Essential Eight vs NIST CSF

Essential Eight or NIST CSF: which should an organization pursue first?

Choose the Essential Eight when the question from regulators, customers or the board is whether specific technical mitigations are in place and how mature each one is. Choose the NIST CSF when the question is whether cybersecurity risk is governed, measured and improved across the whole organization. Pursue both when a single mapped evidence set can answer each audience, which is the situation ASD's own mapping collection is designed to support. Neither produces a certificate: ASD does not issue one for the Essential Eight, and NIST states that it offers no certifications or endorsements for CSF implementations and has no plans for a conformity assessment program. Your evidence will be judged by whoever asks for it, so the first decision is who that is.

Three factors should drive the order. Jurisdiction comes first: if you operate in Australia or supply Australian government, the Essential Eight is the baseline your customers are most likely to recognize, while U.S. federal agencies have made the CSF mandatory under a 2017 executive order (NIST CSF FAQs). Customer demands come second: ask your largest customers and prospects which framework they cite in questionnaires, because some companies require the CSF of customers or suppliers and others will ask for maturity-level evidence. Existing controls come third: if your patching, MFA, privileged access and backup practices are already strong but undocumented, the Essential Eight gives you a fast, technical way to evidence them, while a CSF program is more useful when governance and risk management are the gaps.

Before committing, confirm three things with the party that will read your evidence: whether they expect a named framework or accept a mapping, what proof format they want (a maturity assessment, a documented profile or a third-party report), and whether they will accept mapped evidence across both. The official CSF 2.0 Core covers six Functions and 106 Subcategories, and its Tiers describe governance rigor rather than pass or fail. Start with an inventory of what you already evidence, then map it, so that you do not build two parallel programs. DeployOpen can help plan and document that evidence set as a fixed-scope engagement, but the scope, the mapping and the choice of framework should be confirmed in writing with your own stakeholders first.

How the Essential Eight and NIST CSF 2.0 differ on scope, structure and proof

This table compares the Essential Eight and NIST CSF 2.0 on publisher, audience, structure, assessment, evidence, update cadence and mandate. Read each row as a question about what you must produce and who checks it, since the two frameworks answer those questions differently.

Factor	Essential Eight	NIST CSF 2.0
Publisher	Australian Signals Directorate, published through the Australian Cyber Security Centre	National Institute of Standards and Technology (NIST), a U.S. agency that is not a regulator
Intended users	Organizations that want a prescriptive technical baseline, with Australian government and suppliers the primary audience	All organizations regardless of size, sector or maturity, following the 2024 broadening from critical infrastructure
Structure	Eight mitigation strategies, each assessed against Maturity Levels Zero to Three	Six Functions (Govern, Identify, Protect, Detect, Respond, Recover), 22 Categories and 106 Subcategories, plus Organizational Profiles and Tiers
Certification or conformity assessment	None from ASD. Maturity is evidenced through assessment of each strategy against the model	None from NIST, which has no plans for a conformity assessment program
Evidence it produces	Evidence that each strategy is implemented and effective at the chosen maturity level	A Current and Target Profile and a Tier judgment on risk governance, with no pass or fail result
Update cadence	Maturity model dated November 2023, with ISM and Essentials mappings updated more often	CSF 2.0 Core has had no revision since its February 2024 release, while Quick-Start Guides and mappings are added online
Mandatory status	Voluntary as a framework, though specific Australian government requirements may reference it (confirm with the relevant agency)	Voluntary for most organizations, though a 2017 executive order mandates it for U.S. federal agencies and some customers require it

Who requires each framework, and where the requirement comes from

The Essential Eight is ASD guidance that most organizations adopt because a government customer, a regulator or a contract asks for it, and in Australia it is the reference point for many public sector buyers and their suppliers. The CSF has a different origin. NIST describes it as voluntary for most organizations, although some companies require it of their customers or suppliers, and a 2017 executive order made it mandatory for U.S. federal agencies. Neither framework is a certification scheme. ASD publishes no certificate for the Essential Eight, and NIST states that it does not offer certifications or endorsements of CSF implementations and has no plans for a conformity assessment program. So the question for your team is not whether you are certified against either one, but which document creates the obligation and what it asks you to show.

