Regional · Australia

ASD Essential Eight Maturity Model (November 2023)

Attestkeep maps what your cluster's admission control and image scanning recorded in a period to 46 clauses of Australian Signals Directorate, last updated November 2023. 38 are assessed from those records; 8 are marked outside scope, each with the reason.

Create an account How a package is built

What the framework asks

38 clauses a cluster can answer.

Citations and titles as the report prints them. Open a clause to read what it asks, restated close to the instrument's own words.

Essential Eight Maturity Model

Australian Signals Directorate, last updated November 2023

Appendices A to C — the patch applications, patch operating systems and application control strategies at Maturity Levels One, Two and Three

Citation	Clause	Report sections
Maturity Level One, Patch applications (vulnerability scanner)	A vulnerability scanner with an up-to-date vulnerability database A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.	Coverage
Maturity Level One, Patch applications (scanning cadence, online services)	A vulnerability scanner used at least daily on online services A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.	Coverage
Maturity Level One, Patch applications (48 hours, online services)	Critical or exploited vulnerabilities in online services patched within 48 hours Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Control statementCoverageAdmission decisionsOutcomes
Maturity Level One, Patch applications (two weeks, online services)	Non-critical vulnerabilities in online services patched within two weeks Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Control statementClusterCoverageAdmission decisionsOutcomes
Maturity Level One, Patch operating systems (vulnerability scanner)	A vulnerability scanner with an up-to-date vulnerability database A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.	Coverage
Maturity Level One, Patch operating systems (scanning cadence, internet-facing servers)	A vulnerability scanner used at least daily on internet-facing operating systems A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.	Coverage
Maturity Level One, Patch operating systems (48 hours, internet-facing servers)	Critical or exploited vulnerabilities in internet-facing operating systems patched within 48 hours Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Control statementCoverageAdmission decisionsOutcomes
Maturity Level One, Patch operating systems (two weeks, internet-facing servers)	Non-critical vulnerabilities in internet-facing operating systems patched within two weeks Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Control statementClusterCoverageAdmission decisionsOutcomes
Maturity Level One, Patch operating systems (one month, workstations and non-internet-facing servers)	Operating systems of workstations and non-internet-facing servers patched within one month Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release.	Control statementCoverageAdmission decisionsOutcomes
Maturity Level One, Patch operating systems (unsupported operating systems)	Operating systems no longer supported by vendors are replaced Operating systems that are no longer supported by vendors are replaced.	Control statementCoverage
Maturity Level One, Application control (organisation-approved set)	Execution is restricted to an organisation-approved set Application control restricts the execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.	Control statementSupply chainAdmission decisions
Maturity Level Two, Patch applications (vulnerability scanner)	A vulnerability scanner with an up-to-date vulnerability database A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.	Coverage
Maturity Level Two, Patch applications (scanning cadence, online services)	A vulnerability scanner used at least daily on online services A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.	Coverage
Maturity Level Two, Patch applications (48 hours, online services)	Critical or exploited vulnerabilities in online services patched within 48 hours Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Control statementCoverageAdmission decisionsOutcomes
Maturity Level Two, Patch applications (two weeks, online services)	Non-critical vulnerabilities in online services patched within two weeks Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Control statementClusterCoverageAdmission decisionsOutcomes
Maturity Level Two, Patch applications (one month, other applications)	Applications other than the named classes patched within one month Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within one month of release.	Control statementCoverageAdmission decisionsOutcomes
Maturity Level Two, Patch operating systems (vulnerability scanner)	A vulnerability scanner with an up-to-date vulnerability database A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.	Coverage
Maturity Level Two, Patch operating systems (scanning cadence, internet-facing servers)	A vulnerability scanner used at least daily on internet-facing operating systems A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.	Coverage
Maturity Level Two, Patch operating systems (48 hours, internet-facing servers)	Critical or exploited vulnerabilities in internet-facing operating systems patched within 48 hours Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Control statementCoverageAdmission decisionsOutcomes
Maturity Level Two, Patch operating systems (two weeks, internet-facing servers)	Non-critical vulnerabilities in internet-facing operating systems patched within two weeks Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Control statementClusterCoverageAdmission decisionsOutcomes
Maturity Level Two, Patch operating systems (one month, workstations and non-internet-facing servers)	Operating systems of workstations and non-internet-facing servers patched within one month Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release.	Control statementCoverageAdmission decisionsOutcomes
Maturity Level Two, Patch operating systems (unsupported operating systems)	Operating systems no longer supported by vendors are replaced Operating systems that are no longer supported by vendors are replaced.	Control statementCoverage
Maturity Level Two, Application control (organisation-approved set)	Execution is restricted to an organisation-approved set Application control restricts the execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.	Control statementSupply chainAdmission decisions
Maturity Level Two, Application control (event logging)	Allowed and blocked events are centrally logged Allowed and blocked application control events are centrally logged.	Evidence chain
Maturity Level Three, Patch applications (vulnerability scanner)	A vulnerability scanner with an up-to-date vulnerability database A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.	Coverage
Maturity Level Three, Patch applications (scanning cadence, online services)	A vulnerability scanner used at least daily on online services A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.	Coverage
Maturity Level Three, Patch applications (48 hours, online services)	Critical or exploited vulnerabilities in online services patched within 48 hours Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Control statementCoverageAdmission decisionsOutcomes
Maturity Level Three, Patch applications (two weeks, online services)	Non-critical vulnerabilities in online services patched within two weeks Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Control statementClusterCoverageAdmission decisionsOutcomes
Maturity Level Three, Patch applications (one month, other applications)	Applications other than the named classes patched within one month Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within one month of release.	Control statementCoverageAdmission decisionsOutcomes
Maturity Level Three, Patch operating systems (vulnerability scanner)	A vulnerability scanner with an up-to-date vulnerability database A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.	Coverage
Maturity Level Three, Patch operating systems (scanning cadence, internet-facing servers)	A vulnerability scanner used at least daily on internet-facing operating systems A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.	Coverage
Maturity Level Three, Patch operating systems (48 hours, internet-facing servers)	Critical or exploited vulnerabilities in internet-facing operating systems patched within 48 hours Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Control statementCoverageAdmission decisionsOutcomes
Maturity Level Three, Patch operating systems (two weeks, internet-facing servers)	Non-critical vulnerabilities in internet-facing operating systems patched within two weeks Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Control statementClusterCoverageAdmission decisionsOutcomes
Maturity Level Three, Patch operating systems (48 hours, workstations and non-internet-facing servers)	Critical or exploited vulnerabilities in other operating systems patched within 48 hours Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.	Control statementCoverageAdmission decisionsOutcomes
Maturity Level Three, Patch operating systems (one month, workstations and non-internet-facing servers)	Non-critical vulnerabilities in other operating systems patched within one month Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.	Control statementClusterCoverageAdmission decisionsOutcomes
Maturity Level Three, Patch operating systems (unsupported operating systems)	Operating systems no longer supported by vendors are replaced Operating systems that are no longer supported by vendors are replaced.	Control statementCoverage
Maturity Level Three, Application control (organisation-approved set)	Execution is restricted to an organisation-approved set Application control restricts the execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets to an organisation-approved set.	Control statementSupply chainAdmission decisions
Maturity Level Three, Application control (event logging)	Allowed and blocked events are centrally logged Allowed and blocked application control events are centrally logged.	Evidence chain

