Shield
Start free trialFree trial
Menu
For your teamFrameworksHow it worksPricingSecurityQuestionsCompareSign in

Frameworks · Essential Eight

Essential Eight requirements by maturity level, with the evidence for each.

Every requirement of the ASD Essential Eight maturity model, grouped by mitigation strategy and maturity level, so you can see where you are and what the next level takes.

Start a 14-day free trialHow a programme works

The framework

NameASD Essential Eight Maturity Model
Who it applies toBusinesses, government agencies and other organisations protecting internet-connected information technology networks: ASD designed the Essential Eight for those networks, not for enterprise mobility or operational technology networks. An organisation picks a target maturity level suitable for its environment and implements each level in turn until it gets there. Independent certification isn't required, but a government directive or policy, a regulatory authority or a contract may require an independent assessment.
Introduction; Implementation, Essential Eight maturity model, November 2023 update (published 30 Jun 2017, last reviewed 27 Nov 2023; PDF 'Essential Eight maturity model (November 2023)'), read 10 November 2026
In force on 11 November 2026Essential Eight maturity model (November 2023), from 27 November 2023
Appendices A to D, Essential Eight maturity model, November 2023 update (published 30 Jun 2017, last reviewed 27 Nov 2023; PDF 'Essential Eight maturity model (November 2023)'), read 10 November 2026
Maturity levelsMaturity Level Zero, Maturity Level One, Maturity Level Two, Maturity Level Three

What a Essential Eight programme does

Requirements by maturity level

Each requirement is a control with its mitigation strategy and the maturity levels that require it.

Targets and uplift

Set a target maturity level and draft a maturity uplift plan from the gaps, for a named person to issue.

Answer questionnaires from evidence

Draft customer and insurer responses that cite the evidence for each requirement.

Versions

VersionFromUntilSource
Essential Eight maturity model (November 2023)27 November 2023CurrentAppendices A to D

Controls (152)

Essential Eight maturity model (November 2023). Each control cites its source; your programme holds made.'s plain-English summary of each obligation beside it.

Patch applications

RefControlMaturity levelCitation
PA-01Automated asset discovery at least fortnightly1Patch applications, requirement 1 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PA-02Vulnerability scanner database kept up to date1Patch applications, requirement 2 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PA-03Daily vulnerability scans of online services1Patch applications, requirement 3 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PA-04Weekly vulnerability scans of office, browser, email, PDF and security software1Patch applications, requirement 4 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PA-05Fortnightly vulnerability scans of other applications2Patch applications, requirement 5 of Appendix D (required at Maturity Level Two and Maturity Level Three)
PA-06Online services patched within 48 hours (critical or exploited)1Patch applications, requirement 6 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PA-07Online services patched within two weeks (non-critical)1Patch applications, requirement 7 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PA-08Office, browser, email, PDF and security software patched within two weeks1Patch applications, requirement 8 of Appendix D (required at Maturity Level One and Maturity Level Two)
PA-09Office, browser, email, PDF and security software patched within 48 hours (critical or exploited)3Patch applications, requirement 9 of Appendix D (required at Maturity Level Three)
PA-10Office, browser, email, PDF and security software patched within two weeks (non-critical)3Patch applications, requirement 10 of Appendix D (required at Maturity Level Three)
PA-11Other applications patched within one month2Patch applications, requirement 11 of Appendix D (required at Maturity Level Two and Maturity Level Three)
PA-12Unsupported online services removed1Patch applications, requirement 12 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PA-13Unsupported office, browser, email, PDF, Flash and security software removed1Patch applications, requirement 13 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PA-14Unsupported other applications removed3Patch applications, requirement 14 of Appendix D (required at Maturity Level Three)