Start by reading the requirement itself. Look for the framework name, the maturity level or tier expected, the scope (which systems, business units or suppliers), and the evidence the counterparty will accept. A tender for Australian government work may name an Essential Eight maturity level. A U.S. federal contract may reference the CSF in a statement of work. A customer security questionnaire may ask for a self-assessed tier or a yes or no answer per strategy. Each of these creates a different expectation, and a sentence in a questionnaire does not always mean the same thing as a clause in a contract. Ask the buyer to confirm in writing which framework, version and level applies, and whether they expect a self-assessment, an independent review or a supporting report.

Keep the answer on file. When the requirement comes from a contract, record the clause number and the date the buyer confirmed it. When it comes from a regulator, record the regulator's name and the instrument it relies on, and check whether that instrument uses the framework as a reference or as a binding standard. Where a requirement is unclear, treat the written answer from the buyer or regulator as the source of truth, not a summary in a vendor's marketing or a secondary guide. This record tells you which framework must be evidenced first and prevents you from building a program around a requirement nobody actually imposed.

Which framework fits which situation

Essential Eight matters most for Australian organizations whose customers, regulators or government agencies ask for a maturity level measured against ASD's model. The Essential Eight has no ASD certificate, so the practical question is which maturity level and which evidence the requester expects. CSF 2.0 becomes relevant when a customer or multinational parent asks for mapping to a U.S.-origin outcome framework, and ASD's mapping collection gives a starting point for that conversation.

The target level: Confirm whether the requirement names Maturity Level One, Two or Three, and whether it applies to all eight strategies.
The evidence source: The E4EIT OSCAL repository includes the Assessment evidence guide for enterprise IT v2026.10.15, published 15 October 2026, which lists the Essential Eight and CSF 2.0 as places where evidence may already exist.
The status of mappings: ASD says its referenced frameworks indicate where evidence of an action's effectiveness may exist and are not intended to define the controls required to meet an action.
The report format: Ask who performs the assessment and what document they expect, since the output is an assessment against the maturity model rather than a certificate.

Check with the agency or customer whether an Essential Eight assessment satisfies the request on its own, or whether they also want a CSF mapping.

What Maturity Levels and CSF Tiers measure, and why they are not interchangeable

Essential Eight maturity levels and CSF Tiers both sound like a scale of how well an organization is doing, but they measure different things at different scopes. The cards below separate what each measure rates, what evidence it needs, and which artifacts must not be read as a score on the other.

Essential Eight maturity levels

Maturity Levels Zero to Three are set for each of the eight mitigation strategies, so an organization can be at one level for multi-factor authentication and another for backups. Each level targets increasingly capable adversary tradecraft, and ASD assesses implementation and effectiveness against the model. Check that a stated level names the strategy it applies to, because a single headline level hides gaps across the eight. The model has no ASD certificate attached to it.

CSF Tiers of risk governance

CSF Tiers are Partial, Risk Informed, Repeatable and Adaptive. They describe how rigorously an organization governs and manages cybersecurity risk, moving from informal, ad hoc response toward agile, continuously improving practice. A Tier does not rate whether a specific technical control, such as patching or MFA, is in place. Ask whether a Tier claim is supported by documented risk decisions and repeatable processes rather than by a single self-assessment.

CSF Current and Target Profiles

A CSF Profile records outcomes an organization has achieved (Current) and intends to achieve (Target) across the Core. The gap between them becomes a prioritized improvement plan that the organization owns. A Current Profile is a self-described statement of outcomes, not an ASD assessment or an independent check of any Essential Eight strategy. Ask who wrote it, what evidence backs each outcome, and whether the Target reflects real risk decisions.

The E4EIT catalog of actions

ASD's Essentials series organizes enterprise IT guidance into 28 principles across five functions (Govern, Identify, Protect, Detect, Respond) and 58 actions. These are specific, checkable activities, closer in grain to Essential Eight strategies than to CSF Categories. The mapping collection notes that referenced frameworks show where evidence of an action may exist, and does not define the controls needed to meet it. Confirm which catalog version your assessor uses before comparing counts.

