ASD Essential Eight — Level 2
107 published statements across eight mitigation strategies for target maturity level 2
All available frameworksWhat the app checks
Technical checks run for the selected scope, available connectors and credentials. Results provide evidence for review; missing data is not a pass.
Explicit requirement-to-test mappings
| Requirement | Collector / test | What it checks or supports |
|---|---|---|
| ML2-PA-01 | WINDOWS / WIN-INVENTORY-COVERAGE-001 | Supporting observation only. Independently verify target-level time limits, population, enforcement, approved exceptions or CAF essential-function context and expert conclusion. No maturity or CAF achievement rating from a scan. |
| ML2-PA-02 | VULN / VULN-IMPORT-001 | Supporting observation only. Independently verify target-level time limits, population, enforcement, approved exceptions or CAF essential-function context and expert conclusion. No maturity or CAF achievement rating from a scan. |
| ML2-PO-05 | WINDOWS / WIN-PATCH-FRESHNESS-001 | Supporting observation only. Independently verify target-level time limits, population, enforcement, approved exceptions or CAF essential-function context and expert conclusion. No maturity or CAF achievement rating from a scan. |
| ML2-MF-01 | ENTRA / ENTRA-MFA-REG-001 | Supporting observation only. Independently verify target-level time limits, population, enforcement, approved exceptions or CAF essential-function context and expert conclusion. No maturity or CAF achievement rating from a scan. |
| ML2-AP-01 | ADSEC / AD-PRIV-001 | Supporting observation only. Independently verify target-level time limits, population, enforcement, approved exceptions or CAF essential-function context and expert conclusion. No maturity or CAF achievement rating from a scan. |
| ML2-RB-01 | BACKUP / VEEAM-REPO-001 | Supporting observation only. Independently verify target-level time limits, population, enforcement, approved exceptions or CAF essential-function context and expert conclusion. No maturity or CAF achievement rating from a scan. |
What requires manual review
Confirm scope and applicability, review the requirement guidance, collect policies and records, conduct interviews or observations where needed, and assess evidence relevance and freshness. Record owners, rationale, workpaper conclusions and remediation. An assessor makes the final decision; a technical pass does not approve the whole framework.
Target-level evidence preparation; no automatic maturity rating or certification. Approved exceptions and compensating measures require independent review. ITAF statement identifiers are not official ASD identifiers. Adapted from ASD Essential Eight maturity model (November 2023), Commonwealth of Australia 2023, CC BY 4.0: https://creativecommons.org/licenses/by/4.0/. Text reformatted; ITAF identifiers, evidence actions and scan mappings added. No ASD endorsement.
Where it is available
This preparation framework is listed in the C32 Professional/MSP application catalog. Free retains its ISO assessment limits. Availability of a framework is separate from the extent of automated scanning.
Coverage shown here comes from the application’s C32 requirement and mapping catalogs.