1752Partially overlaps Fortnightly Vulnerability Scanning for Non-Workstations ISM-1808Depends on Vulnerability Scanning with Updated Tools ISM-1877Supports Timely Application of Critical Security Patches ISM-1900Partially overlaps Fortnightly System Vulnerability Scanning
E8-PO-ML1.4 Use a vulnerability scanner fortnightly to find missing OS patches	Patch operating systems	ISM-0298Supports Centralised System Patch and Update Management ISM-1163Partially meets Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1696Supports Apply Critical Patches Within 48 Hours ISM-1702Equivalent Regularly Scan for Missing Security Patches ISM-1703Partially overlaps Regular Vulnerability Scanning for Missing Patches ISM-1808Depends on Vulnerability Scanning with Updated Tools
E8-PO-ML1.5 Apply critical patches to internet-facing OS within 48 hours	Patch operating systems	ISM-0298Depends on Centralised System Patch and Update Management ISM-1143Depends on Develop and Maintain Patch Management Procedures ISM-1163Supports Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1407Partially overlaps Ensure Use of Current OS Versions ISM-1606Partially overlaps Patch Isolation Mechanisms and Underlying Operating Systems Promptly ISM-1643Depends on Maintain Detailed Software Version and Patch Records ISM-1694Partially overlaps Timely Application of Non-Critical Security Patches ISM-1696Partially overlaps Apply Critical Patches Within 48 Hours ISM-1701Depends on Daily Vulnerability Scanning for Internet-Facing Systems ISM-1753Depends on Replace Unsupported Internet-Facing Devices ISM-1876Partially overlaps Apply Critical Patches Within 48 Hours ISM-1877Equivalent Timely Application of Critical Security Patches ISM-1878Partially overlaps Apply Critical Patches Within 48 Hours ISM-1879Partially overlaps Timely Patching of Critical Driver Vulnerabilities ISM-1902Partially overlaps Apply Non-Critical Patches to Non-Internet Systems Promptly ISM-1921Depends on Assess System Compromise Risks Often
E8-PO-ML1.6 Timely application of non-critical patches for internet-facing OS vulnerabilities	Patch operating systems	ISM-1143Depends on Develop and Maintain Patch Management Procedures ISM-1606Partially overlaps Patch Isolation Mechanisms and Underlying Operating Systems Promptly ISM-1690Partially overlaps Timely Application of Non-Critical Vulnerability Patches ISM-1694Equivalent Timely Application of Non-Critical Security Patches ISM-1877Partially overlaps Timely Application of Critical Security Patches ISM-1902Partially overlaps Apply Non-Critical Patches to Non-Internet Systems Promptly
E8-PO-ML1.8 Replace unsupported operating systems	Patch operating systems	ISM-0298Partially overlaps Centralised System Patch and Update Management ISM-1407Partially overlaps Ensure Use of Current OS Versions ISM-1501Equivalent Replace Unsupported Operating Systems ISM-1643Depends on Maintain Detailed Software Version and Patch Records ISM-1753Partially overlaps Replace Unsupported Internet-Facing Devices ISM-1809Partially overlaps Compensating Controls for Unsupported Systems Pending Removal or Replacement ISM-1848Partially overlaps Replace Unsupported Software-Based Isolation Mechanisms Sharing Physical Resources ISM-1981Partially overlaps Replace Unsupportable Non-Internet Network Devices ISM-1982Partially overlaps Replace Unsupported Networked IT Equipment
E8-PO-ML3.1 Vulnerability scanner used fortnightly to identify missing driver patches	Patch operating systems	ISM-0298Supports Centralised System Patch and Update Management ISM-1143Partially meets Develop and Maintain Patch Management Procedures ISM-1163Partially meets Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1697Supports Apply Non-Critical Patches Within One Month ISM-1703Equivalent Regular Vulnerability Scanning for Missing Patches ISM-1808Depends on Vulnerability Scanning with Updated Tools
E8-PO-ML3.2 At least fortnightly use of a vulnerability scanner for firmware	Patch operating systems	ISM-0298Supports Centralised System Patch and Update Management ISM-1703Partially overlaps Regular Vulnerability Scanning for Missing Patches ISM-1752Partially overlaps Fortnightly Vulnerability Scanning for Non-Workstations ISM-1807Depends on Automated Asset Discovery for Vulnerability Scanning ISM-1808Depends on Vulnerability Scanning with Updated Tools ISM-1900Equivalent Fortnightly System Vulnerability Scanning ISM-1903Partially overlaps Rapid Application of Critical Firmware Patches ISM-1904Partially overlaps Apply Firmware Patches for Non-Critical Vulnerabilities
E8-PO-ML3.3 Apply critical patches to non-internet-facing OS within 48 hours	Patch operating systems	ISM-0298Depends on Centralised System Patch and Update Management ISM-1143Depends on Develop and Maintain Patch Management Procedures ISM-1606Partially overlaps Patch Isolation Mechanisms and Underlying Operating Systems Promptly ISM-1643Depends on Maintain Detailed Software Version and Patch Records ISM-1695Partially overlaps Timely Application of System Security Patches ISM-1696Equivalent Apply Critical Patches Within 48 Hours ISM-1702Depends on Regularly Scan for Missing Security Patches ISM-1876Partially overlaps Apply Critical Patches Within 48 Hours ISM-1877Partially overlaps Timely Application of Critical Security Patches ISM-1878Partially overlaps Apply Critical Patches Within 48 Hours ISM-1902Partially overlaps Apply Non-Critical Patches to Non-Internet Systems Promptly ISM-1921Depends on Assess System Compromise Risks Often ISM-1981Depends on Replace Unsupportable Non-Internet Network Devices
E8-PO-ML3.4 Non-critical OS patches applied within one month if no exploits exist	Patch operating systems	ISM-0298Supports Centralised System Patch and Update Management ISM-1143Depends on Develop and Maintain Patch Management Procedures ISM-1694Partially overlaps Timely Application of Non-Critical Security Patches ISM-1695Partially meets Timely Application of System Security Patches ISM-1696Partially overlaps Apply Critical Patches Within 48 Hours ISM-1697Partially overlaps Apply Non-Critical Patches Within One Month ISM-1702Depends on Regularly Scan for Missing Security Patches ISM-1751Partially overlaps Timely Application of Vendor Patches for Non-Critical OS Vulnerabilities ISM-1902Equivalent Apply Non-Critical Patches to Non-Internet Systems Promptly ISM-1904Partially overlaps Apply Firmware Patches for Non-Critical Vulnerabilities
