ISO 27001Essential Eight

ISO 27001 Annex A to Essential Eight Control Mapping

The Essential Eight is Australia's baseline set of eight mitigation strategies; ISO/IEC 27001 Annex A is the global 93-control catalogue. This tool maps each ISO 27001 Annex A control to the Essential Eight strategy it supports, so an organisation certified to one can see its coverage of the other.

ISO 27001 controls Essential Eight guide

Annex A controls with a direct Essential Eight equivalent: 8 of 93
Essential Eight strategies with an Annex A match: 8 of 8
ISO 27001 themes with a direct match: 1 of 4

8 of the 93 ISO 27001:2022 Annex A controls have a direct Essential Eight equivalent, and all of them sit in the Technological theme. That is expected: the Essential Eight is a technical mitigation baseline, so it does not map to the organisational, people or physical controls that make up most of ISO 27001. Where a mapping exists, it is shown below; where none exists, that is stated plainly.

Every mapping is verified against the official ISO control text and the ACSC Essential Eight strategy definitions, then corroborated by an independent review of the underlying control-to-control relationships. Loose or indirect overlaps are deliberately excluded.

Control Stack is a free Australian reference covering 1,484 cyber security controls: all 1,143 ASD ISM controls, 152 Essential Eight controls across three maturity levels, all 93 ISO/IEC 27001:2022 Annex A controls, 58 ASD Essentials for enterprise IT actions and all 38 ISO/IEC 42001:2023 Annex A controls. Every one of them is cross-mapped between the five frameworks and readable in full without an account.

Reviewed 16 September 2026 · Maps all 93 ISO/IEC 27001:2022 Annex A controls to the ASD Essential Eight

ISO 27001 to Essential Eight

Filter by Essential Eight strategy or by ISO 27001 control theme. Each ISO control links to its full control page.

StrategyTheme

Showing all 93 ISO 27001 Annex A controls

Organisational controls

37 controls, 0 with a direct match

A.5.1Policies for information security
No direct Essential Eight equivalent
40 ISM controls
A.5.2Defining information security roles and responsibilities
No direct Essential Eight equivalent
27 ISM controls
A.5.3Segregation of duties
No direct Essential Eight equivalent
10 ISM controls
A.5.4Management responsibilities for information security
No direct Essential Eight equivalent
35 ISM controls
A.5.5Establish and maintain contact with authorities
No direct Essential Eight equivalent
9 ISM controls
A.5.6Contact with special interest groups
No direct Essential Eight equivalent
4 ISM controls
A.5.7Threat intelligence collection and analysis
No direct Essential Eight equivalent
10 ISM controls
A.5.8Information security in project management
No direct Essential Eight equivalent
13 ISM controls
A.5.9Inventory management of information and associated assets
No direct Essential Eight equivalent
15 ISM controls
A.5.10Acceptable use policies for information and assets
No direct Essential Eight equivalent
38 ISM controls
A.5.11Return of organisation's assets upon departure
No direct Essential Eight equivalent
2 ISM controls
A.5.12Information classification policy and practices
No direct Essential Eight equivalent
35 ISM controls
A.5.13Labelling of information
No direct Essential Eight equivalent
24 ISM controls
A.5.14Information transfer policies and procedures
No direct Essential Eight equivalent
33 ISM controls
A.5.15Access control policies and procedures
No direct Essential Eight equivalent
83 ISM controls
A.5.16Identity life cycle management
No direct Essential Eight equivalent
21 ISM controls
A.5.17Management of authentication information
No direct Essential Eight equivalent
50 ISM controls
A.5.18Managing access rights to information assets
No direct Essential Eight equivalent
51 ISM controls
A.5.19Managing information security in supplier relationships
No direct Essential Eight equivalent
55 ISM controls
A.5.20Integrating security clauses in supplier agreements
No direct Essential Eight equivalent
23 ISM controls
A.5.21Managing information security in the ICT supply chain
No direct Essential Eight equivalent
48 ISM controls
A.5.22Monitoring and managing supplier services
No direct Essential Eight equivalent
27 ISM controls
A.5.23Cloud service security management
No direct Essential Eight equivalent
5 ISM controls
A.5.24Information security incident management planning and preparation
No direct Essential Eight equivalent
24 ISM controls
A.5.25Assessment and decision on information security events
No direct Essential Eight equivalent
4 ISM controls
A.5.26Response to information security incidents
No direct Essential Eight equivalent
19 ISM controls
A.5.27Learning from information security incidents
No direct Essential Eight equivalent
3 ISM controls
A.5.28Procedures for collecting and preserving evidence
No direct Essential Eight equivalent
28 ISM controls
A.5.29Maintain information security during disruptions
No direct Essential Eight equivalent
6 ISM controls
A.5.30ICT readiness for business continuity
No direct Essential Eight equivalent
16 ISM controls
A.5.31Compliance with information security legal requirements
No direct Essential Eight equivalent
13 ISM controls
A.5.32Intellectual property rights protection
No direct Essential Eight equivalent
3 ISM controls
A.5.33Protection of records
No direct Essential Eight equivalent
12 ISM controls
A.5.34Privacy and protection of personally identifiable information
No direct Essential Eight equivalent
11 ISM controls
A.5.35Independent review of information security
No direct Essential Eight equivalent
22 ISM controls
A.5.36Review compliance with information security policies
No direct Essential Eight equivalent
28 ISM controls
A.5.37Documented operating procedures for information processing
No direct Essential Eight equivalent
16 ISM controls

