What Essential Eight is
The Australian Cyber Security Centre’s eight mitigation strategies.
Who asks for it: Australian organisations and ACSC-aligned MSPs.
What Microsoft 365 can show
3 strategies evidenced by 17 checks. A check maps to a strategy only where its result is genuine evidence for it, so a strategy is listed only when a tenant setting can show it.
Outside Microsoft 365
Application control, patching applications, macro settings and backups are largely enforced on devices.
Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.
Every strategy and the checks behind it
The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.
| Strategy | Checks that evidence it |
|---|---|
| Multi-factor authentication |
|
| Patch operating systems | |
| Restrict administrative privileges |
Related frameworks
- Microsoft Cloud Security Benchmark: Microsoft’s own baseline for securing its cloud services.
- Zero Trust: Microsoft’s Zero Trust deployment pillars, from identities to data.
- Microsoft Secure Score: Microsoft’s own score for a tenant, read beside the checks.
- PCI DSS 4.0.1: The card industry’s data security standard.