What ASD's Essentials series and its mapping to CSF 2.0 actually show

ASD's mapping collection shows where evidence for an Essential Eight action may already exist, and it does not tell you which NIST CSF 2.0 subcategories you must meet. The Assessment evidence guide for enterprise IT, version 2026.10.15, was published on 15 October 2026 as the first chapter of the Essentials series and is available in OSCAL. Its mapping collection references the Essential Eight (dated 02 Oct 2024) alongside the ISM v2026.09.4, NIST CSF 2.0 and NIST SP 800-171r3. ASD is explicit that these referenced frameworks indicate where evidence of an action's effectiveness may exist, and that they are not intended to define the controls required to meet the action. Treat the collection as a map of where to look for proof, not as a crosswalk you can certify against.

Before you use the CSF 2.0 entries, confirm what the mapping covers in your own environment. Pull the OSCAL files from the ASD mirror of the E4EIT OSCAL repository, then check which CSF 2.0 subcategories each Essential Eight action points to. For each one, ask whether the evidence named (configuration exports, patch reports, backup restore tests, privileged account reviews) already exists and is kept current. Note that the CSF side of the link is a NIST informative reference, and NIST does not check the correctness of non-NIST mappings and does not endorse them. Any mapping you rely on is one you must verify yourself, and an auditor or a regulator will ask how you verified it.

The practical decision is therefore about evidence ownership. Assign each mapped CSF subcategory to an owner who can show the Essential Eight evidence behind it, and record where a subcategory has no Essential Eight action behind it at all, such as governance or supplier risk. Those gaps stay on your CSF Target Profile work even when the Essentials mapping looks complete. If your organization is outside Australia, confirm with your customers or regulator whether they accept evidence organized this way, since ASD's material is written for Australian government and does not carry CSF 2.0 authority.

Where the work overlaps, and where it does not

Essential Eight and the NIST CSF both appear in official mapping collections that point to where evidence may already exist. Those pointers are a starting place for shared evidence, not proof that one framework satisfies the other.

Shared evidence pointers

ASD's E4EIT mapping collection lists both the Essential Eight and NIST CSF 2.0 as frameworks where supporting evidence for an action may already exist. ASD states that these references indicate where evidence of effectiveness may exist and do not define the controls required to meet an action. Use them to find reusable evidence, then confirm each mapped item against your own environment before you claim coverage.

Large CSF reference library

NIST's CSF 2.0 Reference Tool export lists 363 Implementation Examples and informative references to standards including ISO/IEC 27001:2022, SP 800-53 Rev. 5.2.0 and CIS Controls v8.1. Those references are developed by NIST and non-NIST entities, and NIST does not check the correctness of non-NIST mappings. Treat each reference as a lead to test, not a finished crosswalk to the Essential Eight.

CIS Navigator as a bridge

The CIS Controls Navigator for v8.1 maps CIS Controls to NIST CSF 2.0 and to other frameworks, so it can serve as an intermediate step when you trace Essential Eight work into CSF categories. Because CIS mappings and ASD mappings are built separately, a shared CIS control does not automatically mean a shared Essential Eight strategy. Check which CIS safeguards actually back each strategy before relying on the chain.

Six functions versus five

The CSF 2.0 Core has six Functions: Govern, Identify, Protect, Detect, Respond and Recover. The E4EIT catalog uses five: Govern, Identify, Protect, Detect and Respond, with 28 principles and 58 actions. Recover has no matching E4EIT function, so recovery work tied to the backup strategy will need its own mapping and owner. Confirm where restoration testing and incident recovery sit in both structures.

Maturity levels are not tiers

Essential Eight maturity levels grade implementation of eight specific strategies against ASD's maturity model. CSF Tiers describe the rigor of cybersecurity risk governance and management practices, from Partial to Adaptive. A team can sit at a high Essential Eight level and a low CSF Tier, or the reverse. Report the two scores separately so neither one is read as a conversion of the other.

Verify each overlap by control

A shared reference means the two frameworks look at related evidence, not that a single artifact closes both. Essential Eight strategies such as multi-factor authentication or restricted administrative privileges are narrow and testable, while CSF subcategories are outcome statements that many controls can satisfy. Build a control-by-control register that records the evidence, the owner and the test for each overlap, and flag any CSF subcategory that no Essential Eight action covers.

