Essential Eight
What evidence should you prepare before an Essential Eight assessment?
Prepare for an Essential Eight assessment with scoped system records, control evidence and an evidence index that makes coverage and limitations clear.
By Lisa Elkner4 min readPrepare evidence that helps an assessor understand your environment and examine the controls within scope. Begin with an agreed boundary, current system information and people who can explain how the controls operate. Then organise the records that support those explanations.
A well organised evidence pack can make an assessment easier to conduct. Its contents still need to be assessed. The presence of a policy, report or screenshot does not establish maturity on its own, and no generic checklist replaces the evidence requirements agreed for your assessment.
Agree the scope before collecting everything
Confirm which systems, services and requirements the assessment covers. Ask the assessor what evidence they need, what period it should relate to and how it should be provided. This helps avoid collecting large volumes of material that do not answer the assessment questions.
Identify the people who understand each part of the environment. Your IT provider may hold configuration and operational records, while a business owner explains why a system exists or who is responsible for it. Both perspectives can be useful.
Build a current picture of the environment
Start with the information needed to understand what is in scope. Useful starting records include the following, with dates and coverage made clear:
- An inventory of computers, servers and relevant software.
- Administrator account information and the people responsible for that access.
- Multi-factor authentication information showing which accounts and services it covers.
- Patch status reports and visibility of systems missing from those reports.
- Backup records and records of restoration testing.
- The owners who can explain the systems and follow up gaps in the information.
Keep the meaning of each record attached
A report is easier to interpret when its context travels with it. Record when it was produced, what systems or accounts it covers and any known exclusions. Retain enough explanation for someone outside day-to-day operations to understand what they are looking at.
Use an evidence index
A simple index can help you organise material without rewriting every existing document. Create one entry for each item and capture:
- The question or control the item relates to.
- The file or record location and its owner.
- The date captured or period covered.
- The systems, accounts or activities represented.
- Known limitations, exceptions or information still to be obtained.
Include implementation and operating evidence
Different records answer different assessment questions. Their usefulness depends on the agreed scope and what the assessor needs to establish.
| Record | What it can help establish | What still needs checking |
|---|---|---|
| Policy or procedure | Intended requirements and responsibilities | Whether those requirements are implemented and operate within the assessed environment |
| Configuration record or screenshot | How the represented system was configured at a particular time | Scope, capture date and whether further evidence is needed for continued operation |
| Patch status report | The reported position of included devices | Whether all relevant devices are represented and what remains unknown outside that coverage |
| Backup completion record | Whether the recorded backup activity completed | Whether the required information can be restored; completion and restoration answer different questions |
| Restoration test record | The result of the test performed | What was tested, when, and whether its scope answers the assessment question |
Make unknowns visible before the assessment
If a record is unavailable or its coverage is uncertain, label that clearly and identify who can investigate. Distinguish information that has not yet been collected from a confirmed implementation gap. That gives the assessor a more accurate starting point and helps your team direct its preparation.
The purpose is to provide a coherent account of the environment supported by evidence. It is reasonable for an assessment to identify further questions. Good preparation means those questions can be followed through with the right people and records.
For help defining the scope and evidence needs of an Essential Eight assessment, speak with Strategic Cyber.