Book a demo

Essential Eight ML2 evidence checklist

A practical list of Maturity Level 2 artefacts. Use it to prepare, then let Constant collect, pre-review, and assess them.

How to use the checklist

An Essential Eight evidence checklist lists the artefacts that show Maturity Level 2, strategy by strategy. It is a preparation aid, not a substitute for assessor judgement.

Collect the items below, attach them to the control in Constant, and have a certified assessor review whether they meet ML2.

ML2 evidence checklist

Application control

  • ML2 requirement: application control on workstations and internet-facing servers.
  • Evidence: the application control policy, and a coverage report for workstations and internet-facing servers.

Patch applications

  • ML2 requirement: patch non-internet-facing applications within one month.
  • Evidence: patch or vulnerability reports that show timing for those applications.

Configure Microsoft Office macros

  • ML2 requirement: block macros in files from untrusted sources.
  • Evidence: the macro configuration policy and how exceptions are handled.

User application hardening

  • ML2 requirement: extended hardening, including web browsers.
  • Evidence: hardening baselines and browser policy as applied to users.

Restrict administrative privileges

  • ML2 requirement: dedicated admin workstations and multi-factor authentication.
  • Evidence: privileged account inventory, admin workstation standard, and MFA enrolment for those accounts.

Patch operating systems

  • ML2 requirement: patch all operating systems within one month.
  • Evidence: inventory plus patch records that show operating system coverage and timing.

Multi-factor authentication

  • ML2 requirement: MFA for all users accessing important data.
  • Evidence: enrolment and policy reports for those users, not only for administrators.

Regular backups

  • ML2 requirement: backups synchronised with the retention policy.
  • Evidence: backup scope, retention settings, and a recent restoration test.

After the checklist

A checklist shows what to gather. Constant is where those artefacts stay linked to the strategy, get an AI pre-review, and go to a certified assessor.

Essential Eight Maturity Level 2

Check scope and freshness

An artefact should identify the relevant systems or users, show the period it covers, and be recent enough to support the claimed implementation. A policy without operating evidence is rarely enough on its own.

Use ASD’s current maturity model as the authority. This checklist is practical preparation and may need to change when official requirements change.

Sources and further reading

Last reviewed 23 September 2026.

Related pages

Maturity Level 2

Essential Eight Maturity Level 2 requirements and the evidence behind them.

Evidence collection

Automated Essential Eight evidence collection, plus upload where needed.

Maturity assessment

Essential Eight maturity assessment software for ML1, ML2, and ML3.

ASD Essentials

The ASD Essentials transition tracker. What ASD has published, and what it has not.

Questions answered

What evidence is needed for Essential Eight Maturity Level 2?

Each strategy has its own ML2 bar. Typical artefacts include application control coverage, patch timing reports, macro and hardening policy, privileged access and MFA records, and backup retention with a restoration test. The checklist on this page lists them. A certified assessor still has to decide whether the artefact meets the level.

Is this checklist a formal ACSC assessment?

No. It is a preparation list aligned to the Maturity Level 2 capabilities Constant tracks. It does not replace an assessor review or an official ACSC publication.

Does finishing this checklist mean we are at Maturity Level 2?

No. The checklist shows what to gather. A certified assessor still decides whether each artefact meets Maturity Level 2.

Where do checklist artefacts go in Constant?

Attach them to the control. Constant links the artefact to the strategy, uses AI to pre-review it, and has a certified assessor review whether it meets the level.

Start your compliance journey today

Choose the right plan for your organisation. Scale seamlessly as your compliance needs evolve.

Ready to simplify your compliance process?

Book a demo and see constant in action.

Book a Demo Explore More

All Paid Plans Include

  • Unlimited human assessor reviews

  • Evidence collection

  • AI-assisted pre-reviews

  • Compliance dashboards

  • Australian business-hours support

  • On-demand reporting

  • Control owners and tasks

  • Evidence uploads

  • Maturity and gap tracking

  • Role-based access controls

  • Framework guidance

  • 5×5 Risk Matrix

  • Australian data residency