Essential Eight Maturity Level Two for AWS and Azure workloads

The ASD model assumes a managed fleet of workstations. Six of the eight strategies map onto cloud services, and two do not.

Last reviewed: · 6 min read

Which document this follows

The Essential Eight Maturity Model published by the Australian Signals Directorate, November 2023 release. Maturity Level Two requirements sit in Appendix B. Where a requirement is quoted below it comes from that appendix.

Two things about the model catch cloud teams out. Maturity is assessed across all eight strategies together, so your level is the lowest level you fully meet. And the model is written about organisations, so a cloud account is part of your assessment scope rather than the whole of it.

The eight strategies in AWS and Azure terms

StrategyWhat ML2 asks forAWSAzure
Patch applicationsScan fortnightly. Patch internet-facing services within two weeks, or 48 hours where an exploit exists.Inspector for continuous scanning of EC2, ECR images and Lambda. Systems Manager Patch Manager to apply.Defender for Cloud vulnerability assessment and Defender for Containers. Azure Update Manager to apply.
Patch operating systemsScan fortnightly. Patch internet-facing systems within two weeks. Vendor-supported versions only.Patch Manager with patch baselines and maintenance windows. EC2 Image Builder for rebuilt images.Azure Update Manager with scheduled patching. Azure Compute Gallery for rebuilt images.
Multi-factor authenticationMFA for privileged users and for users of internet-facing services. ML2 wants something better than a one-time code.IAM Identity Center with FIDO2 security keys. Deny actions without the MFA condition key.Entra ID Conditional Access with a phishing-resistant authentication strength.
Restrict administrative privilegesValidate privileged access on request and revalidate annually. No internet, email or web services from privileged accounts.Identity Center permission sets and short role sessions. IAM Access Analyzer unused access findings. No long-lived keys.Entra Privileged Identity Management with time-bound eligible roles and access reviews.
Application controlControl executable content on workstations and on internet-facing servers, using an allowlist.No AWS service does this. Deploy the operating system mechanism through Systems Manager.No Azure service does this. Deploy through Azure Policy guest configuration and monitor in Defender for Servers.
Restrict Microsoft Office macrosBlock macros from the internet. Antivirus scanning. Users cannot change the setting.Not applicable to a cloud workload. This lives in Microsoft 365 and on the endpoint.Not applicable to a cloud workload. Configure in Microsoft 365 Apps policy.
User application hardeningBlock web ads and Java in browsers. Block Internet Explorer 11. Log and protect PowerShell activity.Mostly endpoint. The server-side part is Windows event and Sysmon collection through the CloudWatch agent.Mostly endpoint. The server-side part is Azure Monitor Agent collecting the PowerShell operational log.
Regular backupsBackups retained and tested. Unprivileged accounts cannot access others backups. Accounts other than backup administrators cannot modify or delete them.AWS Backup with Vault Lock in compliance mode, copied to a separate backup account.Azure Backup with an immutable vault, soft delete, and multi-user authorisation through a Resource Guard.

The two that do not map

Office macro restrictions and most of user application hardening are endpoint controls. No cloud setting satisfies them, and a provider cannot satisfy them for you.

This matters because of how the model scores. If your cloud estate meets ML2 on six strategies and your laptops are unmanaged, the organisation is not at ML2. A vendor telling you that a cloud posture tool gets you to ML2 has either not read the model or is hoping you have not.

Where cloud teams miss ML2

The gaps below come up repeatedly, and none of them is about a missing product.

  • Logs collected but never analysed. ML2 asks for timely analysis.
  • Logs deletable by the people being logged. Use Object Lock or immutable storage.
  • Backups deletable by a production administrator. Vault Lock and multi-user authorisation fix this.
  • Restores never tested. The requirement is tested backups, not configured backups.
  • Unused accounts and access keys linger past 45 days of inactivity.
  • Privileged access granted once and never revalidated. ML2 asks for annual revalidation.
  • Administration from a laptop that also reads email. That fails regardless of configuration.
  • Managed services assumed patched. Your engine version and images are still yours.

What ML2 does not ask for

  • A specific product, from any vendor, anywhere in the model.
  • Zero unpatched vulnerabilities. It asks for a scan cadence and a patch window.
  • Certification. There is no ASD certificate for the Essential Eight.
  • Maturity Level Three, unless your obligation or your risk says so.

What to do next

Score yourself first. The Essential Eight ML2 self-check runs in your browser and scores against ML2 without sending anything anywhere, and the Essential Eight assessment page sets out what an assessment covers and excludes.

If the gap is in the cloud estate rather than the endpoint fleet, a cloud security review finds it faster. If an auditor is also asking for a test, read what a penetration test report should contain first. The rest is in the guides index.

Questions before you book

Practical answers.

Does the Essential Eight apply to cloud workloads?

The model applies to your organisation, not to an account. Internet-facing servers are explicitly in scope for several strategies, so a cloud workload is assessed. What the model does not do is describe the strategies in cloud service terms, which is the gap this guide fills.

Can we reach Maturity Level Two with cloud configuration alone?

No. Two of the eight strategies are endpoint controls, and no AWS or Azure setting satisfies them. Your maturity level is the lowest level you fully meet across all eight, so a perfectly configured cloud account with unmanaged laptops is not at ML2.

Which AWS or Azure service provides application control?

Neither provider sells one. Application control is enforced inside the operating system, so on a Windows instance it is AppLocker or Windows Defender Application Control, and on Linux it is a mechanism such as fapolicyd. The cloud services deploy and monitor that configuration rather than replacing it.

Does using a managed service remove the patching requirement?

It moves the platform patching to the provider and leaves your layer with you. A managed database still runs your engine version, and a container image you built still carries the libraries you put in it. ML2 asks for a fortnightly scan and a two-week patch window, and neither is satisfied by the shared responsibility model.

How long does an ML2 assessment take?

Assessing eight strategies across a cloud estate and an endpoint fleet is usually two to three weeks of work, and the uplift takes longer than the assessment. The honest answer depends on how much logging already exists, because that is where most teams are furthest from the requirement.

Let’s scope it

Need an honest ML2 score?

Tell us what triggered the question and what you already collect. We will scope an assessment against the November 2023 model.

Request a quote