E8-PO-ML3.5 Apply critical driver patches within 48 hours	Patch operating systems	ISM-0298Depends on Centralised System Patch and Update Management ISM-0300Partially overlaps Apply System Security Patches with Approval ISM-1143Depends on Develop and Maintain Patch Management Procedures ISM-1163Supports Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1697Partially overlaps Apply Non-Critical Patches Within One Month ISM-1754Partially meets Timely Resolution of Identified Software Vulnerabilities ISM-1879Equivalent Timely Patching of Critical Driver Vulnerabilities ISM-1921Supports Assess System Compromise Risks Often
E8-PO-ML3.6 Apply non-critical driver patches within one month	Patch operating systems	ISM-0298Depends on Centralised System Patch and Update Management ISM-1143Depends on Develop and Maintain Patch Management Procedures ISM-1697Equivalent Apply Non-Critical Patches Within One Month ISM-1904Partially overlaps Apply Firmware Patches for Non-Critical Vulnerabilities
E8-PO-ML3.7 Apply critical firmware patches within 48 hours	Patch operating systems	ISM-0298Depends on Centralised System Patch and Update Management ISM-1143Depends on Develop and Maintain Patch Management Procedures ISM-1697Partially overlaps Apply Non-Critical Patches Within One Month ISM-1754Partially overlaps Timely Resolution of Identified Software Vulnerabilities ISM-1876Partially overlaps Apply Critical Patches Within 48 Hours ISM-1903Equivalent Rapid Application of Critical Firmware Patches ISM-1904Partially overlaps Apply Firmware Patches for Non-Critical Vulnerabilities
E8-PO-ML3.8 Firmware vulnerabilities patched within one month if non-critical and no exploits	Patch operating systems	ISM-0298Supports Centralised System Patch and Update Management ISM-0300Partially overlaps Apply System Security Patches with Approval ISM-1143Partially meets Develop and Maintain Patch Management Procedures ISM-1163Supports Continuous Monitoring Plan to Find and Fix Vulnerabilities ISM-1697Partially overlaps Apply Non-Critical Patches Within One Month ISM-1900Depends on Fortnightly System Vulnerability Scanning ISM-1903Partially overlaps Rapid Application of Critical Firmware Patches ISM-1904Equivalent Apply Firmware Patches for Non-Critical Vulnerabilities
E8-PO-ML3.9 The latest or previous OS release is used	Patch operating systems	ISM-1407Equivalent Ensure Use of Current OS Versions ISM-1483Partially overlaps Use Latest Release of Internet-Facing Server Applications ISM-1501Partially overlaps Replace Unsupported Operating Systems ISM-1605Depends on Harden the Operating System Beneath Software Isolation Mechanisms ISM-1848Partially overlaps Replace Unsupported Software-Based Isolation Mechanisms Sharing Physical Resources
E8-RA-ML1.1 Validating privileged access requests upon initial request	Restrict admin privileges	ISM-0407Supports Maintaining a Secure Lifetime Access Record for Each Human User ISM-0432Depends on Document System Access Requirements in Security Plans ISM-0446Partially overlaps Restrict Privileged Access for Foreign Nationals ISM-1507Equivalent Ensure Requests for Privileged Access are Verified ISM-1508Partially overlaps Restricting Privileged Access to What Duties Require ISM-1647Partially overlaps Disable Privileged Access After 12 Months ISM-1883Partially overlaps Limit Authorised Privileged Account Online Service Access to Duties ISM-1927Partially overlaps Limit Identity Server Access to Privileged Users Requiring It ISM-1939Supports Minimise Members in Privileged Security Groups ISM-2136Partially overlaps Enforcing Risk-Based Access Decisions Informed by Contextual Signals ISM-2137Partially overlaps Block User OAuth Consent, Reserve It for Authorised Administrators
E8-RA-ML1.2 Dedicated privileged user accounts for privileged duties	Restrict admin privileges	ISM-0414Depends on Uniquely Identifying Every User Granted System Access ISM-0445Equivalent Dedicated Privileged Accounts Used Solely for Privileged Duties ISM-1175Supports Restrict Privileged Users from Internet Access ISM-1263Partially meets Enforce Unique Accounts for Server Administration ISM-1508Partially overlaps Restricting Privileged Access to What Duties Require ISM-1620Supports Ensure Privileged Accounts are Secured in AD ISM-1827Partially meets Use Dedicated Admin Accounts for Domain Controllers ISM-1927Depends on Limit Identity Server Access to Privileged Users Requiring It ISM-1949Broader than Use Dedicated Accounts for AD FS Administration ISM-1958Depends on Block DCSync-Permitted Accounts From Logging On To Unprivileged Environments ISM-2133Partially overlaps Assign Each AI Agent a Unique Identity Distinct from Personnel Accounts
E8-RA-ML1.3 Prevent privileged user accounts from accessing internet, email and web services	Restrict admin privileges	ISM-0445Depends on Dedicated Privileged Accounts Used Solely for Privileged Duties ISM-0874Partially overlaps Ensure Internet Access via Organisation's Gateway ISM-1175Equivalent Restrict Privileged Users from Internet Access ISM-1380Partially overlaps Privileged Users Work in Separate Privileged and Unprivileged Operating Environments ISM-1385Partially overlaps Segregation of Administrative Infrastructure from Networks ISM-1508Partially overlaps Restricting Privileged Access to What Duties Require ISM-1883Partially overlaps Limit Authorised Privileged Account Online Service Access to Duties
