Essential Eight and the Essentials series

Phase 1 covers two domains: boundary services and identity services. ASD places these first because they control how users and traffic reach everything else in the environment. A weak boundary or identity layer undermines the controls assessed in later phases, so assessors usually expect these domains to be well documented before others are reviewed in depth.

• Boundary services: Evidence of how traffic enters and leaves the environment, such as firewall rule reviews, remote access paths and the logs that show they are monitored.
• Identity services: Evidence of how accounts are created, authenticated and removed, including directory configuration and the controls that match Essential Eight multi-factor authentication.
• Action-level indicators: Each action carries indicators at not effective, partially effective and fully effective, so record which level your evidence supports for each action.
• Domain-specific proof: A firewall review does not prove identity controls, and a directory review does not prove boundary controls. Collect evidence for each domain separately.
• Shared services: If one identity platform serves both domains, document its role in each, because it may need different evidence for each.

Before assessment, confirm with your assessor which evidence they will accept for each action and whether they expect the phase 1 domains to be tested first.

Phase 2 covers critical processes and services, and privileged environments. These domains depend on phase 1, because privileged access and critical services rely on the boundary and identity controls already in place. Organizations usually assess them once phase 1 evidence is stable, since weaknesses in identity often surface here as privileged access gaps.

• Critical processes and services: Evidence that the organization has identified the services that matter most, their dependencies and how they are protected and recovered.
• Privileged environments: Evidence of how administrative access is limited, separated, logged and reviewed, which connects to the Essential Eight restrict administrative privileges strategy.
• Dependency mapping: Show how a critical service relies on boundary and identity controls, and point to the phase 1 evidence rather than repeating it.
• Domain-level testing: Privileged access controls that pass in the identity domain still need their own evidence in the privileged environments domain.
• Recovery evidence: Records of tested restores or failover for critical services, where the action requires them.

Confirm with your assessor how they will sample privileged accounts and critical services, since the sample size and method determine how much evidence you must prepare.

Phase 3 covers four domains: business systems, user devices, governance and culture, and visibility and response. These are assessed last, but they are not optional and they are not covered by controls assessed earlier. Business systems and user devices each need their own evidence, and governance and culture includes actions such as executive accountability and security awareness training that extend beyond the eight Essential Eight strategies.

• Business systems: Evidence for the applications the business runs, including patching, access and logging for each system in scope.
• User devices: Evidence of endpoint configuration, application control and hardening, mapped to the matching Essential Eight strategies where they apply.
• Governance and culture: Evidence such as accountability records, policies, training completion and supplier assurance, which many organizations hold outside security teams.
• Visibility and response: Evidence of logging, detection and incident response, including whether alerts are reviewed and acted on.
• Separate proof per domain: A device hardening record does not show that business systems are patched, so each domain needs its own evidence set.

Before assessment, ask your assessor how they will weight phase 3 domains and whether they require evidence from business owners outside IT.

E4EIT assesses actions per domain rather than across the whole organization. ASD's mapping notes say that a set of controls effective for one domain does not automatically prove effectiveness in another. An organization that has strong controls in its corporate network can still fall short in an operational or business domain, so the assessment has to test each domain with its own evidence.

• No automatic inheritance: Controls proven in one domain do not carry over to another, even if they use the same tools.
• Mapped frameworks as pointers: ASD's mapping collection lists frameworks such as the Essential Eight and ISM where supporting evidence may already exist, but these references show where evidence may exist and do not define the controls required.
• Evidence per action: Track which evidence supports which action in each domain, with a date and an owner.
• Scope decisions: Record which systems belong to each domain and why, since unclear boundaries are a common source of gaps.
• Reuse with care: You can reuse evidence across domains only where the assessor agrees it applies.

Ask your assessor to confirm the domain boundaries and the evidence they accept before you start collecting.