Answer first
This checklist captures the technical and policy artefacts an Australian Signals Directorate (ASD) qualified assessor will sample when evaluating Essential Eight Maturity Level 2 — one section per mitigation strategy. Every artefact references the Information Security Manual (Australian Cyber Security Centre — ISM, accessed 16 June 2026) (November 2025 release) control identifiers and the ASD Essential Eight Maturity Model (Australian Signals Directorate — Essential Eight maturity model, accessed 16 June 2026) (current revision). Use it as the index for the quarterly evidence-pack refresh; use the free Essential Eight Maturity Assessment to identify which control to refresh first.
How to use this checklist
Each section follows the same shape: the Maturity Level 2 requirement, the system of record from which the evidence comes, and the artefact filename convention. Store the pack in a dated SharePoint library or shared drive that the security team owns. Filename convention: <control>-<artefact>-<YYYYMMDD>.<ext> — for example c1-applocker-effective-policy-20260524.xml. Source URL and ISM control identifier go in the document metadata field.
The pillar guide Essential Eight Maturity Level 2 — the 2026 evidence pack covers the per-control requirements in narrative depth; this how-to is the practitioner checklist.
1. Control 1 — Application control
ML2 requirement (ASD Essential Eight Maturity Model, current revision): Application control implemented on workstations and internet-facing servers; restricts the execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets; Microsoft and ASD recommended block rules implemented.
Evidence artefacts:
- AppLocker policy XML or Windows Defender Application Control (WDAC) policy file — exported from the central management point
- Effective-policy report from a sampled workstation —
Get-AppLockerPolicy -Effective -Xmloutput or the WDAC effective-policy CIP file - Effective-policy report from a sampled internet-facing server
- Allowlist of approved publishers and signed binaries — current as at refresh date
- Microsoft and ASD recommended block-rule policy fragment — versioned and dated
- Application control denial event log extract for the prior 30 days — sampled across workstations and servers
- Application control exception register — applications and users with documented business need plus compensating controls
System of record: Microsoft Intune, Microsoft Endpoint Configuration Manager (MECM), Group Policy, or third-party application control platform.
Related ISM control identifiers (November 2025): Application control, recommended block rules, allowlisting governance.
2. Control 2 — Patch applications
ML2 requirement (ASD Essential Eight Maturity Model, current revision): Patches for security vulnerabilities in internet-facing services applied within two weeks of release, or within 48 hours if an exploit exists; patches for office productivity suites, web browsers, email clients, PDF software and security products applied within one month; vulnerability scanner used at least fortnightly.
Evidence artefacts:
- Microsoft Intune App install status report or MECM Software Updates — Compliance report — covering the assessment period
- Microsoft Defender Vulnerability Management Vulnerable software report — exported fortnightly for the prior 12 months
- Internet-facing services patch log — service name, current version, patch date, source advisory URL
- Vulnerability scanner output — Tenable Nessus, Qualys or equivalent — for the prior 12 months
- Patch exception register — patches deferred beyond the timeframe with business justification and compensating controls
- Out-of-band emergency patch procedure document — versioned and dated
System of record: Microsoft Intune, MECM, Microsoft Defender Vulnerability Management, Tenable Nessus, Qualys.
Related ISM control identifiers (November 2025): ISM-1690, ISM-1691 and adjacent identifiers governing application vulnerability scanning and internet-facing and non-internet-facing patch timeframes.
3. Control 3 — Configure Microsoft Office macro settings
ML2 requirement (ASD Essential Eight Maturity Model, current revision): Microsoft Office macros disabled for users without a business requirement; macros in files originating from the internet blocked; macro antivirus scanning enabled; macro security settings cannot be changed by users; only sandboxed, Trusted Location, or digitally signed by Trusted Publisher macros allowed to execute.
Evidence artefacts:
- Group Policy or Intune configuration profile export covering Microsoft Office macro settings — Word, Excel, PowerPoint, Outlook, Access
- Approved Trusted Publishers inventory — including the code-signing certificate thumbprint per publisher
- Trusted Locations inventory — including the SharePoint or file share path
- Macro execution audit log extract from Microsoft 365 Apps — prior 90 days
- Macro exception register — users with documented business need, approved certificate, expiry date
System of record: Microsoft Intune, Group Policy, Microsoft 365 Apps admin centre, Microsoft Defender for Office 365.