Who assesses each framework and what each one issues

This table compares who checks each framework, what document or evidence comes out of the check, and how often it runs. Read the cycle column as what the sources state, then confirm timing with the assessor or your own governance calendar. The main takeaway is that Essential Eight produces assessed maturity against a published baseline, while NIST CSF produces no certificate and depends on the assessment you define.

Framework	Who assesses	What is issued	Cycle
Essential Eight	An assessor applying ASD's Essential Eight Maturity Model to each strategy's implementation and effectiveness	A maturity assessment by strategy against Maturity Levels Zero to Three, with no ASD certificate	Set by the party requesting the assessment; confirm frequency with the assessor
Essential Eight scope baseline	ASD publishes the ISM in OSCAL with ML1, ML2 and ML3 profiles (46, 87 and 123 controls in ISM v2026.09.4)	Machine-readable control sets buyers can use to define assessment scope; not a certificate	Tied to ISM releases; confirm which version your assessor will use
NIST CSF 2.0	No conformity assessment program; NIST does not certify CSF implementations or the firms that deliver them	No certificate. Output is whatever the organization or its customer defines, such as Current and Target Profiles and a Tier assessment	Self-directed or customer-defined; agree timing and evidence in writing
NIST CSF Tiers and Profiles	Internal teams or an outside party engaged by the organization	Tier characterization (Partial to Adaptive) and Organizational Profiles, which are not a pass or fail result	Chosen by the organization; repeat when risk governance changes
Independent assurance on either framework	No ASD or NIST body issues it; a party the buyer engages sets scope and method	Engagement-specific report or memo that the buyer defines, not an official Essential Eight or CSF attestation	Confirm scope, frequency and deliverables before work starts

Doing both: the order that avoids duplicate evidence

This sequence sets the requirement source and scope first, then builds one evidence register that serves both the Essential Eight maturity assessment and the CSF outcome review, so the same control evidence is not collected twice.

Confirm the requirement source in writing
Before any mapping work, get written confirmation from the customer, regulator, or internal risk owner that states which framework is mandatory, which is voluntary, and which outputs they expect. Usually the compliance lead and the contract or regulatory owner do this together. The step is done when the requirement list is filed with its source document and date, and each requirement is marked as either a maturity target (Essential Eight) or an outcome target (CSF). Without this, teams often build a CSF profile nobody asked for.
Define scope for environment, systems and business units
Agree in writing which environments, systems, data stores, and business units fall inside the assessment boundary. Both frameworks depend on this boundary, and a mismatch is the most common source of duplicate work. The platform owner, security lead, and business unit sponsors sign off on the list. The step closes when every in-scope asset has an owner and a location, and out-of-scope items are recorded with a reason.
Baseline current state against Maturity Level One
Assess each of the eight Essential Eight strategies against Maturity Level One of ASD's maturity model as the technical floor. Engineers collect the implementation evidence, such as patch records, MFA enforcement settings, and backup test logs, and the reviewer records a gap for each strategy not yet met. The step produces a dated baseline with one row per strategy and the evidence location for each row. Higher maturity levels can be planned later from this baseline.
Map existing evidence to CSF Subcategories
Use the NIST CSF 2.0 Reference Tool export to look up the Subcategories and Implementation Examples that correspond to each baseline row, and use the E4EIT mapping collection to see where Essential Eight actions point to supporting evidence for the same control areas. Record each piece of evidence once and link it to every Subcategory it supports. The output is a cross-reference table in which each evidence item appears one time. Confirm that ASD's mapping notes describe where evidence may exist and do not define the controls a Subcategory requires.
Set CSF Target Profile and Tier goals for governance gaps
Some CSF outcomes, especially within Govern, have no direct Essential Eight equivalent. For those, the governance lead drafts a Current Profile and a Target Profile, then sets Tier goals for risk governance and management practices, using the Partial, Risk Informed, Repeatable, and Adaptive Tiers. Leadership approves the target in writing. The step is complete when each governance gap has a named owner, a target Tier, and a link to the policy, role, or process that will close it.
Agree the evidence register and retention approach
Create one evidence register that lists each artifact, its owner, its collection date, its source system, and the framework outcomes it supports. Agree with legal, records, and the auditor or customer how long each artifact is retained and where it is stored. The register is the single source for both the maturity assessment and any CSF review. The step is done when the register is approved and the retention rules are written down, with any customer-specific retention terms identified in the contract.
Schedule independent assessment where required
Neither the Essential Eight nor the CSF produces a certificate, so independent assessment is needed only where a customer, regulator, or contract requires it. Confirm with each requester which assessor type they accept and what report form they expect. Book the assessor only after the register is complete, so the assessor reviews one evidence set. The step closes when the assessor's scope, evidence request list, and report format are agreed in writing.

