ISO 27001 Annex A to Essential Eight Control Mapping
The Essential Eight is Australia's baseline set of eight mitigation strategies; ISO/IEC 27001 Annex A is the global 93-control catalogue. This tool maps each ISO 27001 Annex A control to the Essential Eight strategy it supports, so an organisation certified to one can see its coverage of the other.
8 of the 93 ISO 27001:2022 Annex A controls have a direct Essential Eight equivalent, and all of them sit in the Technological theme. That is expected: the Essential Eight is a technical mitigation baseline, so it does not map to the organisational, people or physical controls that make up most of ISO 27001. Where a mapping exists, it is shown below; where none exists, that is stated plainly.
Every mapping is verified against the official ISO control text and the ACSC Essential Eight strategy definitions, then corroborated by an independent review of the underlying control-to-control relationships. Loose or indirect overlaps are deliberately excluded.
ISO 27001 to Essential Eight
Filter by Essential Eight strategy or by ISO 27001 control theme. Each ISO control links to its full control page.
| ISO 27001 Annex A control | Theme | Essential Eight strategy | ASD ISM |
|---|---|---|---|
| Annex A 5.1 Policies for information security | Organisational | No direct Essential Eight equivalent | 40 ISM controls |
| Annex A 5.2 Defining Information Security Roles and Responsibilities | Organisational | No direct Essential Eight equivalent | 27 ISM controls |
| Annex A 5.3 Segregation of Duties | Organisational | No direct Essential Eight equivalent | 10 ISM controls |
| Annex A 5.4 Management responsibilities for information security | Organisational | No direct Essential Eight equivalent | 35 ISM controls |
| Annex A 5.5 Establish and Maintain Contact with Authorities | Organisational | No direct Essential Eight equivalent | 9 ISM controls |
| Annex A 5.6 Contact with special interest groups | Organisational | No direct Essential Eight equivalent | 4 ISM controls |
| Annex A 5.7 Threat Intelligence Collection and Analysis | Organisational | No direct Essential Eight equivalent | 10 ISM controls |
| Annex A 5.8 Information security in project management | Organisational | No direct Essential Eight equivalent | 13 ISM controls |
| Annex A 5.9 Inventory management of information and associated assets | Organisational | No direct Essential Eight equivalent | 15 ISM controls |
| Annex A 5.10 Acceptable Use Policies for Information and Assets | Organisational | No direct Essential Eight equivalent | 38 ISM controls |
| Annex A 5.11 Return of Organisation's Assets upon Departure | Organisational | No direct Essential Eight equivalent | 2 ISM controls |
| Annex A 5.12 Information Classification Policy and Practices | Organisational | No direct Essential Eight equivalent | 35 ISM controls |
| Annex A 5.13 Labelling of Information | Organisational | No direct Essential Eight equivalent | 24 ISM controls |
| Annex A 5.14 Information Transfer Policies and Procedures | Organisational | No direct Essential Eight equivalent | 33 ISM controls |
| Annex A 5.15 Access Control Policies and Procedures | Organisational | No direct Essential Eight equivalent | 83 ISM controls |
| Annex A 5.16 Identity life cycle management | Organisational | No direct Essential Eight equivalent | 21 ISM controls |
| Annex A 5.17 Management of Authentication Information | Organisational | No direct Essential Eight equivalent | 50 ISM controls |
| Annex A 5.18 Managing Access Rights to Information Assets | Organisational | No direct Essential Eight equivalent | 51 ISM controls |
| Annex A 5.19 Managing Information Security in Supplier Relationships | Organisational | No direct Essential Eight equivalent | 55 ISM controls |
| Annex A 5.20 Integrating security clauses in supplier agreements | Organisational | No direct Essential Eight equivalent | 23 ISM controls |
| Annex A 5.21 Managing Information Security in the ICT Supply Chain | Organisational | No direct Essential Eight equivalent | 48 ISM controls |
| Annex A 5.22 Monitoring and Managing Supplier Services | Organisational | No direct Essential Eight equivalent | 27 ISM controls |
| Annex A 5.23 Cloud Service Security Management | Organisational | No direct Essential Eight equivalent | 5 ISM controls |
| Annex A 5.24 Information security incident management planning and preparation | Organisational | No direct Essential Eight equivalent | 24 ISM controls |