People controls

8 controls, 0 with a direct match

A.6.1Personnel background verification
No direct Essential Eight equivalent
5 ISM controls
A.6.2Terms and conditions of employment for security
No direct Essential Eight equivalent
5 ISM controls
A.6.3Information security awareness, education and training program
No direct Essential Eight equivalent
34 ISM controls
A.6.4Disciplinary process for information security violations
No direct Essential Eight equivalent
3 ISM controls
A.6.5Responsibilities after employment termination or role change
No direct Essential Eight equivalent
4 ISM controls
A.6.6Confidentiality and non-disclosure agreements
No direct Essential Eight equivalent
2 ISM controls
A.6.7Remote working security measures
No direct Essential Eight equivalent
20 ISM controls
A.6.8Mechanisms for reporting security events
No direct Essential Eight equivalent
16 ISM controls

Physical controls

14 controls, 0 with a direct match

A.7.1Physical security perimeters
No direct Essential Eight equivalent
20 ISM controls
A.7.2Physical access controls for secure areas
No direct Essential Eight equivalent
19 ISM controls
A.7.3Physical security for offices and facilities
No direct Essential Eight equivalent
22 ISM controls
A.7.4Continuous monitoring of physical access to premises
No direct Essential Eight equivalent
4 ISM controls
A.7.5Protecting against physical and environmental threats
No direct Essential Eight equivalent
18 ISM controls
A.7.6Security measures for working in secure areas
No direct Essential Eight equivalent
24 ISM controls
A.7.7Clear desk and clear screen policies
No direct Essential Eight equivalent
12 ISM controls
A.7.8Equipment siting and protection
No direct Essential Eight equivalent
22 ISM controls
A.7.9Security of off-site assets
No direct Essential Eight equivalent
6 ISM controls
A.7.10Secure management of storage media
No direct Essential Eight equivalent
66 ISM controls
A.7.11Protection from utility failures
No direct Essential Eight equivalent
3 ISM controls
A.7.12Secure cabling for power and data
No direct Essential Eight equivalent
28 ISM controls
A.7.13Proper maintenance of equipment
No direct Essential Eight equivalent
13 ISM controls
A.7.14Secure disposal or re-use of equipment
No direct Essential Eight equivalent
57 ISM controls

Technological controls

34 controls, 8 with a direct match

A.8.1Protection of user endpoint devices
No direct Essential Eight equivalent
36 ISM controls
A.8.2Management of privileged access rights
Restrict Administrative Privileges
59 ISM controls
A.8.3Restrict access to information and assets
No direct Essential Eight equivalent
67 ISM controls
A.8.4Access management for source code and tools
No direct Essential Eight equivalent
12 ISM controls
A.8.5Secure authentication technologies and procedures
Multi-Factor Authentication
62 ISM controls
A.8.6Capacity management for resource use
No direct Essential Eight equivalent
8 ISM controls
A.8.7Protection against malware
Application Control User Application Hardening
23 ISM controls
A.8.8Management of technical vulnerabilities
Patch Applications Patch Operating Systems
63 ISM controls
A.8.9Configuration management for secure IT systems
Configure Microsoft Office Macro Settings User Application Hardening
94 ISM controls
A.8.10Secure deletion of information when no longer needed
No direct Essential Eight equivalent
27 ISM controls
A.8.11Data masking for sensitive information
No direct Essential Eight equivalent
1 ISM control
A.8.12Data leakage prevention measures
No direct Essential Eight equivalent
34 ISM controls
A.8.13Backup and recovery procedures for data
Regular Backups
11 ISM controls
A.8.14Redundancy of information processing facilities
No direct Essential Eight equivalent
1 ISM control
A.8.15Logging of activities and events
No direct Essential Eight equivalent
54 ISM controls
A.8.16Monitoring networks and systems for anomalous behaviour
No direct Essential Eight equivalent
35 ISM controls
A.8.17Clock synchronisation for information systems
No direct Essential Eight equivalent
2 ISM controls
A.8.18Use of privileged utility programs
Application Control
10 ISM controls
A.8.19Secure software installation procedures
Application Control
29 ISM controls
A.8.20Network and network devices security
No direct Essential Eight equivalent
100 ISM controls
A.8.21Security of network services
No direct Essential Eight equivalent
24 ISM controls
A.8.22Network segregation for security
No direct Essential Eight equivalent
51 ISM controls
A.8.23Web filtering to reduce malicious website exposure
No direct Essential Eight equivalent
15 ISM controls
A.8.24Effective use of cryptography and key management
No direct Essential Eight equivalent
91 ISM controls
A.8.25Secure development lifecycle
No direct Essential Eight equivalent
48 ISM controls
A.8.26Defining security requirements for applications
No direct Essential Eight equivalent
33 ISM controls
A.8.27Secure system architecture and engineering principles
No direct Essential Eight equivalent
31 ISM controls
A.8.28Secure coding practices in software development
No direct Essential Eight equivalent
38 ISM controls
A.8.29Security testing in development and acceptance
No direct Essential Eight equivalent
34 ISM controls
A.8.30Management of outsourced system development
No direct Essential Eight equivalent
20 ISM controls
A.8.31Separation of development, test, and production environments
No direct Essential Eight equivalent
9 ISM controls
A.8.32Change management procedures for information systems
No direct Essential Eight equivalent
26 ISM controls
A.8.33Test information selection and protection
No direct Essential Eight equivalent
7 ISM controls
A.8.34Protection of information systems during audits
No direct Essential Eight equivalent
5 ISM controls

