ACSC Essential Eight
ActiveSpecialized framework
Best for: Australian government agencies subject to the Protective Security Policy Framework (PSPF) must implement the Essential Eight. The ACSC recommends it for all Australian businesses, especially critical infrastructure sectors under the Security of Critical Infrastructure Act 2018 (SOCI Act). Organizations reporting to the Australian Signals Directorate or undergoing ACSC assessments should treat it as a baseline.
| Mandatory? | Mandatory for PSPF-covered AU gov entities; recommended for all |
|---|---|
| Who validates? | Self-assessment against Maturity Model; optional third-party |
| Renewal | At least annually |
| Scope | Eight mitigation strategies for all Australian organizations |
| Governing body | Australian Cyber Security Centre (ACSC), part of the Australian Signals Directorate (ASD), Essential Eight (Nov 2023 update). Official source |
Get started
Point the module source at the ACSC Essential Eight endpoint and pin a version range you reviewed:
module "..." {
source = "acscessentialeight.compliance.tf/terraform-aws-modules/<module>/aws"
version = "<version>"
}acscessentialeight.compliance.tf lists every ACSC Essential Eight module with its versions, inputs and outputs.
What compliance.tf covers and what you handle
| Area | Compliance.tf automates | You handle |
|---|---|---|
| Regular Backups | Validates AWS Backup plan retention periods (minimum 35 days), recovery point encryption, and deletion protection. Detects backup vaults without manual deletion locks. | Testing backup restoration procedures, documenting Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), and verifying that backups are stored offline or in an isolated account for Maturity Level 3 compliance. |
| Audit Logging | Covers CloudTrail enablement across all regions, S3 data event logging, API Gateway stage logging, AppSync field-level logging, and CloudFront access log configuration, including CloudTrail integration with CloudWatch Logs. | Defining log retention policies aligned to your maturity level target, configuring SIEM ingestion, and establishing alert triage workflows for security-relevant events. |
| Log Integrity | Checks that CloudTrail log file validation is enabled, trail logs are encrypted with KMS CMKs, and CloudWatch alarms have associated actions configured. | Periodic review of CloudTrail digest files, KMS key rotation schedules, and incident response procedures triggered by CloudWatch alarm actions. |
| Administrative Privilege Restriction | Checks that AWS accounts belong to AWS Organizations for centralized policy enforcement. Detects CodeBuild projects running in privileged mode and publicly accessible CloudTrail S3 buckets. | Implementing least-privilege IAM policies, separating privileged and unprivileged accounts, running periodic access reviews, and enforcing multi-factor authentication for all privileged users. |
| Encryption at Rest | Validates encryption for backup recovery points and CloudTrail logs using KMS CMKs. Detects unencrypted data stores relevant to the backups and logging controls in scope. | Defining a key management policy, assigning key administrators, and ensuring CMK access policies follow least-privilege principles. |
Controls by category
42 of 65 mapped controls are Enforced by compliance.tf modules at terraform plan. The other 23 are Mapped only: ACSC Essential Eight lists them, no compliance.tf module checks them.
Audit and Accountability Logging
Comprehensive logging underpins detection across all eight strategies, so assessors check coverage gaps first. Expect scrutiny on CloudTrail multi-region enablement, S3 data event capture, and API Gateway and AppSync logging; application-layer audit trails are the most frequently missed. At Maturity Level 3, the ACSC expects logs flowing into a centralized analysis platform with alerting on indicators of compromise.
Log Integrity and Protection
Log file validation and KMS encryption together prevent an attacker from covering tracks after a compromise. Assessors will ask whether digest files are actually checked during incident response, not just that validation is toggled on. A CloudWatch alarm with no configured action is a finding; it signals that the organization is collecting data but not acting on it.