| Annex A 5.25 Assessment and decision on information security events | Organisational | No direct Essential Eight equivalent | 4 ISM controls |
| Annex A 5.26 Response to Information Security Incidents | Organisational | No direct Essential Eight equivalent | 19 ISM controls |
| Annex A 5.27 Learning from information security incidents | Organisational | No direct Essential Eight equivalent | 3 ISM controls |
| Annex A 5.28 Procedures for Collecting and Preserving Evidence | Organisational | No direct Essential Eight equivalent | 28 ISM controls |
| Annex A 5.29 Maintain information security during disruptions | Organisational | No direct Essential Eight equivalent | 6 ISM controls |
| Annex A 5.30 ICT Readiness for Business Continuity | Organisational | No direct Essential Eight equivalent | 16 ISM controls |
| Annex A 5.31 Compliance with Information Security Legal Requirements | Organisational | No direct Essential Eight equivalent | 13 ISM controls |
| Annex A 5.32 Intellectual Property Rights Protection | Organisational | No direct Essential Eight equivalent | 3 ISM controls |
| Annex A 5.33 Protection of Records | Organisational | No direct Essential Eight equivalent | 12 ISM controls |
| Annex A 5.34 Privacy and Protection of Personally Identifiable Information | Organisational | No direct Essential Eight equivalent | 11 ISM controls |
| Annex A 5.35 Independent review of information security | Organisational | No direct Essential Eight equivalent | 22 ISM controls |
| Annex A 5.36 Review compliance with information security policies | Organisational | No direct Essential Eight equivalent | 28 ISM controls |
| Annex A 5.37 Documented Operating Procedures for Information Processing | Organisational | No direct Essential Eight equivalent | 16 ISM controls |
| Annex A 6.1 Personnel Background Verification | People | No direct Essential Eight equivalent | 5 ISM controls |
| Annex A 6.2 Terms and conditions of employment for security | People | No direct Essential Eight equivalent | 5 ISM controls |
| Annex A 6.3 Information security awareness, education and training program | People | No direct Essential Eight equivalent | 34 ISM controls |
| Annex A 6.4 Disciplinary Process for Information Security Violations | People | No direct Essential Eight equivalent | 3 ISM controls |
| Annex A 6.5 Responsibilities after employment termination or role change | People | No direct Essential Eight equivalent | 4 ISM controls |
| Annex A 6.6 Confidentiality and Non-disclosure Agreements | People | No direct Essential Eight equivalent | 2 ISM controls |
| Annex A 6.7 Remote Working Security Measures | People | No direct Essential Eight equivalent | 20 ISM controls |
| Annex A 6.8 Mechanisms for Reporting Security Events | People | No direct Essential Eight equivalent | 16 ISM controls |
| Annex A 7.1 Physical Security Perimeters | Physical | No direct Essential Eight equivalent | 20 ISM controls |
| Annex A 7.2 Physical access controls for secure areas | Physical | No direct Essential Eight equivalent | 19 ISM controls |
| Annex A 7.3 Physical Security for Offices and Facilities | Physical | No direct Essential Eight equivalent | 22 ISM controls |
| Annex A 7.4 Continuous monitoring of physical access to premises | Physical | No direct Essential Eight equivalent | 4 ISM controls |
| Annex A 7.5 Protecting against physical and environmental threats | Physical | No direct Essential Eight equivalent | 18 ISM controls |
| Annex A 7.6 Security Measures for Working in Secure Areas | Physical | No direct Essential Eight equivalent | 24 ISM controls |
| Annex A 7.7 Clear desk and clear screen policies | Physical | No direct Essential Eight equivalent | 12 ISM controls |
| Annex A 7.8 Equipment Siting and Protection | Physical | No direct Essential Eight equivalent | 22 ISM controls |
| Annex A 7.9 Security of Off-Site Assets | Physical | No direct Essential Eight equivalent | 6 ISM controls |
| Annex A 7.10 Secure Management of Storage Media | Physical | No direct Essential Eight equivalent | 66 ISM controls |
| Annex A 7.11 Protection from Utility Failures | Physical | No direct Essential Eight equivalent | 3 ISM controls |
| Annex A 7.12 Secure Cabling for Power and Data | Physical | No direct Essential Eight equivalent | 28 ISM controls |
| Annex A 7.13 Proper Maintenance of Equipment | Physical | No direct Essential Eight equivalent | 13 ISM controls |
