An Essential Eight checklist should give you one question and one piece of evidence for each of the eight mitigation strategies, so you can show an insurer, auditor or customer where you stand within a working day. This is that list, control by control.
Sooner or later someone asks where you stand on the Essential Eight: an insurer at renewal, a government buyer running due diligence, an enterprise customer with a security questionnaire and a deadline. The organisations that handle the question well are usually the ones with the evidence already assembled, whatever their security budget.
How to use it: if you cannot produce the evidence within a working day, treat the control as unproven, whatever the policy document says. Our Essential Eight uplift guide goes deeper, including how to sequence the fixes, and an Essential Eight assessment tests every item on this list for you.
The question: can an unapproved executable run on a standard workstation?
Evidence to hold: log output from an attempted execution in a user-writable path, dated within the last quarter. If you are still in audit mode, hold the inventory report instead and say so. Assessors give more credit to audit mode with a date attached than to enforcement claims without logs.
The question: how many days did your last three critical application patches take, from disclosure to deployed?
Evidence to hold: deployment records with dates. The patching policy on its own does not count. The gap between a stated 48-hour window and an observed six weeks is the single most common finding in first assessments, and insurers now check at claim time instead of taking the questionnaire on trust.
The question: is every operating system in the estate still vendor-supported?
Evidence to hold: a current inventory listing OS version and support status per host, including the internet-facing systems that sit outside the standard patch group. If an unsupported server has to stay, record it with a risk acceptance signed by someone senior. A known and accepted risk is treated very differently from one the assessor discovers.
The question: can a user open and run a macro-enabled document received from outside?
Evidence to hold: the result of a test send from an external address to a standard mailbox. If a department holds a macro exception for a legacy workbook, hold the scope of that exception too. A blanket exception written to accommodate one team is a common way this control fails.
The question: is hardening applied to every device, or just the standard build?
Evidence to hold: an applied-policy comparison across device groups, including executive laptops and anything inherited through an acquisition. This is cheap configuration work and it is often half-done, with the gaps sitting on the devices outside the standard build.
The question: who holds privileged access, and is every entry a current person or process?
Evidence to hold: a full privileged account export with a named, current owner against each entry. The first full audit typically finds several times more admin accounts than anyone expected, many of them belonging to people and processes that no longer exist.
The question: which authentication paths accept a password alone from an unmanaged device?
Evidence to hold: external test results covering every path you can find, including legacy webmail, service accounts with exemptions, and VPN fallback behaviour. MFA is assessed on coverage, so a strong implementation can still fail an assessment on one forgotten endpoint.
The question: how long does a full restore take, and has anyone done one?
Evidence to hold: a timed restoration record with sign-off from the business owner of the process. Assessors give credit for tested restoration, and retention alone does not count. If a full restore takes eleven days, the business needs to know that before an incident starts.
First, know your maturity level and be able to say why. The model scores you at your weakest control, and each level has specific requirements. Our explainer on the Essential Eight maturity model covers how the scoring works.
Second, put a date on everything. Evidence ages, and a privileged access export from eighteen months ago will not be accepted as current. The organisations that hold their level run a light quarterly self-check against this list and an independent re-assessment annually or after major change. For what insurers check in particular, see what insurers and auditors expect from the Essential Eight.
All eight mitigation strategies, with a question that tests whether each control operates and the dated evidence that answers it. Assessors look for proof the control works, so a list of policies is not enough.
Dated records of the control operating: execution logs, patch deployment records, test results, privileged account exports and timed restore records. A policy document on its own counts as a gap.
A light self-check every quarter, plus an independent re-assessment once a year or after a major change to the environment.
Most private companies have no legal obligation to implement it. Insurers, enterprise customers and government buyers increasingly ask about it, so many organisations treat it as a commercial requirement.
Any answer on this checklist that begins "we have a policy that" is a gap. If you have more gaps than you expected, that is normal, and they can be fixed in a defined order. Our Essential Eight assessment scores the controls running in your environment, and our Essential Eight uplift work closes the gaps it finds. A practitioner from our cyber security practice replies within one business day.