Regular Backups
Deletion locks on backup vaults are the first check; without them, ransomware can wipe recovery points before a response team engages. Maturity Level 2 and above also require recovery point encryption and documented, tested restoration procedures.
| Control | Status |
|---|---|
| Backup plan rules should retain recovery points for at least 35 days | Mapped |
Restrict Administrative Privileges
Publicly accessible CloudTrail buckets and CodeBuild projects running in privileged mode are immediate findings. AWS Organizations membership demonstrates centralized governance; at Maturity Level 1, the ACSC expects privileged accounts are not used for everyday tasks, which in cloud environments means least-privilege service role configurations across all service principals.
| Control | Status |
|---|---|
| CodeBuild projects should not have privileged mode enabled | Mapped |
Additional controls (53)
AWS Database Migration Service (1)
| Control | Status |
|---|---|
| DMS replication instances should not be publicly accessible | Enforced |
AWS Lambda (1)
| Control | Status |
|---|---|
| Lambda functions should use latest runtimes | Enforced |
AWS Step Functions (1)
| Control | Status |
|---|---|
| Step Functions state machines should have logging enabled | Enforced |
AWS WAF (1)
| Control | Status |
|---|---|
| WAFv2 rules should have CloudWatch metrics enabled | Enforced |
Amazon CloudWatch Logs (1)
| Control | Status |
|---|---|
| Log groups should have encryption at rest enabled | Enforced |
Amazon DocumentDB (1)
| Control | Status |
|---|---|
| DocumentDB clusters should have an adequate backup retention period | Mapped |
Amazon DynamoDB (1)
| Control | Status |
|---|---|
| DynamoDB tables should have point-in-time recovery enabled | Enforced |
Amazon EC2 (3)
Amazon ECR (1)
| Control | Status |
|---|---|
| ECR repositories should have image scan on push enabled | Enforced |
Amazon ECS (1)
| Control | Status |
|---|---|
| ECS fargate services should run on the latest fargate platform version | Enforced |
Amazon EFS (2)
| Control | Status |
|---|---|
| EFS access points should enforce a root directory | Enforced |
| EFS access points should enforce a user identity | Mapped |
Amazon EKS (1)
| Control | Status |
|---|---|
| EKS clusters should have control plane audit logging enabled | Enforced |
Amazon ElastiCache (1)
Amazon Neptune (3)
Amazon OpenSearch Service (3)
Amazon RDS (8)
Amazon Redshift (5)
Amazon S3 (11)
Amazon SageMaker (2)
Elastic Load Balancing (2)
Other (3)
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| PCI DSS v4.0 | High 98% | |
| NIST Cybersecurity Framework v1.1 | High 78% | |
| NIST Cybersecurity Framework v2.0 | High 68% |
Frequently asked questions
Does the Essential Eight apply to my organization if we are not an Australian government entity?
The ACSC recommends the Essential Eight for all Australian organizations, but the mandate applies only to non-corporate Commonwealth entities under the PSPF. Organizations covered by the SOCI Act (critical infrastructure) face increasing pressure to adopt it. If you operate in Australia and handle sensitive data or provide essential services, treat it as a de facto requirement. Outside Australia, it is a practical baseline but carries no regulatory weight.
What maturity level should we target?
Target the same maturity level across all eight strategies. Reaching Level 3 in some while sitting at Level 0 in others is explicitly what the ACSC advises against. Most organizations start at Maturity Level 1. Government entities handling sensitive or classified information are expected to reach Maturity Level 2 or 3. Your target depends on your threat profile, which the ACSC outlines in the Maturity Model documentation.
How does the Essential Eight relate to the ASD Information Security Manual (ISM)?
The Essential Eight is a prioritized subset of the ISM. The ISM contains over 800 controls covering the full spectrum of information security. The Essential Eight extracts the eight mitigation strategies that the ACSC considers most effective against commodity and targeted cyber threats. Compliance at Maturity Level 3 covers a meaningful portion of the ISM's technical controls, but does not satisfy the ISM in full.
How do the controls compliance.tf maps here relate to the eight strategies?
The mapped controls primarily address 'Regular Backups' and 'Restrict Administrative Privileges' directly, with extensive coverage of audit logging requirements that support detection across all strategies. Strategies like 'Patch Applications,' 'Patch Operating Systems,' and 'Configure Microsoft Office Macro Settings' require endpoint management tools (WSUS, SCCM, Intune) and are not measurable through AWS resource configuration checks.
Is there a formal certification for the Essential Eight?
No. Organizations self-assess their maturity level against the Essential Eight Maturity Model, and government entities report through internal governance channels. Some engage external assessors for independent validation, but this is voluntary. The ACSC may conduct assessments of Commonwealth entities directly.