| Annex A 7.14 Secure disposal or re-use of equipment | Physical | No direct Essential Eight equivalent | 57 ISM controls |
| Annex A 8.1 Protection of User Endpoint Devices | Technological | No direct Essential Eight equivalent | 36 ISM controls |
| Annex A 8.2 Management of Privileged Access Rights | Technological | 59 ISM controls | |
| Annex A 8.3 Restrict access to information and assets | Technological | No direct Essential Eight equivalent | 67 ISM controls |
| Annex A 8.4 Access management for source code and tools | Technological | No direct Essential Eight equivalent | 12 ISM controls |
| Annex A 8.5 Secure authentication technologies and procedures | Technological | 62 ISM controls | |
| Annex A 8.6 Capacity Management for Resource Use | Technological | No direct Essential Eight equivalent | 8 ISM controls |
| Annex A 8.7 Protection against malware | Technological | 23 ISM controls | |
| Annex A 8.8 Management of Technical Vulnerabilities | Technological | 63 ISM controls | |
| Annex A 8.9 Configuration Management for Secure IT Systems | Technological | 94 ISM controls | |
| Annex A 8.10 Secure deletion of information when no longer needed | Technological | No direct Essential Eight equivalent | 27 ISM controls |
| Annex A 8.11 Data Masking for Sensitive Information | Technological | No direct Essential Eight equivalent | 1 ISM control |
| Annex A 8.12 Data Leakage Prevention Measures | Technological | No direct Essential Eight equivalent | 34 ISM controls |
| Annex A 8.13 Backup and Recovery Procedures for Data | Technological | 11 ISM controls | |
| Annex A 8.14 Redundancy of Information Processing Facilities | Technological | No direct Essential Eight equivalent | 1 ISM control |
| Annex A 8.15 Logging of Activities and Events | Technological | No direct Essential Eight equivalent | 54 ISM controls |
| Annex A 8.16 Monitoring Networks and Systems for Anomalous Behaviour | Technological | No direct Essential Eight equivalent | 35 ISM controls |
| Annex A 8.17 Clock synchronisation for information systems | Technological | No direct Essential Eight equivalent | 2 ISM controls |
| Annex A 8.18 Use of Privileged Utility Programs | Technological | 10 ISM controls | |
| Annex A 8.19 Secure Software Installation Procedures | Technological | 29 ISM controls | |
| Annex A 8.20 Network and Network Devices Security | Technological | No direct Essential Eight equivalent | 100 ISM controls |
| Annex A 8.21 Security of Network Services | Technological | No direct Essential Eight equivalent | 24 ISM controls |
| Annex A 8.22 Network Segregation for Security | Technological | No direct Essential Eight equivalent | 51 ISM controls |
| Annex A 8.23 Web Filtering to Reduce Malicious Website Exposure | Technological | No direct Essential Eight equivalent | 15 ISM controls |
| Annex A 8.24 Effective Use of Cryptography and Key Management | Technological | No direct Essential Eight equivalent | 91 ISM controls |
| Annex A 8.25 Secure Development Lifecycle | Technological | No direct Essential Eight equivalent | 48 ISM controls |
| Annex A 8.26 Defining Security Requirements for Applications | Technological | No direct Essential Eight equivalent | 33 ISM controls |
| Annex A 8.27 Secure system architecture and engineering principles | Technological | No direct Essential Eight equivalent | 31 ISM controls |
| Annex A 8.28 Secure Coding Practices in Software Development | Technological | No direct Essential Eight equivalent | 38 ISM controls |
| Annex A 8.29 Security testing in development and acceptance | Technological | No direct Essential Eight equivalent | 34 ISM controls |
| Annex A 8.30 Management of Outsourced System Development | Technological | No direct Essential Eight equivalent | 20 ISM controls |
| Annex A 8.31 Separation of Development, Test, and Production Environments | Technological | No direct Essential Eight equivalent | 9 ISM controls |
| Annex A 8.32 Change management procedures for information systems | Technological | No direct Essential Eight equivalent | 26 ISM controls |
| Annex A 8.33 Test Information Selection and Protection | Technological | No direct Essential Eight equivalent | 7 ISM controls |
| Annex A 8.34 Protection of information systems during audits | Technological | No direct Essential Eight equivalent | 5 ISM controls |
Essential Eight to ISO 27001
Each Essential Eight strategy and the primary ISO 27001 Annex A control(s) it satisfies.