E8-RA-ML1.4 Limit privileged user accounts to essential online service access	Restrict admin privileges	ISM-0441Partially overlaps Restricting Temporary System Access to Data Required for Duties ISM-0445Supports Dedicated Privileged Accounts Used Solely for Privileged Duties ISM-1175Equivalent Restrict Privileged Users from Internet Access ISM-1507Depends on Ensure Requests for Privileged Access are Verified ISM-1508Partially meets Restricting Privileged Access to What Duties Require ISM-1833Partially meets Limit Privileges for User Accounts in Active Directory ISM-1852Partially overlaps Limit Unprivileged Access to What Duties Require ISM-1883Equivalent Limit Authorised Privileged Account Online Service Access to Duties ISM-1927Partially overlaps Limit Identity Server Access to Privileged Users Requiring It ISM-2068Partially overlaps Restrict Internet Access for Networked Devices ISM-2156Partially overlaps Restrict Agentic AI Applications to Minimum Tools, Functions and Permissions
E8-RA-ML1.5 Privileged users use separate privileged and unprivileged environments	Restrict admin privileges	ISM-0445Depends on Dedicated Privileged Accounts Used Solely for Privileged Duties ISM-1380Equivalent Privileged Users Work in Separate Privileged and Unprivileged Operating Environments ISM-1387Partially overlaps Use Jump Servers for Administrative Activities ISM-1635Partially meets System Owners Implement Security Controls for Each System and Environment ISM-1687Supports Prevent Virtualisation of Privileged Environments ISM-1688Supports Block Unprivileged Account Logons to Privileged Operating Environments ISM-1689Broader than Block Privileged Account Logons to Unprivileged Operating Environments ISM-1958Broader than Block DCSync-Permitted Accounts From Logging On To Unprivileged Environments
E8-RA-ML1.6 Unprivileged user accounts restricted from logging on to privileged environments	Restrict admin privileges	ISM-0445Depends on Dedicated Privileged Accounts Used Solely for Privileged Duties ISM-1380Partially overlaps Privileged Users Work in Separate Privileged and Unprivileged Operating Environments ISM-1688Equivalent Block Unprivileged Account Logons to Privileged Operating Environments ISM-1689Partially overlaps Block Privileged Account Logons to Unprivileged Operating Environments ISM-1927Partially overlaps Limit Identity Server Access to Privileged Users Requiring It ISM-1958Partially overlaps Block DCSync-Permitted Accounts From Logging On To Unprivileged Environments
E8-RA-ML1.7 Prevent privileged user accounts from logging on to unprivileged environments	Restrict admin privileges	ISM-0445Supports Dedicated Privileged Accounts Used Solely for Privileged Duties ISM-1380Supports Privileged Users Work in Separate Privileged and Unprivileged Operating Environments ISM-1508Partially overlaps Restricting Privileged Access to What Duties Require ISM-1688Partially overlaps Block Unprivileged Account Logons to Privileged Operating Environments ISM-1689Equivalent Block Privileged Account Logons to Unprivileged Operating Environments ISM-1827Partially overlaps Use Dedicated Admin Accounts for Domain Controllers ISM-1958Partially overlaps Block DCSync-Permitted Accounts From Logging On To Unprivileged Environments
E8-RA-ML2.1 Disable privileged access after 12 months without revalidation	Restrict admin privileges	ISM-1507Partially overlaps Ensure Requests for Privileged Access are Verified ISM-1508Depends on Restricting Privileged Access to What Duties Require ISM-1647Equivalent Disable Privileged Access After 12 Months ISM-1649Supports Implement Just-in-Time Administration for System Access ISM-1843Partially overlaps Annual Review of Unconstrained Delegation in AD Accounts ISM-1934Partially overlaps Six-Monthly Review and Removal of DCSync User Permissions
E8-RA-ML2.2 Privileged access is disabled after 45 days of inactivity	Restrict admin privileges	ISM-1647Partially overlaps Disable Privileged Access After 12 Months ISM-1648Equivalent Disabling Inactive Privileged Access to Systems
E8-RA-ML2.3 Privileged environments are not virtualised within unprivileged environments	Restrict admin privileges	ISM-1380Partially meets Privileged Users Work in Separate Privileged and Unprivileged Operating Environments ISM-1687Equivalent Prevent Virtualisation of Privileged Environments ISM-1689Supports Block Privileged Account Logons to Unprivileged Operating Environments
E8-RA-ML2.4 Conduct administrative activities through jump servers	Restrict admin privileges	ISM-0445Partially overlaps Dedicated Privileged Accounts Used Solely for Privileged Duties ISM-1380Depends on Privileged Users Work in Separate Privileged and Unprivileged Operating Environments ISM-1387Equivalent Use Jump Servers for Administrative Activities ISM-1750Supports Segregation of Administrative Infrastructure for Server Security ISM-1898Partially overlaps Use Secure Admin Workstations for Administration ISM-1899Depends on Restrict Unauthorised Network Connections
E8-RA-ML2.5 Long, unique, and managed credentials for admin accounts	Restrict admin privileges	ISM-1227Partially overlaps Randomly Generate User Account Credentials ISM-1590Partially overlaps Changing User Account Credentials After Compromise, Exposure or Shared Membership Change ISM-1612Partially overlaps Restricted Use of Break Glass Accounts for Emergencies ISM-1614Partially overlaps Manage Emergency Account Access Changes ISM-1615Depends on Testing Break Glass Accounts Post Credential Change ISM-1619Broader than Configure Service Accounts as Managed Service Accounts ISM-1685Equivalent Strengthening Passwords for Critical Accounts ISM-1795Partially overlaps Set 30-Character Minimum for Key Administrator Passwords ISM-1829Depends on Prevent Password Storage in Group Policy Preferences ISM-1842Partially overlaps Use Privileged Accounts for Domain Machine Addition ISM-1847Partially overlaps Double KRBTGT Password Reset After Compromise or Six Months ISM-1875Depends on Monthly System Scans to Detect Credentials Stored in the Clear ISM-1949Partially overlaps Use Dedicated Accounts for AD FS Administration ISM-1953Broader than Ensure Strong Management of Admin Account Credentials ISM-1954Equivalent Enforce Random Credentials for Administrator Accounts ISM-2081Depends on Enforce Use of All ASCII Characters in Passwords ISM-2142Partially overlaps Central Management of Application and Workload Credentials ISM-2144Partially overlaps Change Application Static Credentials Found Compromised or Exposed in Clear
