Achieved maturity
L0
Essential Eight automated evidence collection
Link every Essential Eight control to the artefact that proves it, collected automatically where you are connected and uploaded where you are not.
Evidence that stays linked to the requirement
Essential Eight evidence is the artefact that shows a strategy is implemented at a maturity level, not a policy that says it should be.
Constant collects evidence automatically where a supported integration is connected, and by upload where it is not. AI pre-reviews that evidence, and a certified assessor reviews the result before it is reported.
From source system to reviewed evidence
What good evidence looks like
Assessors look for something that matches the strategy and the level. A patch report that shows timing. An application control policy and where it is enforced. An MFA enrolment record. A backup restoration test.
Constant links those artefacts to the control. Supported integrations can collect them. Microsoft Defender is one example of security tooling Constant can work with. Anything without a connector is uploaded and reviewed the same way.
Collection is not the assessment
A connector can show a configuration or event from a source system. The assessment still needs to determine whether that artefact covers the right systems, period, and maturity requirement.
Constant separates collection, AI-assisted checking, and human assessor review so an automated check is not presented as final assurance.
Sources and further reading
Last reviewed 23 September 2026.
Questions answered
What is Essential Eight evidence automation?
It is collecting Essential Eight artefacts from connected systems, instead of asking people for screenshots before every review. Constant collects evidence automatically where a supported integration is connected, and accepts uploads where it is not. AI pre-reviews the evidence and a certified assessor reviews the result.
Which integrations does Constant use for evidence?
Constant supports API and integrations, including Microsoft security tooling such as Microsoft Defender, and manual upload when a connector is not used. Evidence from either path is linked to the control and reviewed.
What if there is no integration for a control?
Upload the artefact. Constant still links it to the control, uses AI to pre-review it, and has a certified assessor review the result. Automated collection is used where a supported integration is connected.
Does Microsoft Defender replace an Essential Eight assessment?
No. Microsoft Defender is an example of security tooling Constant can work with. It can supply evidence. A certified assessor still reviews whether that evidence meets the maturity level.
Start your compliance journey today
Choose the right plan for your organisation. Scale seamlessly as your compliance needs evolve.
Ready to simplify your compliance process?
Book a demo and see constant in action.
All Paid Plans Include
-
Unlimited human assessor reviews
-
Evidence collection
-
AI-assisted pre-reviews
-
Compliance dashboards
-
Australian business-hours support
-
On-demand reporting
-
Control owners and tasks
-
Evidence uploads
-
Maturity and gap tracking
-
Role-based access controls
-
Framework guidance
-
5×5 Risk Matrix
-
Australian data residency