Patch operating systems

RefControlMaturity levelCitation
PO-01Automated asset discovery at least fortnightly1Patch operating systems, requirement 1 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PO-02Vulnerability scanner database kept up to date1Patch operating systems, requirement 2 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PO-03Daily vulnerability scans of internet-facing server and network device operating systems1Patch operating systems, requirement 3 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PO-04Fortnightly vulnerability scans of workstation and internal server and network device operating systems1Patch operating systems, requirement 4 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PO-05Fortnightly vulnerability scans of drivers3Patch operating systems, requirement 5 of Appendix D (required at Maturity Level Three)
PO-06Fortnightly vulnerability scans of firmware3Patch operating systems, requirement 6 of Appendix D (required at Maturity Level Three)
PO-07Internet-facing operating systems patched within 48 hours (critical or exploited)1Patch operating systems, requirement 7 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PO-08Internet-facing operating systems patched within two weeks (non-critical)1Patch operating systems, requirement 8 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
PO-09Workstation and internal operating systems patched within one month1Patch operating systems, requirement 9 of Appendix D (required at Maturity Level One and Maturity Level Two)
PO-10Workstation and internal operating systems patched within 48 hours (critical or exploited)3Patch operating systems, requirement 10 of Appendix D (required at Maturity Level Three)
PO-11Workstation and internal operating systems patched within one month (non-critical)3Patch operating systems, requirement 11 of Appendix D (required at Maturity Level Three)
PO-12Drivers patched within 48 hours (critical or exploited)3Patch operating systems, requirement 12 of Appendix D (required at Maturity Level Three)
PO-13Drivers patched within one month (non-critical)3Patch operating systems, requirement 13 of Appendix D (required at Maturity Level Three)
PO-14Firmware patched within 48 hours (critical or exploited)3Patch operating systems, requirement 14 of Appendix D (required at Maturity Level Three)
PO-15Firmware patched within one month (non-critical)3Patch operating systems, requirement 15 of Appendix D (required at Maturity Level Three)
PO-16Latest or previous operating system release in use3Patch operating systems, requirement 16 of Appendix D (required at Maturity Level Three)
PO-17Unsupported operating systems replaced1Patch operating systems, requirement 17 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)

Multi-factor authentication

RefControlMaturity levelCitation
MFA-01MFA for the organisation's online services holding sensitive data1Multi-factor authentication, requirement 1 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
MFA-02MFA for third-party online services holding sensitive data1Multi-factor authentication, requirement 2 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
MFA-03MFA (where available) for third-party online services holding non-sensitive data1Multi-factor authentication, requirement 3 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
MFA-04MFA for users of the organisation's online customer services holding sensitive customer data1Multi-factor authentication, requirement 4 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
MFA-05MFA for users of third-party online customer services holding sensitive customer data1Multi-factor authentication, requirement 5 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
MFA-06MFA for customers of online customer services holding sensitive customer data1Multi-factor authentication, requirement 6 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
MFA-07MFA for privileged users of systems2Multi-factor authentication, requirement 7 of Appendix D (required at Maturity Level Two and Maturity Level Three)
MFA-08MFA for unprivileged users of systems2Multi-factor authentication, requirement 8 of Appendix D (required at Maturity Level Two and Maturity Level Three)
MFA-09MFA for users of data repositories3Multi-factor authentication, requirement 9 of Appendix D (required at Maturity Level Three)
MFA-10MFA combines something users have with something they know or are1Multi-factor authentication, requirement 10 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
MFA-11Phishing-resistant MFA for users of online services2Multi-factor authentication, requirement 11 of Appendix D (required at Maturity Level Two and Maturity Level Three)
MFA-12Phishing-resistant MFA option for customers of online customer services2Multi-factor authentication, requirement 12 of Appendix D (required at Maturity Level Two)
MFA-13Phishing-resistant MFA for customers of online customer services3Multi-factor authentication, requirement 13 of Appendix D (required at Maturity Level Three)
MFA-14Phishing-resistant MFA for users of systems2Multi-factor authentication, requirement 14 of Appendix D (required at Maturity Level Two and Maturity Level Three)
MFA-15Phishing-resistant MFA for users of data repositories3Multi-factor authentication, requirement 15 of Appendix D (required at Maturity Level Three)
MFA-16MFA events centrally logged2Multi-factor authentication, requirement 16 of Appendix D (required at Maturity Level Two and Maturity Level Three)
MFA-17Event logs protected from modification and deletion2Multi-factor authentication, requirement 17 of Appendix D (required at Maturity Level Two and Maturity Level Three)
MFA-18Internet-facing server event logs analysed promptly2Multi-factor authentication, requirement 18 of Appendix D (required at Maturity Level Two and Maturity Level Three)
MFA-19Internal server event logs analysed promptly3Multi-factor authentication, requirement 19 of Appendix D (required at Maturity Level Three)
MFA-20Workstation event logs analysed promptly3Multi-factor authentication, requirement 20 of Appendix D (required at Maturity Level Three)
MFA-21Cyber security events analysed promptly for incidents2Multi-factor authentication, requirement 21 of Appendix D (required at Maturity Level Two and Maturity Level Three)
MFA-22Incidents reported to the CISO or a delegate2Multi-factor authentication, requirement 22 of Appendix D (required at Maturity Level Two and Maturity Level Three)
MFA-23Incidents reported to ASD2Multi-factor authentication, requirement 23 of Appendix D (required at Maturity Level Two and Maturity Level Three)
MFA-24Incident response plan enacted2Multi-factor authentication, requirement 24 of Appendix D (required at Maturity Level Two and Maturity Level Three)