E8-RA-ML2.6 Privileged access events are centrally logged.	Restrict admin privileges	ISM-0580Supports Develop, Implement and Maintain a Security Monitoring Policy ISM-0582Partially overlaps Central Logging of Windows Security Events ISM-0585Partially overlaps Capture Detailed Information in Event Logs ISM-1509Equivalent Log Privileged Access Events Centrally for Monitoring ISM-1537Partially overlaps Log Security-Relevant Database Events Centrally ISM-1607Partially overlaps Integrity Monitoring and Logging for Isolation Mechanism ISM-1613Broader than Central Logging of Break Glass Account Usage ISM-1650Partially meets Log Management of Privileged User Activities ISM-1830Partially meets Central Logging of Security Events for Microsoft AD Infrastructure Servers ISM-1895Partially overlaps Log Single-factor Authentication Events ISM-1976Partially overlaps Central Logging of Security Events on macOS ISM-1977Partially overlaps Central Logging of Linux System Events ISM-1983Partially overlaps Log Events Sent to Centralised Facility Quickly ISM-1989Partially overlaps Ensure Event Logs Meet Retention Requirements
E8-RA-ML2.7 Centrally log privileged user account and security group management events	Restrict admin privileges	ISM-0580Depends on Develop, Implement and Maintain a Security Monitoring Policy ISM-0585Partially overlaps Capture Detailed Information in Event Logs ISM-0988Depends on Ensure Accurate Time Source for Event Logs ISM-1405Depends on Implement a Centralised Event Logging Facility ISM-1509Partially meets Log Privileged Access Events Centrally for Monitoring ISM-1537Partially overlaps Log Security-Relevant Database Events Centrally ISM-1613Partially overlaps Central Logging of Break Glass Account Usage ISM-1650Equivalent Log Management of Privileged User Activities ISM-1976Partially overlaps Central Logging of Security Events on macOS ISM-1977Partially overlaps Central Logging of Linux System Events
E8-RA-ML2.8 Event logs are protected from unauthorised changes and losses	Restrict admin privileges	ISM-1624Broader than Protect PowerShell Script Block Logs ISM-1815Equivalent Protect Event Logs from Unauthorised Access ISM-1985Partially overlaps Protect Event Logs from Unauthorised Access
E8-RA-ML2.9 Event logs are analysed promptly for security events	Restrict admin privileges	ISM-0120Depends on Access to Tools for Detecting Security Events ISM-0580Supports Develop, Implement and Maintain a Security Monitoring Policy ISM-1228Partially meets Analyse Cyber Security Events Promptly ISM-1526Partially meets System Owners Continuously Monitor Security and Manage Threats, Risks and Controls ISM-1607Partially overlaps Integrity Monitoring and Logging for Isolation Mechanism ISM-1906Equivalent Timely Analysis of Internet-Facing Server Logs ISM-1907Partially overlaps Timely Analysis of Non-Internet-Server Logs ISM-1960Partially overlaps Timely Analysis of Event Logs for Cyber security ISM-1961Partially overlaps Timely Analysis of Network Device Event Logs ISM-1978Depends on Centralised Logging for Server Application Events ISM-1986Partially overlaps Timely Analysis of Critical Server Event Logs ISM-1987Partially overlaps Timely Analysis of Security Event Logs
E8-RA-ML2.10 Timely analysis of cyber security events to identify incidents	Restrict admin privileges	ISM-1228Equivalent Analyse Cyber Security Events Promptly ISM-1526Depends on System Owners Continuously Monitor Security and Manage Threats, Risks and Controls ISM-1906Partially overlaps Timely Analysis of Internet-Facing Server Logs ISM-1907Partially overlaps Timely Analysis of Non-Internet-Server Logs ISM-1960Depends on Timely Analysis of Event Logs for Cyber security ISM-1961Partially overlaps Timely Analysis of Network Device Event Logs ISM-1986Partially overlaps Timely Analysis of Critical Server Event Logs ISM-1987Depends on Timely Analysis of Security Event Logs ISM-2116Depends on Use Cyber Threat Intelligence for Event Detection
E8-RA-ML2.11 Report cyber incidents to the CISO promptly	Restrict admin privileges	ISM-0043Partially meets Cyber Security Incident Response Plan Requirements ISM-0123Equivalent Report Cyber Security Incidents Promptly ISM-0140Partially overlaps Prompt Reporting of Cyber Incidents to ASD ISM-0141Partially overlaps Report Cyber Incidents Promptly to Designated Contacts ISM-0142Broader than Report Cryptographic Equipment Compromises Promptly ISM-0576Partially meets Develop and Maintain Cyber Security Incident Plans ISM-0733Partially overlaps Ensure CISO Awareness of Cyber Incidents ISM-1088Partially overlaps Report Potential Compromises of Mobile Devices Overseas ISM-1478Depends on CISO Management of Cyber Security Compliance ISM-1618Supports CISO's Role in Cyber Security Incident Response ISM-1803Partially overlaps Document and Report Cyber Security Incidents
E8-RA-ML2.12 Report cyber security incidents to ASD promptly	Restrict admin privileges	ISM-0043Depends on Cyber Security Incident Response Plan Requirements ISM-0123Partially overlaps Report Cyber Security Incidents Promptly ISM-0140Equivalent Prompt Reporting of Cyber Incidents to ASD
E8-RA-ML2.13 Enact cyber incident response plan after an incident is identified	Restrict admin privileges	ISM-0043Depends on Cyber Security Incident Response Plan Requirements ISM-0123Partially overlaps Report Cyber Security Incidents Promptly ISM-0576Depends on Develop and Maintain Cyber Security Incident Plans ISM-1618Supports CISO's Role in Cyber Security Incident Response ISM-1731Broader than Plan and Coordinate Intrusion Remediation From Trusted Separate Systems ISM-1732Partially overlaps Coordinating and Sequencing Intrusion Remediation to Prevent Re-Compromise ISM-1819Equivalent Enact Cyber Security Incident Response Plans