Application Control
Prevent execution of unapproved or malicious software; allow only approved applications to run.
- Annex A 8.19 - Secure Software Installation Procedures
A.8.19 requires securely managing software installation on operational systems - the core of controlling which applications may run.
- Annex A 8.7 - Protection against malware
A.8.7 (protection against malware) is served by application control preventing unapproved or malicious executables from running.
- Annex A 8.18 - Use of Privileged Utility Programs
A.8.18 restricts use of privileged utility programs that can override system controls, which application control enforces.
Patch Applications
Apply security patches to applications (browsers, office suites, email, PDF software) within defined timeframes.
- Annex A 8.8 - Management of Technical Vulnerabilities
A.8.8 (management of technical vulnerabilities) requires obtaining vulnerability information and applying appropriate measures - patching applications is a core such measure.
Configure Microsoft Office Macro Settings
Block or restrict Microsoft Office macros, especially those originating from the internet.
- Annex A 8.9 - Configuration Management for Secure IT Systems
A.8.9 (configuration management) requires secure, documented configurations - macro settings are a security configuration it governs.
User Application Hardening
Harden browsers and applications by disabling risky features such as Flash, Java, ads and unneeded functionality.
- Annex A 8.9 - Configuration Management for Secure IT Systems
A.8.9 (configuration management) covers hardening application and browser configurations to a secure baseline.
- Annex A 8.7 - Protection against malware
A.8.7 (protection against malware) is supported by hardening applications to remove features attackers exploit.
Restrict Administrative Privileges
Limit, validate and manage privileged and administrative access.
- Annex A 8.2 - Management of Privileged Access Rights
A.8.2 requires that allocation and use of privileged access rights be restricted and managed - identical intent to the strategy.
Patch Operating Systems
Apply operating system and firmware patches within defined timeframes; replace unsupported systems.
- Annex A 8.8 - Management of Technical Vulnerabilities
A.8.8 (management of technical vulnerabilities) covers evaluating exposure and applying operating-system patches as appropriate measures.
Multi-Factor Authentication
Require multi-factor authentication for remote access, privileged actions and internet-facing services.
- Annex A 8.5 - Secure authentication technologies and procedures
A.8.5 requires secure authentication technologies and procedures - multi-factor authentication is the primary such technology.
Regular Backups
Perform and test backups of important data; retain and protect them so they cannot be altered or deleted by an intruder.
- Annex A 8.13 - Backup and Recovery Procedures for Data
A.8.13 requires backup copies of information, software and systems to be maintained and regularly tested.
How to use this mapping
If you are certified to ISO/IEC 27001 and need to demonstrate Essential Eight coverage, start from a technological ISO control above and follow it to the Essential Eight strategy it supports, then open that strategy for its maturity-level requirements. If you already run the Essential Eight and want ISO 27001 alignment, use the reverse section to find the Annex A control each strategy satisfies. Every ISO control also links through to its full ASD ISM mappings.
Frequently asked questions
Does ISO 27001 cover the Essential Eight?
Largely, yes. Most Essential Eight strategies map to one or more ISO 27001 Annex A controls (for example, patch management maps to Annex A 8.8, and application control maps to Annex A 8.19). ISO 27001 is broader and risk-based, while the Essential Eight is a prescriptive Australian baseline; this crosswalk shows control by control where they overlap.
Which ISO 27001 Annex A controls map to the Essential Eight?
Eight ISO/IEC 27001:2022 Annex A controls have a direct Essential Eight equivalent, all in the Technological theme: A.8.2, A.8.5, A.8.7, A.8.8, A.8.9, A.8.13, A.8.18 and A.8.19. The organisational, people and physical controls have no direct Essential Eight equivalent, because the Essential Eight is a technical mitigation baseline rather than a full management system.
Is the Essential Eight mandatory in Australia?
The Essential Eight is mandated for Australian non-corporate Commonwealth entities and is widely adopted as a baseline by other organisations. It is published by the Australian Cyber Security Centre (ACSC).