Restrict administrative privileges

RefControlMaturity levelCitation
RAP-01Privileged access requests validated when first requested1Restrict administrative privileges, requirement 1 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RAP-02Privileged access disabled after 12 months unless revalidated2Restrict administrative privileges, requirement 2 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-03Privileged access disabled after 45 days of inactivity2Restrict administrative privileges, requirement 3 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-04Dedicated privileged user accounts1Restrict administrative privileges, requirement 4 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RAP-05Privileged access limited to what duties require3Restrict administrative privileges, requirement 5 of Appendix D (required at Maturity Level Three)
RAP-06Privileged accounts blocked from internet, email and web services1Restrict administrative privileges, requirement 6 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RAP-07Privileged accounts authorised for online services strictly limited1Restrict administrative privileges, requirement 7 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RAP-08Secure Admin Workstations used for administration3Restrict administrative privileges, requirement 8 of Appendix D (required at Maturity Level Three)
RAP-09Separate privileged and unprivileged operating environments1Restrict administrative privileges, requirement 9 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RAP-10Privileged environments not virtualised within unprivileged ones2Restrict administrative privileges, requirement 10 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-11Unprivileged accounts can't log on to privileged environments1Restrict administrative privileges, requirement 11 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RAP-12Privileged accounts can't log on to unprivileged environments1Restrict administrative privileges, requirement 12 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RAP-13Just-in-time administration3Restrict administrative privileges, requirement 13 of Appendix D (required at Maturity Level Three)
RAP-14Administration through jump servers2Restrict administrative privileges, requirement 14 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-15Break glass, local administrator and service account credentials managed2Restrict administrative privileges, requirement 15 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-16Memory integrity enabled3Restrict administrative privileges, requirement 16 of Appendix D (required at Maturity Level Three)
RAP-17Local Security Authority protection enabled3Restrict administrative privileges, requirement 17 of Appendix D (required at Maturity Level Three)
RAP-18Credential Guard enabled3Restrict administrative privileges, requirement 18 of Appendix D (required at Maturity Level Three)
RAP-19Remote Credential Guard enabled3Restrict administrative privileges, requirement 19 of Appendix D (required at Maturity Level Three)
RAP-20Privileged access events centrally logged2Restrict administrative privileges, requirement 20 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-21Privileged account and security group management events centrally logged2Restrict administrative privileges, requirement 21 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-22Event logs protected from modification and deletion2Restrict administrative privileges, requirement 22 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-23Internet-facing server event logs analysed promptly2Restrict administrative privileges, requirement 23 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-24Internal server event logs analysed promptly3Restrict administrative privileges, requirement 24 of Appendix D (required at Maturity Level Three)
RAP-25Workstation event logs analysed promptly3Restrict administrative privileges, requirement 25 of Appendix D (required at Maturity Level Three)
RAP-26Cyber security events analysed promptly for incidents2Restrict administrative privileges, requirement 26 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-27Incidents reported to the CISO or a delegate2Restrict administrative privileges, requirement 27 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-28Incidents reported to ASD2Restrict administrative privileges, requirement 28 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RAP-29Incident response plan enacted2Restrict administrative privileges, requirement 29 of Appendix D (required at Maturity Level Two and Maturity Level Three)