Essential Eight to ISO 27001

Each Essential Eight strategy and the primary ISO 27001 Annex A control(s) it satisfies.

Application Control

Prevent execution of unapproved or malicious software; allow only approved applications to run.

A.8.19: Secure software installation procedures
A.8.19 requires securely managing software installation on operational systems, the core of controlling which applications may run.
A.8.7: Protection against malware
A.8.7 (protection against malware) is served by application control preventing unapproved or malicious executables from running.
A.8.18: Use of privileged utility programs
A.8.18 restricts use of privileged utility programs that can override system controls, which application control enforces.

Patch Applications

Apply security patches to applications (browsers, office suites, email, PDF software) within defined timeframes.

A.8.8: Management of technical vulnerabilities
A.8.8 (management of technical vulnerabilities) requires obtaining vulnerability information and applying appropriate measures. Patching applications is a core such measure.

Configure Microsoft Office Macro Settings

Block or restrict Microsoft Office macros, especially those originating from the internet.

A.8.9: Configuration management for secure IT systems
A.8.9 (configuration management) requires secure, documented configurations. Macro settings are a security configuration it governs.

User Application Hardening

Harden browsers and applications by disabling risky features such as Flash, Java, ads and unneeded functionality.

A.8.9: Configuration management for secure IT systems
A.8.9 (configuration management) covers hardening application and browser configurations to a secure baseline.
A.8.7: Protection against malware
A.8.7 (protection against malware) is supported by hardening applications to remove features attackers exploit.

Restrict Administrative Privileges

Limit, validate and manage privileged and administrative access.

A.8.2: Management of privileged access rights
A.8.2 requires that allocation and use of privileged access rights be restricted and managed: identical intent to the strategy.

Patch Operating Systems

Apply operating system and firmware patches within defined timeframes; replace unsupported systems.

A.8.8: Management of technical vulnerabilities
A.8.8 (management of technical vulnerabilities) covers evaluating exposure and applying operating-system patches as appropriate measures.

Multi-Factor Authentication

Require multi-factor authentication for remote access, privileged actions and internet-facing services.

A.8.5: Secure authentication technologies and procedures
A.8.5 requires secure authentication technologies and procedures. Multi-factor authentication is the primary such technology.

Regular Backups

Perform and test backups of important data; retain and protect them so they cannot be altered or deleted by an intruder.

A.8.13: Backup and recovery procedures for data
A.8.13 requires backup copies of information, software and systems to be maintained and regularly tested.

How to use this mapping

If you are certified to ISO/IEC 27001 and need to demonstrate Essential Eight coverage, start from a technological ISO control above and follow it to the Essential Eight strategy it supports, then open that strategy for its maturity-level requirements. If you already run the Essential Eight and want ISO 27001 alignment, use the reverse section to find the Annex A control each strategy satisfies. Every ISO control also links through to its full ASD ISM mappings.

ISO 27001 controls Essential Eight guide ASD ISM controls All mappings

Frequently asked questions

Does ISO 27001 cover the Essential Eight?

Largely, yes. Most Essential Eight strategies map to one or more ISO 27001 Annex A controls (for example, patch management maps to Annex A 8.8, and application control maps to Annex A 8.19). ISO 27001 is broader and risk-based, while the Essential Eight is a prescriptive Australian baseline; this crosswalk shows control by control where they overlap.

Which ISO 27001 Annex A controls map to the Essential Eight?

Eight ISO/IEC 27001:2022 Annex A controls have a direct Essential Eight equivalent, all in the Technological theme: A.8.2, A.8.5, A.8.7, A.8.8, A.8.9, A.8.13, A.8.18 and A.8.19. The organisational, people and physical controls have no direct Essential Eight equivalent, because the Essential Eight is a technical mitigation baseline rather than a full management system.

Is the Essential Eight mandatory in Australia?

The Essential Eight is mandated for Australian non-corporate Commonwealth entities and is widely adopted as a baseline by other organisations. It is published by the Australian Cyber Security Centre (ACSC).