What drives the cost and effort of each framework

The cost of the Essential Eight and the NIST CSF 2.0 is not one line item, and the two frameworks put their money in different places. Essential Eight work is mostly technical: the eight mitigation strategies (patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups) must be implemented and evidenced at the maturity level you target. CSF 2.0 work is mostly governance and documentation: you define the Organizational Profiles (Current and Target), set the Tier you want, and map your existing policies and controls to Subcategories. Your internal staff time is the largest component in both cases. Tooling, independent assessment fees, and external help with implementation or evidence preparation are the other components. Neither framework has a certification body, so there is no mandatory assessment fee for either. Any independent assessment you buy is a separate engagement, and it should be scoped and priced on its own terms. No fees or durations for either framework are supplied for this page, so ask any vendor or adviser for a written scope that lists deliverables, systems covered, and the people who will do the work before you compare numbers.

Several drivers move effort up or down in both frameworks. The first is the number of systems in scope: each endpoint, server, identity source, and backup repository has to be checked against each Essential Eight strategy, and each asset class has to be described under the CSF Identify Function. The second is existing control maturity. An organization that already patches on a cycle, restricts administrative accounts, and tests backups will spend far less time than one that must first discover its assets. The third is the number of customer, regulator, or supplier requests you must answer, since each new request multiplies the evidence you must gather and explain. The fourth is whether governance documentation must be built from scratch. Writing the Govern Function policies, risk strategy, and supplier oversight records is often the slowest part of a CSF program. Ask each bidder to price these four drivers separately so you can see where your own environment pushes the effort.

Some costs are one-time and some recur, and the split matters for budgeting. One-time work includes the initial Essential Eight baseline at your target maturity level, the first pass of the CSF Current Profile, the Target Profile definition, and the first set of policies and evidence files. Recurring work includes reassessing each strategy, refreshing evidence as systems change, retesting controls, and updating the CSF Profiles when your risk appetite or business changes. ASD's Essentials series and its evidence mappings to CSF 2.0 may change how you collect evidence, so ask your assessor which evidence versions they will use. The Essential Eight Maturity Model's current release is dated November 2023, and NIST's CSF updates archive records new Quick-Start Guides and informative reference mappings since February 2024 without a revision of the CSF 2.0 Core, so confirm which versions your quote is based on. When you request a quote, ask for the one-time and recurring costs as separate lines, the assumed number of systems, and the named roles for each piece of work.

Questions buyers ask before choosing between the Essential Eight and NIST CSF

Does the Essential Eight or NIST CSF give us a certificate?

No. Neither framework issues a certificate. The Essential Eight is a set of mitigations, and ASD issues no certificate. Maturity is evidenced by assessing how each of the eight strategies is implemented and how well it works against the Essential Eight Maturity Model, which defines Maturity Levels Zero to Three. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans for a conformity assessment program. Any formal proof therefore comes from your own assessor, your customer or a contract. Ask each buyer which evidence format they accept, such as a written assessment, a self-assessment or an independent review, and confirm it before you scope the work.

Can the Essential Eight replace the CSF for an Australian government supplier?

Not by default. The two frameworks answer different questions. The Essential Eight sets technical mitigations with maturity levels, while the CSF organizes cybersecurity outcomes into six Functions, 22 Categories and 106 Subcategories. Whether a specific Australian government contract asks for Essential Eight maturity, CSF alignment or both is decided by the contract and the agency's security requirements, and neither framework makes that decision. Confirm the required level, the evidence format and the assessor with the contracting agency before you commit. Some suppliers keep the Essential Eight as the technical evidence and map it into the CSF for a wider audience, but that approach should be agreed with the buyer first.

