ASD Essential Eight and ISM Tests
These tests verify Microsoft 365 tenant configuration against the Essential Eight and the Information security manual (ISM), both published by the Australian Signals Directorate (ASD). You may know them as the ACSC Essential Eight and the ACSC ISM: the Australian Cyber Security Centre (ACSC) is part of ASD. The Essential Eight maturity model (November 2023) sets requirements at Maturity Level One to Three, and ASD maps each requirement to an ISM control, so each test is named after the ISM control it checks: ASD.ISM-1504 checks ISM-1504. A few tests check ISM controls outside the Essential Eight, such as ASD.ISM-1403.
Tests
| Test ID | Title | Severity | Product | Feature |
|---|---|---|---|---|
| ASD.ISM-1175 | Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services. | High | Entra ID | Roles and administrators |
| ASD.ISM-1403 | User accounts are protected by lockout mechanisms aligned to a maximum of five failed logon attempts. | Medium | Entra ID | Password protection |
| ASD.ISM-1488 | Microsoft Office macros in files originating from the internet are blocked. | Medium | Intune | Device configuration |
| ASD.ISM-1504 | Multi-factor authentication is used to authenticate human users to their organisation's online services. | High | Entra ID | Conditional Access |
| ASD.ISM-1648 | Privileged access to systems and their resources is disabled after 45 days of inactivity. | Medium | Entra ID | Roles and administrators |
| ASD.ISM-1649 | Just-in-time administration is used for the administration of systems and their resources. | High | Entra ID | Privileged Identity Management |
| ASD.ISM-1654 | Internet Explorer 11 is disabled or removed. | Low | Intune | Device configuration |
| ASD.ISM-1667 | Microsoft Office is blocked from creating child processes. | High | Intune | Endpoint security |
| ASD.ISM-1668 | Microsoft Office is blocked from creating executable content. | High | Intune | Endpoint security |
| ASD.ISM-1669 | Microsoft Office is blocked from injecting code into other processes. | High | Intune | Endpoint security |
| ASD.ISM-1672 | Microsoft Office macro antivirus scanning is enabled. | Medium | Intune | Device configuration |
| ASD.ISM-1673 | Microsoft Office macros are blocked from making Win32 API calls. | High | Intune | Endpoint security |
| ASD.ISM-1695 | Patches for vulnerabilities in the operating systems of workstations are applied within one month of release. | High | Intune | Device configuration |
| ASD.ISM-1872 | Multi-factor authentication used for authenticating human users of online services is phishing-resistant. | High | Entra ID | Conditional Access |