Essential Eight Gap Analysis Checklist 2026: A Practical Walkthrough for Australian Organisations

An Essential Eight gap analysis tells you precisely which controls are absent, partially implemented, or inconsistently applied across your environment — so you fix problems before an auditor finds them for you.

This checklist is structured around the ACSC's 2025 Essential Eight Maturity Model update (current as of mid-2026) and is calibrated to distinguish ML1 from ML2 requirements. Work through it strategy by strategy, assign a status to each item, and use the output to build a remediation plan with owners and target dates.

Before you begin, take our free online Essential Eight assessment to get a rapid baseline that you can then validate in depth using this checklist.

How to Use This Checklist

For each item, assign one of four statuses:

• Implemented — the control is in place, enforced, and objectively verifiable
• Partial — the control exists but is not applied consistently or completely across all in-scope systems
• Not implemented — the control is absent
• Not applicable — document your rationale; auditors will scrutinise N/A claims

Record your status, the evidence that supports it, and the name of the person who verified it. A checklist with no supporting evidence is a self-assessment; a checklist with supporting evidence is the start of your audit-ready pack. For guidance on building the full pack, see the Essential Eight ML2 evidence pack pillar guide.

Strategy 1: Application Control

Application control prevents unapproved or malicious programs from executing on workstations and servers.

ML1 requirements:

• Application control is implemented on all workstations to restrict the execution of executables, software libraries, scripts, and installers to an approved set

ML2 additional requirements:

• Application control is implemented on all servers
• Allowed and blocked execution events are logged
• Logs are retained and reviewed

Checklist items:

1. Is application control software deployed on all workstations — including non-SOE devices in scope?
2. Is application control software deployed on all servers — including cloud-hosted virtual machines?
3. Does the control cover all execution types: executables (.exe), software libraries (.dll), scripts (.ps1, .vbs, .bat), and installers (.msi)?
4. Are allowed and denied execution events logged centrally?
5. Are logs retained for a minimum period consistent with your log retention policy?
6. Has the application control ruleset been reviewed in the past twelve months?
7. Are exceptions to the application control policy documented and formally approved?

Common gaps: Server-side coverage is frequently missing. Organisations implement AppLocker or Intune Application Control on workstations but exempt servers due to operational concerns. This is a direct ML2 gap.

Strategy 2: Patch Applications

Unpatched third-party applications remain the most exploited entry point in Australian incidents.

ML1 requirements:

• Patches or updates for internet-facing services are applied within two weeks of release

ML2 additional requirements:

• Patches for internet-facing services applied within 48 hours when an exploit exists
• Patches for non-internet-facing applications applied within two weeks
• Patches for applications rated critical or high applied within two weeks regardless of internet exposure
• Applications with no vendor support are removed or isolated

Checklist items:

1. Do you maintain an inventory of all applications installed across in-scope systems?
2. Are vulnerability scan outputs reviewed against this inventory to identify unpatched applications?
3. Is there a process to identify when a patch is released for an internet-facing service?
4. Can you demonstrate that internet-facing service patches are applied within 48 hours when an exploit is publicly known?
5. Can you demonstrate that all other critical and high-rated patches are applied within two weeks?
6. Are any applications running past end-of-life or unsupported versions? If so, are they isolated from internet access?
7. Does your vulnerability scanner cover all in-scope systems, including cloud workloads?

Common gaps: The 48-hour patching window for exploited internet-facing vulnerabilities catches most organisations out. Many have a two-week SLA and no process to accelerate when an exploit is published.

Strategy 3: Configure Microsoft Office Macro Settings

Malicious macros remain a primary delivery mechanism for malware targeting Australian businesses.

ML1 requirements:

• Microsoft Office macros are disabled for users who do not have a demonstrated business need

ML2 additional requirements:

• Microsoft Office macros are only allowed to execute when they originate from trusted locations or are digitally signed by a trusted publisher
• Macros sourced from the internet are blocked

Checklist items:

1. Is there a Group Policy or Intune policy controlling macro settings for all Office applications?
2. Are macros disabled by default for users who do not require them?
3. Are macros restricted to trusted locations or digitally signed publishers for users who do require them?
4. Is the "Block macros from running in Office files from the internet" setting enforced via policy?
5. Are exceptions to macro policy formally approved and documented?
6. Has the macro policy configuration been tested to confirm it cannot be overridden by users?

Strategy 4: User Application Hardening

Hardening user-facing applications reduces the attack surface available to browser-based and script-based attacks.

ML1 requirements:

• Flash, Java, and web advertisements are blocked in web browsers

ML2 additional requirements:

• PowerShell is configured to use Constrained Language Mode or equivalent
• .NET Framework 3.5 (including 2.0 and 3.0) is disabled unless required
• Internet Explorer 11 is disabled or removed

Checklist items:

1. Is Adobe Flash blocked or removed from all browsers on in-scope devices?
2. Is Java blocked from running in all browsers on in-scope devices?
3. Are web advertisements blocked via browser policy or a network-level control?
4. Is PowerShell configured to use Constrained Language Mode on all workstations?
5. Is .NET Framework 3.5 disabled on devices where it is not required for a business application?
6. Is Internet Explorer 11 disabled or removed from all in-scope devices?
7. Are users prevented from installing browser extensions without approval?

Strategy 5: Restrict Administrative Privileges

Privilege misuse and stolen admin credentials enable lateral movement in nearly every significant Australian incident.