How long does each take, and what drives the timeline?

No supplied figure sets a duration for either framework, so treat any number from a vendor or consultant as a claim to test. The main drivers are the target maturity level, the number of systems, accounts and sites in scope, how much of the environment is already documented and automated, and whether this is a first assessment or a repeat. For the Essential Eight, the ISM v2026.09.4 profiles that underpin it list 46 controls at ML1, 87 at ML2 and 123 at ML3, so each higher level adds work. For the CSF, the 106 Subcategories and the Current and Target Profiles you choose set the breadth. DeployOpen works to a fixed scope agreed in writing before work starts, so ask for a timeline tied to named deliverables.

Can our own team do this without outside help?

Often yes for a first pass, if each strategy or function has a named owner who can produce evidence. The Essential Eight is mostly technical work: configuration, patching, identity, administrative privilege review and backup restore testing, and the maturity model describes what to check. The CSF is broader. Its Tiers describe the rigor of cybersecurity risk governance, which depends on leadership decisions and documented risk management that many teams underestimate. Outside help is most useful for an independent gap analysis against your target level, a review of evidence before an assessor sees it, and packaging that evidence. Decide which parts you will own, which you will buy and who signs off. DeployOpen plans, implements, hardens and documents self-hosted platforms in your infrastructure and prepares evidence for assessments, but it does not issue audit reports or certifications.

What do we need to provide before an assessment starts?

Collect material that shows how each control operates, not only the policy that describes it. For the Essential Eight, this usually includes an inventory of applications and operating systems, patch and vulnerability records, a list of accounts with administrative privileges, configurations for multi-factor authentication and application control, macro settings, hardening baselines and dated backup restore tests. For the CSF, expect governance documents, a risk register, asset and supplier records, incident response and recovery plans, and the Current and Target Profiles you plan to use. Ask the assessor or customer which evidence they accept, the period it must cover and whether they want outputs in a specific format. Write the scope so it names the systems, sites and accounts included.

Does the CSF map to the Essential Eight automatically?

No. A mapping shows where evidence for one framework may also count toward another. It does not make one framework satisfy the other. ASD's mapping notes say the referenced frameworks indicate where evidence of an action's effectiveness may exist, and they are not intended to define the controls needed to meet the action. The E4EIT collection references NIST CSF 2.0 alongside the Essential Eight, the ISM and NIST SP 800-171r3. NIST states that it does not check the correctness of non-NIST mappings and that listing a mapping does not imply endorsement. Have your assessor review each mapping line you rely on, and record which evidence you reuse and why. Start with the E4EIT OSCAL repository published by ASD.

How DeployOpen scopes and delivers readiness for both frameworks

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, and prepares systems and evidence for compliance assessments. For Essential Eight vs NIST CSF, the work starts with a written scope that maps your current controls to both the Essential Eight strategies and the CSF Functions, Categories and Subcategories, so that one body of evidence can serve both views.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope names which Essential Eight strategies and target maturity levels are in view, and which CSF Tiers or Profiles are in view.
Scope also states which systems, cloud accounts or networks are covered and which evidence sources the team will use.

How we build

Controls are implemented or configured in your environment, such as patch, administrative privilege, MFA and backup settings.
Each control is tested against the agreed scope, and gaps are recorded with owners and remediation steps.
Evidence is collected once in a form that can be reused for both the Essential Eight assessment and CSF outcome reporting.

How we hand over

Deliverables include documented configurations, procedures, test results and a crosswalk between Essential Eight and CSF 2.0 references.
The crosswalk notes that ASD and NIST mappings indicate where evidence may exist and do not replace your own assessment.
Handover covers the people who will run the controls, so your team can keep the evidence current after the engagement ends.

How we support

Ongoing support, upgrades and continuous testing are available as retainers.
A retainer can keep evidence current as your Essential Eight maturity target or CSF Profile changes.
Confirm with DeployOpen in the quote which assessment body, if any, will review your results, since DeployOpen does not issue attestations or certifications.