Standards
ASD Essentials and the Essential Eight.
In October 2026 ASD evolved the Essential Eight into ASD Essentials, which rates each action by assessment, domain by domain. Here is what our software does for each action that applies to it in your estate.
| Principle | How our software meets it |
|---|---|
| Supplier cyber security assurance (GOV-11) | These pages, the cryptographic register and the datasheets: your assurance evidence, reissued with each release. |
| Cyber supply chain security (PRO-16) | Every release signed by a key that never leaves AWS KMS, and verified by your installed system before it is unpacked. |
| Secure system lifecycle (PRO-01) | One network listener; the engine listens only on the local host; report only by default; no default credentials. |
| Identity, credential and access management (PRO-13) | No default accounts. Secrets sealed in an encrypted store; session tokens and keys kept only as hashes. Multi-factor sign-in for administrators. |
| Least privilege access (PRO-12) | Roles and capabilities enforced by the engine itself; a revoked capability fails on the very next request. |
| Secure administration (PRO-05) | Every administrative action recorded, with who, when and what, in a tamper-evident log. |
| Trustworthy software (PRO-07) | Signed binaries at a fixed install path, ready for your application control; the engine runs only after verification. |
| Network segmentation (PRO-18) | Nothing outbound unless you declare it, over TLS 1.3 to a declared trust list or a pinned key. |
| Centralised event logging (DET-01) | Events delivered to your log platform by signed webhook, REST or email; any edit to the audit log shows. |
Where it sits in your program
The software works at your web front door, the Boundary services domain, and sees sign-in traffic there, which touches Identity services: the two domains ASD puts first, in priority phase 1. It also serves the Visibility and response capability, which runs across every phase: it learns what normal looks like for your own systems and records the evidence behind every block.
The Essential Eight crosswalk
Contracts, panels and the PSPF still cite the Essential Eight during the transition, so here it is strategy by strategy. Application control: signed binaries at fixed paths. Patch applications: fixes ship as signed releases at no charge. Restrict administrative privileges: roles enforced by the engine, every privileged action audited. Multi-factor authentication: required for every privileged account. User application hardening: the console sends a content security policy and refuses framing. Office macros, operating system patching and backups belong to your environment; the learned data is an encrypted store you can back up, under a key you hold.
Download the ASD Essentials datasheet (PDF), with every action and its status. Phishing-resistant sign-in and a SIEM-ready event format are on the assurance roadmap.