E8-RA-ML3.1 Limit privileged access to what is necessary for duties	Restrict admin privileges	ISM-0133Partially overlaps Responding to Data Spills by Restricting Access ISM-0441Partially overlaps Restricting Temporary System Access to Data Required for Duties ISM-0446Partially overlaps Restrict Privileged Access for Foreign Nationals ISM-0611Broader than Restrict Privileges for Gateway Administrators ISM-1249Broader than Limit Server Application User Privileges ISM-1250Broader than Limit Server Application User Account Privileges ISM-1255Broader than Restrict Database Content Access by User Duties and Functions ISM-1263Supports Enforce Unique Accounts for Server Administration ISM-1268Partially overlaps Enforce Need-to-Know Access in Databases ISM-1507Partially overlaps Ensure Requests for Privileged Access are Verified ISM-1508Equivalent Restricting Privileged Access to What Duties Require ISM-1833Broader than Limit Privileges for User Accounts in Active Directory ISM-1843Broader than Annual Review of Unconstrained Delegation in AD Accounts ISM-1852Partially overlaps Limit Unprivileged Access to What Duties Require ISM-1883Broader than Limit Authorised Privileged Account Online Service Access to Duties ISM-1927Broader than Limit Identity Server Access to Privileged Users Requiring It ISM-1933Broader than Restrict DCSync Permissions on Service Accounts ISM-1934Broader than Six-Monthly Review and Removal of DCSync User Permissions ISM-1938Broader than Restrict Domain Computers Group in Active Directory ISM-1939Broader than Minimise Members in Privileged Security Groups ISM-1941Broader than Restrict Computer Accounts in Privileged Security Groups ISM-1958Partially overlaps Block DCSync-Permitted Accounts From Logging On To Unprivileged Environments ISM-2093Partially overlaps Role-Based Access Controls in AI Applications ISM-2128Broader than Limit Kernel-Mode Code Installation to Privileged Users Who Need It ISM-2138Depends on Six-Monthly Review of OAuth Application Consents and Granted Permissions
E8-RA-ML3.2 Use Secure Admin Workstations for Administrative Tasks	Restrict admin privileges	ISM-0843Depends on Ensure Workstation Security with Application Control ISM-1385Partially overlaps Segregation of Administrative Infrastructure from Networks ISM-1387Partially overlaps Use Jump Servers for Administrative Activities ISM-1406Depends on Use SOEs for Workstations and Servers ISM-1731Partially overlaps Plan and Coordinate Intrusion Remediation From Trusted Separate Systems ISM-1750Partially overlaps Segregation of Administrative Infrastructure for Server Security ISM-1898Equivalent Use Secure Admin Workstations for Administration
E8-RA-ML3.3 Just-in-time administration is used for administering systems and applications.	Restrict admin privileges	ISM-0445Partially overlaps Dedicated Privileged Accounts Used Solely for Privileged Duties ISM-1508Partially overlaps Restricting Privileged Access to What Duties Require ISM-1649Equivalent Implement Just-in-Time Administration for System Access ISM-1927Supports Limit Identity Server Access to Privileged Users Requiring It ISM-1939Supports Minimise Members in Privileged Security Groups
E8-RA-ML3.4 Memory integrity functionality is enabled	Restrict admin privileges	ISM-1409Partially meets Implement Restrictive OS Hardening Guidelines ISM-1492Partially meets Enable Exploit Protection in Operating Systems ISM-1745Partially overlaps Enable Security Features for System Protection ISM-1896Equivalent Enable Memory Integrity for Credential Protection
E8-RA-ML3.5 Local Security Authority protection functionality is enabled	Restrict admin privileges	ISM-1492Partially overlaps Enable Exploit Protection in Operating Systems ISM-1686Partially overlaps Enable Credential Guard for Credential Protection ISM-1858Partially meets Implement Strict IT Equipment Hardening Guidelines ISM-1861Equivalent Enable Local Security Authority Protection
E8-RA-ML3.6 Enable Credential Guard for secure credential storage	Restrict admin privileges	ISM-1402Partially overlaps Protecting Stored Credentials with Security Measures ISM-1492Partially overlaps Enable Exploit Protection in Operating Systems ISM-1686Equivalent Enable Credential Guard for Credential Protection ISM-1745Depends on Enable Security Features for System Protection ISM-1861Partially overlaps Enable Local Security Authority Protection ISM-1897Partially overlaps Enable Remote Credential Guard for Credential Protection
E8-RA-ML3.7 Enable Remote Credential Guard functionality	Restrict admin privileges	ISM-1686Partially overlaps Enable Credential Guard for Credential Protection ISM-1897Equivalent Enable Remote Credential Guard for Credential Protection
E8-RA-ML3.8 Timely analysis of event logs from non-internet-facing servers	Restrict admin privileges	ISM-0120Depends on Access to Tools for Detecting Security Events ISM-1906Partially overlaps Timely Analysis of Internet-Facing Server Logs ISM-1907Equivalent Timely Analysis of Non-Internet-Server Logs ISM-1961Partially overlaps Timely Analysis of Network Device Event Logs ISM-1979Depends on Central Logging for Security Events on Servers ISM-1986Partially overlaps Timely Analysis of Critical Server Event Logs ISM-1987Partially meets Timely Analysis of Security Event Logs ISM-2116Partially meets Use Cyber Threat Intelligence for Event Detection
E8-RA-ML3.9 Timely analysis of workstation event logs for security events	Restrict admin privileges	ISM-0109Equivalent Timely Analysis of Workstation Event Logs ISM-1228Broader than Analyse Cyber Security Events Promptly ISM-1907Partially overlaps Timely Analysis of Non-Internet-Server Logs ISM-1960Partially overlaps Timely Analysis of Event Logs for Cyber security ISM-1961Partially overlaps Timely Analysis of Network Device Event Logs ISM-1986Partially overlaps Timely Analysis of Critical Server Event Logs ISM-1987Partially meets Timely Analysis of Security Event Logs ISM-2051Depends on Ensure Event Logs for Cyber security Event Detection
E8-RB-ML1.1 Backups aligned with business continuity needs	Regular backups	ISM-0734Depends on CISO Role in Disaster Recovery Planning ISM-1511Equivalent Conduct and Maintain Regular Data Backups ISM-1515Supports Test Backup Restoration During Disaster Recovery ISM-1547Partially overlaps Develop and Maintain Data Backup Procedures ISM-1548Supports Develop and Maintain Data Restoration Processes ISM-1555Partially meets Prepare Mobile Devices Before Overseas Travel ISM-1811Broader than Secure and Resilient Data Backup Retention
