Which document this follows
The Essential Eight Maturity Model published by the Australian Signals Directorate, November 2023 release. Maturity Level Two requirements sit in Appendix B. Where a requirement is quoted below it comes from that appendix.
Two things about the model catch cloud teams out. Maturity is assessed across all eight strategies together, so your level is the lowest level you fully meet. And the model is written about organisations, so a cloud account is part of your assessment scope rather than the whole of it.
The eight strategies in AWS and Azure terms
| Strategy | What ML2 asks for | AWS | Azure |
|---|---|---|---|
| Patch applications | Scan fortnightly. Patch internet-facing services within two weeks, or 48 hours where an exploit exists. | Inspector for continuous scanning of EC2, ECR images and Lambda. Systems Manager Patch Manager to apply. | Defender for Cloud vulnerability assessment and Defender for Containers. Azure Update Manager to apply. |
| Patch operating systems | Scan fortnightly. Patch internet-facing systems within two weeks. Vendor-supported versions only. | Patch Manager with patch baselines and maintenance windows. EC2 Image Builder for rebuilt images. | Azure Update Manager with scheduled patching. Azure Compute Gallery for rebuilt images. |
| Multi-factor authentication | MFA for privileged users and for users of internet-facing services. ML2 wants something better than a one-time code. | IAM Identity Center with FIDO2 security keys. Deny actions without the MFA condition key. | Entra ID Conditional Access with a phishing-resistant authentication strength. |
| Restrict administrative privileges | Validate privileged access on request and revalidate annually. No internet, email or web services from privileged accounts. | Identity Center permission sets and short role sessions. IAM Access Analyzer unused access findings. No long-lived keys. | Entra Privileged Identity Management with time-bound eligible roles and access reviews. |
| Application control | Control executable content on workstations and on internet-facing servers, using an allowlist. | No AWS service does this. Deploy the operating system mechanism through Systems Manager. | No Azure service does this. Deploy through Azure Policy guest configuration and monitor in Defender for Servers. |
| Restrict Microsoft Office macros | Block macros from the internet. Antivirus scanning. Users cannot change the setting. | Not applicable to a cloud workload. This lives in Microsoft 365 and on the endpoint. | Not applicable to a cloud workload. Configure in Microsoft 365 Apps policy. |
| User application hardening | Block web ads and Java in browsers. Block Internet Explorer 11. Log and protect PowerShell activity. | Mostly endpoint. The server-side part is Windows event and Sysmon collection through the CloudWatch agent. | Mostly endpoint. The server-side part is Azure Monitor Agent collecting the PowerShell operational log. |
| Regular backups | Backups retained and tested. Unprivileged accounts cannot access others backups. Accounts other than backup administrators cannot modify or delete them. | AWS Backup with Vault Lock in compliance mode, copied to a separate backup account. | Azure Backup with an immutable vault, soft delete, and multi-user authorisation through a Resource Guard. |
The two that do not map
Office macro restrictions and most of user application hardening are endpoint controls. No cloud setting satisfies them, and a provider cannot satisfy them for you.
This matters because of how the model scores. If your cloud estate meets ML2 on six strategies and your laptops are unmanaged, the organisation is not at ML2. A vendor telling you that a cloud posture tool gets you to ML2 has either not read the model or is hoping you have not.
Where cloud teams miss ML2
The gaps below come up repeatedly, and none of them is about a missing product.
- Logs collected but never analysed. ML2 asks for timely analysis.
- Logs deletable by the people being logged. Use Object Lock or immutable storage.
- Backups deletable by a production administrator. Vault Lock and multi-user authorisation fix this.
- Restores never tested. The requirement is tested backups, not configured backups.
- Unused accounts and access keys linger past 45 days of inactivity.
- Privileged access granted once and never revalidated. ML2 asks for annual revalidation.
- Administration from a laptop that also reads email. That fails regardless of configuration.
- Managed services assumed patched. Your engine version and images are still yours.
What ML2 does not ask for
- A specific product, from any vendor, anywhere in the model.
- Zero unpatched vulnerabilities. It asks for a scan cadence and a patch window.
- Certification. There is no ASD certificate for the Essential Eight.
- Maturity Level Three, unless your obligation or your risk says so.
What to do next
Score yourself first. The Essential Eight ML2 self-check runs in your browser and scores against ML2 without sending anything anywhere, and the Essential Eight assessment page sets out what an assessment covers and excludes.
If the gap is in the cloud estate rather than the endpoint fleet, a cloud security review finds it faster. If an auditor is also asking for a test, read what a penetration test report should contain first. The rest is in the guides index.