8 clauses marked outside scope, and why

Citation	Clause and reason
Maturity Level One, Patch applications (unsupported online services)	Online services no longer supported by vendors are removed nothing in this control holds vendor support dates for the application software inside an image: the inventory records which components and versions are running and the findings standing against them, but no signal marks an application as past vendor support and admission refuses none on that ground. The operating-system twin of this limb is answered under Patch operating systems, because a scan does record whether an image's base operating system is past end of support
Maturity Level Two, Patch applications (unsupported online services)	Online services no longer supported by vendors are removed nothing in this control holds vendor support dates for the application software inside an image: the inventory records which components and versions are running and the findings standing against them, but no signal marks an application as past vendor support and admission refuses none on that ground. The operating-system twin of this limb is answered under Patch operating systems, because a scan does record whether an image's base operating system is past end of support
Maturity Level Three, Patch applications (unsupported online services)	Online services no longer supported by vendors are removed nothing in this control holds vendor support dates for the application software inside an image: the inventory records which components and versions are running and the findings standing against them, but no signal marks an application as past vendor support and admission refuses none on that ground. The operating-system twin of this limb is answered under Patch operating systems, because a scan does record whether an image's base operating system is past end of support
Maturity Levels One to Three, Restrict Microsoft Office macros	Restrict Microsoft Office macros these settings are applied to the Microsoft Office installations on an organisation's workstations, and a container admission decision meets none of them; naming the strategy here is so that a reader looking for it sees where this document stops rather than assuming it was covered
Maturity Levels One to Three, User application hardening	User application hardening the applications this strategy hardens are the browsers, office suites and PDF readers a person uses on a workstation; the workload hardening this control applies at admission is a different thing on a different system and is reported against the frameworks that ask for it, not borrowed for this one
Maturity Levels One to Three, Restrict administrative privileges	Restrict administrative privileges who holds administrative rights over the organisation's systems, and what those accounts may reach, is decided in its identity and endpoint management; this control has its own roles and its own log of who changed what in it, and that is not the estate-wide statement the strategy asks for
Maturity Levels One to Three, Multi-factor authentication	Multi-factor authentication the services this strategy covers are the organisation's own and its third parties', and the factors are configured in the identity provider behind them; this control can federate its own administrative access to a directory, which says nothing about how that directory authenticates anybody
Maturity Levels One to Three, Regular backups	Regular backups backup and restoration are operations on the organisation's data and systems, performed and tested outside this cluster; an admission control decides what may run and holds no copy of anything to restore