Related ISM control identifiers (November 2025): Microsoft Office macro execution restrictions, internet-origin macro blocking, antivirus scanning of macro content. Supporting publication: ACSC Restricting Microsoft Office Macros (cyber.gov.au, current revision).
4. Control 4 — User application hardening
ML2 requirement (ASD Essential Eight Maturity Model, current revision): Web browsers do not process Java from the internet, web advertisements are blocked, Internet Explorer 11 is disabled or removed; Microsoft Office configured to prevent activation of OLE packages; Flash content disabled in Microsoft Office and PDF software; ACSC and vendor-recommended security configurations applied; hardening settings cannot be changed by users.
Evidence artefacts:
- Microsoft Edge enterprise policy export — including ad blocking and Java handling settings
- Google Chrome enterprise policy export — equivalent settings for Chrome-enrolled endpoints
- Internet Explorer 11 disable or removal evidence — Group Policy export plus a sampled endpoint report
- Microsoft Office OLE package handling configuration export
- Flash content disabling evidence — Microsoft Office and PDF software configuration export
- Workstation hardening baseline document — referencing ACSC and Microsoft hardening guidance with version dates
System of record: Microsoft Intune, Group Policy, Microsoft Edge enterprise admin centre.
Related ISM control identifiers (November 2025): Web browser hardening, OLE package handling, Flash content disabling, Internet Explorer 11 removal.
5. Control 5 — Restrict administrative privileges
ML2 requirement (ASD Essential Eight Maturity Model, current revision): Privileged access requests validated when first requested; privileged users use separate privileged and unprivileged operating environments; unprivileged accounts cannot log on to privileged operating environments; privileged accounts (excluding privileged service accounts) prevented from accessing the internet, email and web services; privileged access events centrally logged.
Evidence artefacts:
- Privileged account inventory — every account with elevated rights, the system it provides access to, the business owner, the activation method
- Microsoft Entra ID Privileged Identity Management (PIM) configuration export — including just-in-time activation, approval workflow and audit log retention
- Conditional Access policy export blocking privileged accounts from non-managed networks and the open internet
- Privileged Access Workstation (PAW) inventory — endpoints with the dedicated privileged role, OS hardening baseline and management agents
- Privileged access event log extract — prior 12 months from Microsoft Entra audit logs or Sentinel
- Privileged access review evidence — quarterly review minutes, approver signatures, decommissioning records
System of record: Microsoft Entra ID, Microsoft Entra Privileged Identity Management, Microsoft Sentinel, Microsoft Intune.
Related ISM control identifiers (November 2025): Separate privileged accounts, privileged access workstations, restricted internet access for privileged accounts, centralised privileged access logging.
6. Control 6 — Patch operating systems
ML2 requirement (ASD Essential Eight Maturity Model, current revision): Patches for OS security vulnerabilities in internet-facing services applied within two weeks of release, or within 48 hours if an exploit exists; patches for workstations, servers and network devices applied within one month; vulnerability scanner used at least fortnightly; unsupported operating systems replaced.
Evidence artefacts:
- Windows Update for Business compliance report — Intune or MECM
- MECM Software Updates — Operating System Compliance report — covering the assessment period
- Internet-facing server patch log — server, OS version, patch date, source advisory URL
- Vulnerability scanner output covering operating systems — Tenable Nessus, Qualys or equivalent
- Operating system end-of-support schedule — workstations, servers and network devices approaching vendor end-of-support with replacement plan and target date
- Operating system patch exception register
System of record: Microsoft Intune, MECM, Windows Update for Business, Tenable Nessus, Qualys.
Related ISM control identifiers (November 2025): OS patch timeframes for internet-facing and non-internet-facing infrastructure; replacement of unsupported operating systems.
7. Control 7 — Multi-factor authentication
ML2 requirement (ASD Essential Eight Maturity Model, current revision): Multi-factor authentication used by privileged users, by users accessing important data repositories, and by users accessing the organisation's internet-facing services; MFA uses something users have and something users know, or something users have unlocked by something users know or are; SMS, email or voice call MFA methods are not used.