E8-RB-ML1.2 Ensure backups are synchronised for restoration to a common point in time	Regular backups	ISM-1511Partially meets Conduct and Maintain Regular Data Backups ISM-1515Supports Test Backup Restoration During Disaster Recovery ISM-1547Partially overlaps Develop and Maintain Data Backup Procedures ISM-1548Partially overlaps Develop and Maintain Data Restoration Processes ISM-1555Partially meets Prepare Mobile Devices Before Overseas Travel ISM-1810Equivalent Ensuring Data Backup Synchronisation ISM-1811Partially overlaps Secure and Resilient Data Backup Retention
E8-RB-ML1.3 Backups retained securely and resiliently	Regular backups	ISM-1511Partially overlaps Conduct and Maintain Regular Data Backups ISM-1515Supports Test Backup Restoration During Disaster Recovery ISM-1547Partially overlaps Develop and Maintain Data Backup Procedures ISM-1548Supports Develop and Maintain Data Restoration Processes ISM-1810Partially overlaps Ensuring Data Backup Synchronisation ISM-1811Equivalent Secure and Resilient Data Backup Retention ISM-1928Partially overlaps Encrypt and Restrict Access to Microsoft AD and Entra Connect Server Backups ISM-2151Broader than Technically Enforced Immutability Protecting Backups Through Their Retention Period
E8-RB-ML1.4 Test backup restoration to a common point during disaster recovery	Regular backups	ISM-0917Supports Procedures for Handling Malicious Code Infections ISM-1511Depends on Conduct and Maintain Regular Data Backups ISM-1515Equivalent Test Backup Restoration During Disaster Recovery ISM-1547Depends on Develop and Maintain Data Backup Procedures ISM-1548Depends on Develop and Maintain Data Restoration Processes ISM-1555Partially meets Prepare Mobile Devices Before Overseas Travel ISM-1810Depends on Ensuring Data Backup Synchronisation ISM-1811Depends on Secure and Resilient Data Backup Retention
E8-RB-ML1.5 Unprivileged user accounts cannot access others' backups	Regular backups	ISM-1812Equivalent Restrict Backup Access to Unprivileged Users ISM-1813Partially overlaps Prevent Unauthorised User Access to Backup Data ISM-1852Partially meets Limit Unprivileged Access to What Duties Require
E8-RB-ML1.6 Prevent unprivileged user accounts from modifying and deleting backups	Regular backups	ISM-1707Partially overlaps Restrict Backup Modifications by Privileged Users ISM-1708Partially overlaps Prevent Backup Modifications During Retention ISM-1811Partially meets Secure and Resilient Data Backup Retention ISM-1814Equivalent Prevent Backup Modifications by Unprivileged Users ISM-1928Partially overlaps Encrypt and Restrict Access to Microsoft AD and Entra Connect Server Backups ISM-2151Partially overlaps Technically Enforced Immutability Protecting Backups Through Their Retention Period ISM-2152Depends on Segregate Backup Infrastructure With Separate Administrative Authentication
E8-RB-ML2.1 Prevent privileged user accounts from accessing others' backups	Regular backups	ISM-1705Equivalent Restrict Access to User Account Backups ISM-1706Partially overlaps Prevent Backup Access by Privileged Users ISM-1812Partially overlaps Restrict Backup Access to Unprivileged Users ISM-1928Partially overlaps Encrypt and Restrict Access to Microsoft AD and Entra Connect Server Backups ISM-2152Depends on Segregate Backup Infrastructure With Separate Administrative Authentication
E8-RB-ML2.2 Privileged user accounts cannot modify or delete backups	Regular backups	ISM-1705Partially overlaps Restrict Access to User Account Backups ISM-1706Partially overlaps Prevent Backup Access by Privileged Users ISM-1707Equivalent Restrict Backup Modifications by Privileged Users ISM-1708Partially overlaps Prevent Backup Modifications During Retention ISM-1811Partially meets Secure and Resilient Data Backup Retention ISM-1814Partially overlaps Prevent Backup Modifications by Unprivileged Users ISM-1928Partially overlaps Encrypt and Restrict Access to Microsoft AD and Entra Connect Server Backups ISM-2151Partially overlaps Technically Enforced Immutability Protecting Backups Through Their Retention Period ISM-2152Depends on Segregate Backup Infrastructure With Separate Administrative Authentication
E8-RB-ML3.1 Unprivileged user accounts cannot access their own backups	Regular backups	ISM-1811Partially meets Secure and Resilient Data Backup Retention ISM-1813Equivalent Prevent Unauthorised User Access to Backup Data ISM-1928Partially overlaps Encrypt and Restrict Access to Microsoft AD and Entra Connect Server Backups
E8-RB-ML3.2 Privileged user accounts cannot access their own backups	Regular backups	ISM-1508Partially overlaps Restricting Privileged Access to What Duties Require ISM-1706Equivalent Prevent Backup Access by Privileged Users ISM-1708Partially overlaps Prevent Backup Modifications During Retention ISM-1811Partially meets Secure and Resilient Data Backup Retention ISM-1813Partially overlaps Prevent Unauthorised User Access to Backup Data ISM-1928Partially meets Encrypt and Restrict Access to Microsoft AD and Entra Connect Server Backups ISM-2152Depends on Segregate Backup Infrastructure With Separate Administrative Authentication
E8-RB-ML3.3 Backup administrators cannot modify or delete backups during retention	Regular backups	ISM-1707Partially overlaps Restrict Backup Modifications by Privileged Users ISM-1708Equivalent Prevent Backup Modifications During Retention ISM-1811Partially meets Secure and Resilient Data Backup Retention ISM-1814Partially overlaps Prevent Backup Modifications by Unprivileged Users ISM-1928Partially overlaps Encrypt and Restrict Access to Microsoft AD and Entra Connect Server Backups ISM-2151Partially overlaps Technically Enforced Immutability Protecting Backups Through Their Retention Period
E8-RM-ML1.1 Disable Microsoft Office macros for users without a business need	Configure macro settings	ISM-1489Depends on Lock Microsoft Office Macro Security Settings Against User Changes ISM-1671Equivalent Disable Office Macros for Users Lacking a Demonstrated Business Requirement ISM-1674Partially overlaps Ensuring Secure Execution of Microsoft Office Macros ISM-1675Partially overlaps Prevent Enabling Untrusted Microsoft Office Macros
