Australia Essential Eight

Patch applications, application control, software inventory for Australian organisations.


Short name	AUS E8
Region	Asia-Pacific
Country or scope	Australia
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers AUS E8

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 18 controls from Safeguard's control catalog for AUS E8.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for AUS E8 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`AU-E8-APPCTL` Application Control Baseline	Application control requires an authoritative list of approved software; the organisation must be able to enumerate every software component it runs (Essential Eight - Application Control, Maturity Level 1)	Scan
`AU-E8-PATCHAPP` Patch Applications - Version Visibility	Timely patching of applications is only possible when the installed version of each component is known, so components must record their versions (Essential Eight - Patch Applications)	Scan
`AU-E8-PATCHSPEC` Deterministic Patch Targets	Vulnerability scanners used to drive the 48-hour/two-week patch timeframes need exact versions, so vague or floating version specifiers must not be used (Essential Eight - Patch Applications, scanning and patch timeframe requirements)	Scan
`AU-E8-ASSETID` Scannable Asset Identification	Components should carry standard identifiers (PURL or CPE) so vulnerability scanning across applications and drivers can match them to published advisories (Essential Eight - Patch Applications / Patch Operating Systems, vulnerability scanner use)	Scan
`AU-E8-INTEGRITY` Executable Integrity Evidence	Application control at higher maturity levels validates software by cryptographic attributes, so components should ship with integrity hashes (Essential Eight - Application Control, hash/publisher-based rules)	Scan
`AU-E8-PLATFORM` Named System Under Management	Mitigation strategies are applied per system, so the software inventory must identify the system it describes and list its constituent components (Essential Eight Maturity Model, scoping of assessed systems)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`E8-AC-ML1`	Implement Application Control at Maturity Level 1
`E8-AC-ML2`	Implement Application Control at Maturity Level 2
`E8-AC-ML3`	Implement Application Control at Maturity Level 3
`E8-PA-ML1`	Patch Applications at Maturity Level 1
`E8-PA-ML2`	Patch Applications at Maturity Level 2
`E8-PA-ML3`	Patch Applications at Maturity Level 3
`E8-MO-ML1`	Configure Microsoft Office Macros at Maturity Level 1
`E8-MO-ML2`	Configure Microsoft Office Macros at Maturity Level 2
`E8-MO-ML3`	Configure Microsoft Office Macros at Maturity Level 3
`E8-UAH-ML1`	Apply User Application Hardening at Maturity Level 1
`E8-UAH-ML2`	Apply User Application Hardening at Maturity Level 2
`E8-RAP-ML1`	Restrict Administrative Privileges at Maturity Level 1
`E8-RAP-ML2`	Restrict Administrative Privileges at Maturity Level 2
`E8-RAP-ML3`	Restrict Administrative Privileges at Maturity Level 3
`E8-POS-ML2`	Patch Operating Systems at Maturity Level 2
`E8-MFA-ML2`	Enable Multi-Factor Authentication at Maturity Level 2
`E8-BK-ML1`	Perform Daily Backups at Maturity Level 1
`E8-BK-ML3`	Perform Daily Backups at Maturity Level 3

Policy templates

Written for AUS E8:

Multi-Factor Authentication and Patch Management Policy
Application Control and User Application Hardening Policy
Privileged Access Management and Backup Policy

And 22 from the standard set, adapted to AUS E8.