Evidence artefacts:
- Microsoft Entra ID authentication methods policy export — showing approved methods organisation-wide
- Conditional Access policy export covering privileged users, internet-facing services and important data repositories — requiring approved MFA methods
- Sign-in log extract for the prior 90 days — sampled across in-scope user groups and applications
- Internet-facing services inventory — service name, MFA enforcement method, integration approach (Entra ID, SAML federation, third-party identity provider)
- Important data repositories inventory — repository name, MFA enforcement method, access governance approver
- MFA exception register — users, applications or services for which approved MFA cannot be enforced, compensating controls, review date
System of record: Microsoft Entra ID, Microsoft Entra Conditional Access, Microsoft Sentinel.
Related ISM control identifiers (November 2025): Phishing-resistant authentication for privileged access, internet-facing services and high-value data repositories.
8. Control 8 — Regular backups
ML2 requirement (ASD Essential Eight Maturity Model, current revision): Backups of important data, software and configuration settings performed and retained in accordance with business continuity requirements; backups tested in accordance with business continuity requirements; unprivileged accounts cannot access backups belonging to other accounts; unprivileged accounts cannot modify or delete backups.
Evidence artefacts:
- Backup policy document — retention periods aligned to business continuity requirements with executive sign-off
- Backup job logs for the prior 12 months — Azure Backup, Veeam, Commvault or equivalent
- Restore test logs for the prior 12 months — at least one full-recovery test per critical workload
- Backup access control configuration — demonstrating that unprivileged accounts cannot read, modify or delete other accounts' backups
- Backup immutability configuration — where the backup platform supports immutable or write-once storage
- Backup repository inventory — repository name, contents, retention, immutability, owner
System of record: Azure Backup, Veeam, Commvault, Microsoft 365 Backup, on-premises backup platform.
Related ISM control identifiers (November 2025): Backup retention aligned to business continuity, recoverability testing, restricted access to backups.
9. Cross-cutting artefacts the pack always needs
In addition to the per-control artefacts, every Maturity Level 2 evidence pack benefits from the following cross-cutting documents — these become the executive briefing layer above the technical evidence.
- Information security policy — versioned, with executive sign-off and review date
- Essential Eight implementation roadmap — target maturity per control with timeline and ownership
- Asset inventory — endpoints, servers, applications, data repositories, with classification
- Risk register — Essential Eight-relevant risks, treatments and review dates
- Incident response plan — versioned, tested in the prior 12 months, with restore test cross-reference
- Supplier security expectations — applied to in-scope suppliers, with attestation records
10. Run the cadence — quarterly self-assessment, monthly telemetry, annual formal
The cadence that holds together a working evidence pack is:
- Monthly — refresh patch compliance telemetry, MFA enforcement reports, vulnerability scan output
- Quarterly — refresh policy and configuration exports, run the free Essential Eight Maturity Assessment, update the per-control evidence index
- Per Information Security Manual release (quarterly) — review baseline documents against the updated ISM
- Annually — refresh restore test logs, refresh major baselines, commission formal assessment by qualified assessors
The pillar guide Essential Eight Maturity Level 2 — the 2026 evidence pack covers remediation sequencing — close the weakest control first, because the overall maturity reported is the lowest across all eight. For formal evidence-pack support and a fixed-price assessment, see the Essential Eight Assessment service.
Sources cited
- Australian Signals Directorate — Essential Eight Maturity Model (current revision, cyber.gov.au, checked 24 May 2026)
- Australian Signals Directorate — Essential Eight Maturity Model FAQ (cyber.gov.au, current revision, checked 24 May 2026)
- Australian Signals Directorate — Essential Eight Assessment Process Guide (Australian Signals Directorate — Essential Eight Assessment Process Guide, accessed 16 June 2026) (2024)
- Australian Cyber Security Centre — Information Security Manual (November 2025 release, cyber.gov.au)
- Australian Cyber Security Centre — Restricting Microsoft Office Macros (cyber.gov.au, current revision)
- Australian Cyber Security Centre — Implementing Application Control (cyber.gov.au, current revision)
Sources referenced in this article: ASD Essential Eight Maturity Model, ASD Essential Eight Assessment Process Guide, ACSC Information Security Manual (ISM), ASD Essential Eight Maturity Model FAQ, ACSC Restricting Microsoft Office Macros, ACSC Implementing Application Control, Protective Security Policy Framework (PSPF), Hosting Certification Framework.