Application control

RefControlMaturity levelCitation
AC-01Application control on workstations1Application control, requirement 1 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
AC-02Application control on internet-facing servers2Application control, requirement 2 of Appendix D (required at Maturity Level Two and Maturity Level Three)
AC-03Application control on internal servers3Application control, requirement 3 of Appendix D (required at Maturity Level Three)
AC-04Application control on user profiles and temporary folders1Application control, requirement 4 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
AC-05Application control on all other locations2Application control, requirement 5 of Appendix D (required at Maturity Level Two and Maturity Level Three)
AC-06Executables, libraries, scripts, installers and similar restricted to an approved set1Application control, requirement 6 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
AC-07Drivers restricted to an approved set3Application control, requirement 7 of Appendix D (required at Maturity Level Three)
AC-08Microsoft's recommended application blocklist implemented2Application control, requirement 8 of Appendix D (required at Maturity Level Two and Maturity Level Three)
AC-09Microsoft's vulnerable driver blocklist implemented3Application control, requirement 9 of Appendix D (required at Maturity Level Three)
AC-10Application control rulesets validated at least annually2Application control, requirement 10 of Appendix D (required at Maturity Level Two and Maturity Level Three)
AC-11Allowed and blocked application control events centrally logged2Application control, requirement 11 of Appendix D (required at Maturity Level Two and Maturity Level Three)
AC-12Event logs protected from modification and deletion2Application control, requirement 12 of Appendix D (required at Maturity Level Two and Maturity Level Three)
AC-13Internet-facing server event logs analysed promptly2Application control, requirement 13 of Appendix D (required at Maturity Level Two and Maturity Level Three)
AC-14Internal server event logs analysed promptly3Application control, requirement 14 of Appendix D (required at Maturity Level Three)
AC-15Workstation event logs analysed promptly3Application control, requirement 15 of Appendix D (required at Maturity Level Three)
AC-16Cyber security events analysed promptly for incidents2Application control, requirement 16 of Appendix D (required at Maturity Level Two and Maturity Level Three)
AC-17Incidents reported to the CISO or a delegate2Application control, requirement 17 of Appendix D (required at Maturity Level Two and Maturity Level Three)
AC-18Incidents reported to ASD2Application control, requirement 18 of Appendix D (required at Maturity Level Two and Maturity Level Three)
AC-19Incident response plan enacted2Application control, requirement 19 of Appendix D (required at Maturity Level Two and Maturity Level Three)

Restrict Microsoft Office macros

RefControlMaturity levelCitation
ROM-01Macros disabled for users without a business requirement1Restrict Microsoft Office macros, requirement 1 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
ROM-02Only sandboxed, Trusted Location or trusted-signed macros run3Restrict Microsoft Office macros, requirement 2 of Appendix D (required at Maturity Level Three)
ROM-03Macros checked for malicious code before signing or trusting3Restrict Microsoft Office macros, requirement 3 of Appendix D (required at Maturity Level Three)
ROM-04Only macro checkers can write to Trusted Locations3Restrict Microsoft Office macros, requirement 4 of Appendix D (required at Maturity Level Three)
ROM-05Macros signed by untrusted publishers can't be enabled3Restrict Microsoft Office macros, requirement 5 of Appendix D (required at Maturity Level Three)
ROM-06Macros without V3 signatures can't be enabled3Restrict Microsoft Office macros, requirement 6 of Appendix D (required at Maturity Level Three)
ROM-07Trusted publishers list validated at least annually3Restrict Microsoft Office macros, requirement 7 of Appendix D (required at Maturity Level Three)
ROM-08Macros in files from the internet blocked1Restrict Microsoft Office macros, requirement 8 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
ROM-09Macro antivirus scanning enabled1Restrict Microsoft Office macros, requirement 9 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
ROM-10Macros blocked from making Win32 API calls2Restrict Microsoft Office macros, requirement 10 of Appendix D (required at Maturity Level Two and Maturity Level Three)
ROM-11Users can't change macro security settings1Restrict Microsoft Office macros, requirement 11 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)