ML1 requirements:

• Privileged accounts are used only for tasks that require them (no internet browsing or email on privileged accounts)
• Privileged accounts are not granted to users who do not require them

ML2 additional requirements:

• Privileged access workstations or jump servers are used for privileged tasks
• Privileged account activity is logged and reviewed
• Privileged accounts are reviewed at least annually

Checklist items:

1. Do you have a current inventory of all privileged accounts across Active Directory, cloud platforms, and applications?
2. Is there a formal process to request and approve privileged account creation?
3. Are privileged accounts prevented from browsing the internet or accessing email?
4. Are separate privileged accounts used for administrative tasks (not the user's standard account with elevated permissions)?
5. Are privileged access workstations or jump servers in use for administrative activities?
6. Are privileged account actions logged centrally?
7. Has a privileged account review been completed in the past twelve months?
8. Are there any service accounts with interactive login rights that should be converted to managed service accounts?

Common gaps: The most common gap is shared local administrator accounts with the same password across workstations. This is an ML1 issue that remains widespread.

Strategy 6: Patch Operating Systems

Operating system vulnerabilities without patches provide straightforward footholds for attackers.

ML1 requirements:

• Operating system patches are applied within one month of release

ML2 additional requirements:

• Operating system patches for internet-facing services applied within two weeks
• Operating system patches for internet-facing services with known exploits applied within 48 hours
• Unsupported operating systems are removed or isolated

Checklist items:

1. Do you have a current inventory of all operating systems in your environment, including version and patch level?
2. Is there a process to identify when OS patches are released and assess their severity?
3. Are OS patches for internet-facing systems applied within two weeks as a standard?
4. Is there a process to accelerate patching to 48 hours when an OS exploit is publicly known?
5. Are any systems running unsupported operating systems (Windows Server 2012, Windows 10 21H2, etc.)?
6. Are cloud infrastructure operating systems (VM base images) included in your patch scope?
7. Does your WSUS, Intune, or SCCM deployment confirmation report cover all in-scope systems?

Strategy 7: Multi-Factor Authentication

MFA is the single control that has the highest impact-per-effort ratio for reducing account compromise risk.

ML1 requirements:

• MFA is used to authenticate users to internet-facing services

ML2 additional requirements:

• MFA is used for all users accessing internet-facing services
• MFA is used for all privileged users
• MFA is phishing-resistant (passkeys, certificate-based, or FIDO2 hardware keys) for privileged accounts

Checklist items:

1. Is MFA enabled for all users accessing any internet-facing service — including cloud applications, email, VPN, and remote access?
2. Is MFA enabled for all privileged accounts?
3. Are any legacy authentication protocols (SMTP AUTH, Basic Auth, NTLM) still in use that could bypass MFA?
4. For privileged accounts, is the MFA method phishing-resistant (FIDO2 hardware key, certificate-based, or passkey)?
5. Is there a process to enrol new users in MFA before they gain access to internet-facing systems?
6. Are MFA bypass exceptions formally approved and documented?
7. Have you tested that MFA cannot be bypassed via legacy authentication protocols or conditional access policy gaps?

Common gaps: Conditional access policies that exempt certain applications, device types, or legacy protocols create coverage gaps that bypass MFA entirely. Test coverage, do not assume it.

Strategy 8: Regular Backups

Backups are the last line of defence against ransomware and are a direct ML2 audit focus area.

ML1 requirements:

• Backups of important data, software, and configuration settings are performed and retained for a minimum of three months

ML2 additional requirements:

• Backups are tested to ensure data can be restored
• Privileged access to backups is restricted to prevent tampering
• Backups are stored offline, offsite, or in a cloud storage service that is not accessible from the production environment

Checklist items:

1. Is there a formal backup policy specifying what is backed up, how often, and how long backups are retained?
2. Are backups performed at least daily for critical systems?
3. Are backups retained for a minimum of three months?
4. Are backups stored in a location not accessible from the production environment (air-gapped, offline, or separate cloud tenancy)?
5. Is access to the backup infrastructure restricted to a small number of specifically designated accounts?
6. Has a restore test been completed in the past twelve months, with results documented?
7. Are backup completion and failure logs reviewed regularly?
8. Are configuration and software environment backups (not just data) included in the backup scope?

Scoring and Prioritising Remediation

After completing the checklist, count your items by status:

• Implemented — no action required; schedule periodic re-verification
• Partial — prioritise by the strategy's risk weight; patch, MFA, and application control gaps typically carry highest risk
• Not implemented — immediate remediation planning required

Build a remediation register with the following columns for every non-implemented or partial item:

Present this register to your leadership team alongside a risk summary. Leadership need to understand that ML1-to-ML2 uplift is not a cosmetic improvement — it closes specific attack vectors that threat actors actively exploit against Australian organisations.

2026 Australian Context: What Has Changed

The ACSC's 2025 maturity model update (effective for most assessments from early 2026) introduced stricter requirements in two areas:

1. Phishing-resistant MFA is now explicitly required for privileged accounts at ML2, not just ML3. Organisations still using SMS-based or authenticator app MFA for admin accounts have a gap even if they were previously assessed at ML2.

2. Application control on servers is now weighted more heavily in assessments following several high-profile ransomware cases where server-side execution of malicious scripts was the primary lateral movement technique.

If your last assessment was conducted before July 2025, re-run the checklist against the current model before treating your prior result as current.

Next Steps

A checklist identifies gaps. Closing them requires prioritised effort. If you are uncertain which gaps represent genuine operational risk versus compliance risk in your specific environment, a structured assessment provides the context a checklist alone cannot.

Use our free Essential Eight assessment to validate your checklist findings with an independent view and get a prioritised remediation roadmap tailored to your organisation size and industry.