E8-RM-ML1.2 Block Microsoft Office macros from the internet	Configure macro settings	ISM-1488Equivalent Blocking Internet-Originating Macros in Office Files ISM-1489Depends on Lock Microsoft Office Macro Security Settings Against User Changes ISM-1671Partially overlaps Disable Office Macros for Users Lacking a Demonstrated Business Requirement ISM-1672Partially overlaps Enable Antivirus Scanning for Office Macros ISM-1673Partially overlaps Prevent Win32 API Calls by Office Macros ISM-1674Partially overlaps Ensuring Secure Execution of Microsoft Office Macros ISM-1675Partially overlaps Prevent Enabling Untrusted Microsoft Office Macros ISM-1891Depends on Restrict Non-V3 Signed Macros in Microsoft Office
E8-RM-ML1.3 Enable antivirus scanning for Microsoft Office macros	Configure macro settings	ISM-1417Depends on Ensure Antivirus Protection on Workstations and Servers ISM-1672Equivalent Enable Antivirus Scanning for Office Macros
E8-RM-ML1.4 Prevent users from changing Microsoft Office macro security settings	Configure macro settings	ISM-1488Supports Blocking Internet-Originating Macros in Office Files ISM-1489Equivalent Lock Microsoft Office Macro Security Settings Against User Changes ISM-1584Depends on Prevent Unauthorised Changes to Security Settings ISM-1601Partially overlaps Implement Microsoft Attack Surface Reduction Rules ISM-1671Supports Disable Office Macros for Users Lacking a Demonstrated Business Requirement ISM-1672Supports Enable Antivirus Scanning for Office Macros ISM-1673Depends on Prevent Win32 API Calls by Office Macros ISM-1674Supports Ensuring Secure Execution of Microsoft Office Macros ISM-1675Depends on Prevent Enabling Untrusted Microsoft Office Macros ISM-1748Partially overlaps Lock Email Client Security Settings Against User Changes ISM-1823Partially meets Lock Office Productivity Suite Security Settings Against User Changes ISM-1825Partially overlaps Lock Security Product Settings Against Changes by Human Users ISM-1915Partially meets Ensure User Application Configurations are Approved
E8-RM-ML2.1 Microsoft Office macros are blocked from making Win32 API calls	Configure macro settings	ISM-1601Partially overlaps Implement Microsoft Attack Surface Reduction Rules ISM-1667Partially overlaps Prevent Child Processes in Microsoft Office ISM-1669Partially overlaps Prevent Microsoft Office from Injecting Code ISM-1673Equivalent Prevent Win32 API Calls by Office Macros ISM-1915Partially meets Ensure User Application Configurations are Approved
E8-RM-ML3.1 Restrict Microsoft Office macros to only trusted or sandboxed environments	Configure macro settings	ISM-1487Depends on Restrict Write Access to Trusted Locations to Macro Vetting Users ISM-1488Partially meets Blocking Internet-Originating Macros in Office Files ISM-1671Partially overlaps Disable Office Macros for Users Lacking a Demonstrated Business Requirement ISM-1672Partially overlaps Enable Antivirus Scanning for Office Macros ISM-1673Partially overlaps Prevent Win32 API Calls by Office Macros ISM-1674Equivalent Ensuring Secure Execution of Microsoft Office Macros ISM-1675Supports Prevent Enabling Untrusted Microsoft Office Macros ISM-1676Depends on Validate Microsoft Office Trusted Publishers List At Least Annually ISM-1890Depends on Ensure Macros Are Free of Malicious Code ISM-1891Supports Restrict Non-V3 Signed Macros in Microsoft Office ISM-2050Depends on Validate Digital Signature Certificates Securely
E8-RM-ML3.2 Check Microsoft Office macros for malicious code before signing or trusting	Configure macro settings	ISM-1487Supports Restrict Write Access to Trusted Locations to Macro Vetting Users ISM-1672Supports Enable Antivirus Scanning for Office Macros ISM-1674Supports Ensuring Secure Execution of Microsoft Office Macros ISM-1796Partially overlaps Digitally Sign Executable Software for Security ISM-1890Equivalent Ensure Macros Are Free of Malicious Code
E8-RM-ML3.3 Only privileged users can modify content in Trusted Locations	Configure macro settings	ISM-1392Partially overlaps Restrict File Modifications via Path Rules ISM-1487Equivalent Restrict Write Access to Trusted Locations to Macro Vetting Users ISM-1508Partially overlaps Restricting Privileged Access to What Duties Require ISM-1671Partially overlaps Disable Office Macros for Users Lacking a Demonstrated Business Requirement ISM-1674Supports Ensuring Secure Execution of Microsoft Office Macros ISM-1890Partially overlaps Ensure Macros Are Free of Malicious Code
E8-RM-ML3.4 Untrusted Publisher Macros Cannot Be Enabled via Message Bar or Backstage View	Configure macro settings	ISM-1489Depends on Lock Microsoft Office Macro Security Settings Against User Changes ISM-1674Partially meets Ensuring Secure Execution of Microsoft Office Macros ISM-1675Equivalent Prevent Enabling Untrusted Microsoft Office Macros ISM-1676Depends on Validate Microsoft Office Trusted Publishers List At Least Annually ISM-1891Partially overlaps Restrict Non-V3 Signed Macros in Microsoft Office
E8-RM-ML3.5 Block enabling of non-V3 signed Microsoft Office macros via Message Bar	Configure macro settings	ISM-1489Depends on Lock Microsoft Office Macro Security Settings Against User Changes ISM-1674Depends on Ensuring Secure Execution of Microsoft Office Macros ISM-1675Partially overlaps Prevent Enabling Untrusted Microsoft Office Macros ISM-1823Depends on Lock Office Productivity Suite Security Settings Against User Changes ISM-1891Equivalent Restrict Non-V3 Signed Macros in Microsoft Office
E8-RM-ML3.6 Validate list of trusted publishers in Microsoft Office annually	Configure macro settings	ISM-1582Partially meets Annual Validation of Application Control Rulesets ISM-1674Supports Ensuring Secure Execution of Microsoft Office Macros ISM-1675Supports Prevent Enabling Untrusted Microsoft Office Macros ISM-1676Equivalent Validate Microsoft Office Trusted Publishers List At Least Annually