What Attestkeep produces

Evidence from records the cluster already keeps.

Nothing is filled in by hand. Each clause's answer carries a status (met, partial, gap or outside scope), a note with the period's own numbers, and the report sections those numbers come from.

Statements the mapping draws on

Each assessed clause is answered by one or more of these statements about the period's records. The same statement answers the same question under every framework, so two reports for one period cannot disagree.

Images carrying severe findings are refused18 clauses
Admission refuses non-compliant workloads14 clauses
Every image in the inventory carries a scan record12 clauses
Findings are matched against a national catalogue of exploited vulnerabilities7 clauses
Critical findings, and findings with a working exploit, carry a window of no more than 48 hours7 clauses
Findings below critical carry a remediation window of no more than two weeks6 clauses
Images are scanned as an authenticated pull with the workload's own credentials6 clauses
Critical findings carry a remediation window of no more than one month5 clauses
Images whose base OS is past end of support are refused3 clauses
Only images of established provenance may run3 clauses
Images may enter only from named registries3 clauses
Every decision and administrative action is recorded2 clauses

The package

What the report contains.

Every package carries the same sections, whatever the framework. The ones marked are those Essential Eight answers cite, with the number of clauses citing each.

The scope paragraph, as the report states it.

This document reports what one Kubernetes cluster's admission control and image scanning recorded during the period, mapped onto the Australian Signals Directorate's Essential Eight Maturity Model of November 2023. The Essential Eight is a maturity model for an organisation's whole internet-connected estate — workstations, servers, network devices, office productivity suites, the identity system, the backup regime — and an organisation implements a target maturity level across all eight mitigation strategies. Nothing here assesses that implementation and nothing here establishes a maturity level: the model is assessed against the organisation, by the organisation or by a party it engages, and this cluster is one system inside it. What the period's records support is part of three of the eight strategies, and only for the software inside container images: Patch applications, Patch operating systems, and the one limb of Application control with a cluster analogue — restricting execution to an organisation-approved set, which here means refusing an image from a registry the policy does not name, an unsigned image, or one no trusted builder vouches for. Where a level states one window for internet-facing servers and a longer one for workstations and non-internet-facing servers, the stricter limb is the one mapped, because a cluster does not know which of its workloads are reachable from the internet. The remaining five strategies — restrict Microsoft Office macros, user application hardening, restrict administrative privileges, multi-factor authentication and regular backups — are named below and marked outside what a cluster observes, so a reader looking for them finds them rather than an absence. The limbs about automated asset discovery, drivers and firmware, Microsoft's recommended blocklists, the locations application control is implemented on, and the annual validation of application control rulesets are not mapped at all.

Questions

About Essential Eight and Attestkeep

Is this a Essential Eight certification?

No. The package is evidence produced from your cluster's own records. It is not a certification, and no auditor is obliged to accept it. The scope paragraph on this page is the one the report itself carries.

Why are 8 of the clauses outside scope?

They ask about things one cluster's admission and scanning records cannot show. They are listed with the reason rather than left out, so whoever reads the report can see the gap is deliberate.

Which plan includes Essential Eight?

Every plan can report against it. Community and Team include one framework of your choice, Business three, Enterprise every one. Prices are on the pricing page.

How does an auditor check the package?

In a browser at attestkeep.com/verify.html, where nothing is uploaded, or with the short script on the documentation site. Neither needs us. For auditors has the details.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account