User application hardening

RefControlMaturity levelCitation
UAH-01Internet Explorer 11 disabled or removed1User application hardening, requirement 1 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
UAH-02Web browsers don't process Java from the internet1User application hardening, requirement 2 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
UAH-03Web browsers don't process web advertisements from the internet1User application hardening, requirement 3 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
UAH-04Web browsers hardened to ASD and vendor guidance2User application hardening, requirement 4 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-05Users can't change web browser security settings1User application hardening, requirement 5 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
UAH-06Microsoft Office blocked from creating child processes2User application hardening, requirement 6 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-07Microsoft Office blocked from creating executable content2User application hardening, requirement 7 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-08Microsoft Office blocked from injecting code into other processes2User application hardening, requirement 8 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-09Microsoft Office prevents activation of OLE packages2User application hardening, requirement 9 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-10Office productivity suites hardened to ASD and vendor guidance2User application hardening, requirement 10 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-11Users can't change office productivity suite security settings2User application hardening, requirement 11 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-12PDF software blocked from creating child processes2User application hardening, requirement 12 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-13PDF software hardened to ASD and vendor guidance2User application hardening, requirement 13 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-14Users can't change PDF software security settings2User application hardening, requirement 14 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-15.NET Framework 3.5 disabled or removed3User application hardening, requirement 15 of Appendix D (required at Maturity Level Three)
UAH-16Windows PowerShell 2.0 disabled or removed3User application hardening, requirement 16 of Appendix D (required at Maturity Level Three)
UAH-17PowerShell in Constrained Language Mode3User application hardening, requirement 17 of Appendix D (required at Maturity Level Three)
UAH-18PowerShell logging events centrally logged2User application hardening, requirement 18 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-19Command line process creation events centrally logged2User application hardening, requirement 19 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-20Event logs protected from modification and deletion2User application hardening, requirement 20 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-21Internet-facing server event logs analysed promptly2User application hardening, requirement 21 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-22Internal server event logs analysed promptly3User application hardening, requirement 22 of Appendix D (required at Maturity Level Three)
UAH-23Workstation event logs analysed promptly3User application hardening, requirement 23 of Appendix D (required at Maturity Level Three)
UAH-24Cyber security events analysed promptly for incidents2User application hardening, requirement 24 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-25Incidents reported to the CISO or a delegate2User application hardening, requirement 25 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-26Incidents reported to ASD2User application hardening, requirement 26 of Appendix D (required at Maturity Level Two and Maturity Level Three)
UAH-27Incident response plan enacted2User application hardening, requirement 27 of Appendix D (required at Maturity Level Two and Maturity Level Three)

Regular backups

RefControlMaturity levelCitation
RB-01Backups performed and retained to business criticality and continuity needs1Regular backups, requirement 1 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RB-02Backups synchronised to a common point in time1Regular backups, requirement 2 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RB-03Backups retained securely and resiliently1Regular backups, requirement 3 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RB-04Restoration to a common point in time tested in disaster recovery exercises1Regular backups, requirement 4 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RB-05Unprivileged accounts can't access other accounts' backups1Regular backups, requirement 5 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RB-06Unprivileged accounts can't access their own backups3Regular backups, requirement 6 of Appendix D (required at Maturity Level Three)
RB-07Privileged accounts (not backup administrators) can't access other accounts' backups2Regular backups, requirement 7 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RB-08Privileged accounts (not backup administrators) can't access their own backups3Regular backups, requirement 8 of Appendix D (required at Maturity Level Three)
RB-09Unprivileged accounts can't modify or delete backups1Regular backups, requirement 9 of Appendix D (required at Maturity Level One, Maturity Level Two and Maturity Level Three)
RB-10Privileged accounts (not backup administrators) can't modify or delete backups2Regular backups, requirement 10 of Appendix D (required at Maturity Level Two and Maturity Level Three)
RB-11Backup administrators can't modify or delete backups during retention3Regular backups, requirement 11 of Appendix D (required at Maturity Level Three)

Other frameworks

Facts are as shipped in made. Shield, read from each primary source on the date shown. They describe the law; they aren't legal advice, and your organisation decides how they apply to it.