The ASD Essential 8 policy pack maps the Australian Signals Directorate’s Essential Eight mitigation strategies to checks that the Anchore Enterprise policy engine can evaluate against container images and SBOMs. The pack covers Maturity Levels 1 through 3 and ships as a single bundle ready to import as a policy.
Current ASD Essential 8 policy pack version: Anchore ASD Essential 8 Level 1-3 v2026.1
Introduction
The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate as a baseline against the attacks it sees most often. Implementation is mandatory for Australian federal government entities and widely adopted by state agencies, critical infrastructure operators, and their suppliers. Progress is measured in maturity levels, tiered against increasingly capable adversary tradecraft; every rule set in this pack applies at Maturity Levels 1 through 3.
Four of the eight strategies are reachable from container image content: patch applications, patch operating systems, restrict administrative privileges, and application control. The rest (application hardening, macro settings, multi-factor authentication, and backups) depend on organizational process or runtime configuration and are not represented in the bundle. Rule sets are named by strategy and ISM control identifier, so a finding maps straight back to the control it supports.
Controls
Anchore Enterprise checks for the following control specifications against container images. The rule set marked Required in the Configuration column ships with a placeholder value and must be configured for your environment before the policy is used. See Configure Rule Sets.
| Mitigation strategy | Rule set | Anchore role | Configuration |
|---|---|---|---|
| Patch applications | Patch Applications ISM-1690 - KEV | Fail on any non-OS vulnerability listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, regardless of severity | |
| Patch applications | Patch Applications ISM-1690 | Warn on non-critical non-OS vulnerabilities that have a fix available, then fail once that fix has been available for more than 14 days | |
| Patch applications | Patch Applications ISM-1876 | Fail on critical-severity vulnerabilities in OS packages | |
| Patch applications | Patch Applications ISM-1808 | Fail when the vulnerability feed has not synced in 7 days | |
| Patch operating systems | Patch OS ISM-1876 - KEV | Fail on any OS vulnerability listed on the KEV catalog, regardless of severity | |
| Patch operating systems | Patch OS ISM-1877 | Fail on critical-severity vulnerabilities in OS packages | |
| Patch operating systems | Patch OS ISM-1694 | Fail on non-critical OS vulnerabilities, not listed on the KEV catalog, whose fix has been available for more than 14 days | |
| Patch operating systems | Patch OS ISM-1808 | Fail when the vulnerability feed has not synced in 7 days | |
| Restrict administrative privileges | Restrict Admin Privileges - ISM-1688 | Fail images whose effective user is root or docker | |
| Application control | Application Control - ISM-1657 | Fail images containing a denied package (openssh version 1.0.1 by default) | Required |
The two patching timelines the Essential Eight sets out are split across the rule sets rather than expressed in one: the 48-hour requirement for critical vulnerabilities and working exploits is enforced as an immediate failure (ISM-1876, ISM-1877, and the KEV rule sets), while the two-week requirement for non-critical vulnerabilities is enforced through the max_days_since_fix threshold in ISM-1690 and ISM-1694.
VEX Annotations
Every vulnerability rule set in this pack is split into two rules that differ only in annotation state, as described in Annotations and VEX:
- One rule matches findings that carry no annotation yet, so un-triaged vulnerabilities still fail the policy.
- The other matches findings annotated
affectedorunder_investigation, so vulnerabilities you have assessed as genuinely exploitable keep failing it.
Findings annotated not_affected or fixed match neither rule. Recording an accurate VEX assessment therefore clears the finding from the evaluation without an allowlist entry, and the compliance result refreshes as soon as the annotation is saved. The non-vulnerability rule sets (feed currency, effective user, and application control) do not depend on annotation state.
SBOM Rule Sets
The pack ships parallel rule sets bound to the SBOM mapping, so the patching strategies apply to imported SBOMs as well as scanned images: Patch Applications ISM-1690 - KEV (SBOM), Patch Applications ISM-1876 (SBOM), Patch Applications ISM-1690 (SBOM), Patch OS ISM-1877 (SBOM), and Patch OS ISM-1694 (SBOM). They carry the same VEX rule pairing as their image counterparts.
Restrict administrative privileges, application control, and the feed-currency checks depend on image content or deployment state and are bound to the image mapping only.
Use the Pack
Import the pack like any other policy. See Manage Policies for the GUI, AnchoreCTL, and API workflows. Once imported, scope it to the registries and repositories it should apply to through Policy Mappings, and attach any allowlists you need before activating it as the account’s default policy.
The ASD Essential 8 pack is intended as a starting point. Most teams customize mappings, attach allowlists for accepted risks, or layer additional rule sets on top before activating the pack against production registries.
Configure Rule Sets
Application Control - ISM-1657 ships with a placeholder denied package, openssh at version 1.0.1, that stands in for the organization-approved software set the control calls for. It is tagged [CONFIGURE] in its rule set name in the GUI. Replace the placeholder with the packages you prohibit, using the policy’s Edit action in the Anchore Enterprise GUI (see Manage Policies), before you rely on the pack’s results.
The pack’s other rule sets are usable as shipped, though the two feed-currency thresholds (7 days) and the two patch-age thresholds (14 days) are worth reviewing against the scanning cadence and maturity level you are certifying to.