How to use this mapping

Read it in whichever direction you are being assessed. If Essential Eight is your primary framework, use the table to find the ASD ISM controls that cover the same ground, so evidence you already hold can be reused instead of rebuilt. If ASD ISM is what you are being held to, work back from the counterpart column to see which Essential Eight controls contribute. A mapping means the two controls address related risk, not that satisfying one satisfies the other, so always read the relationship label before relying on it.

Essential Eight ASD ISM All mappings

Frequently asked questions

How do the Essential Eight and the ASD ISM relate?

Both are published by the Australian Signals Directorate. The Essential Eight is a prioritised set of eight mitigation strategies drawn from ASD’s Strategies to Mitigate Cyber Security Incidents, and the ISM carries controls that implement those strategies in detail. This mapping shows which ISM controls sit behind each Essential Eight requirement.

If I reach Maturity Level Two, how much of the ISM have I covered?

A small share. The Essential Eight concentrates on eight technical areas, mostly patching, application control, macros, hardening, administrative privileges, multi-factor authentication and backups. The ISM spans governance, personnel security, physical security, cryptography, gateways, software development and data transfers as well, so most ISM controls have no Essential Eight counterpart at all.

Why are Essential Eight controls numbered by maturity level?

Control Stack renders the Essential Eight Maturity Model as separate, testable controls, one per requirement per level, using keys such as E8-AC-ML2.3. That makes each requirement individually trackable and lets a mapping point at the exact maturity level a given ISM control supports, rather than at a whole strategy.

Is this mapping official?

No. ASD does not publish a control-level crosswalk between the Essential Eight Maturity Model and the ISM. This mapping is produced by Control Stack from the control text of both and reviewed for topic fidelity. Use it for planning and evidence reuse rather than as an authoritative statement from ASD.

Essential Eight to ASD ISM

Essential Eight to ASD ISM

How to use this mapping

Frequently asked questions

Control status

New task