ASD Essential 8

The ASD Essential 8 policy pack maps the Australian Signals Directorate’s Essential Eight mitigation strategies to checks that the Anchore Enterprise policy engine can evaluate against container images and SBOMs. The pack covers Maturity Levels 1 through 3 and ships as a single bundle ready to import as a policy.

Current ASD Essential 8 policy pack version: Anchore ASD Essential 8 Level 1-3 v2026.1

Introduction

The Essential Eight is a set of eight mitigation strategies published by the Australian Signals Directorate as a baseline against the attacks it sees most often. Implementation is mandatory for Australian federal government entities and widely adopted by state agencies, critical infrastructure operators, and their suppliers. Progress is measured in maturity levels, tiered against increasingly capable adversary tradecraft; every rule set in this pack applies at Maturity Levels 1 through 3.

Four of the eight strategies are reachable from container image content: patch applications, patch operating systems, restrict administrative privileges, and application control. The rest (application hardening, macro settings, multi-factor authentication, and backups) depend on organizational process or runtime configuration and are not represented in the bundle. Rule sets are named by strategy and ISM control identifier, so a finding maps straight back to the control it supports.

Controls

Anchore Enterprise checks for the following control specifications against container images. The rule set marked Required in the Configuration column ships with a placeholder value and must be configured for your environment before the policy is used. See Configure Rule Sets.

The two patching timelines the Essential Eight sets out are split across the rule sets rather than expressed in one: the 48-hour requirement for critical vulnerabilities and working exploits is enforced as an immediate failure (ISM-1876, ISM-1877, and the KEV rule sets), while the two-week requirement for non-critical vulnerabilities is enforced through the max_days_since_fix threshold in ISM-1690 and ISM-1694.

VEX Annotations

Every vulnerability rule set in this pack is split into two rules that differ only in annotation state, as described in Annotations and VEX:

• One rule matches findings that carry no annotation yet, so un-triaged vulnerabilities still fail the policy.
• The other matches findings annotated affected or under_investigation, so vulnerabilities you have assessed as genuinely exploitable keep failing it.

Findings annotated not_affected or fixed match neither rule. Recording an accurate VEX assessment therefore clears the finding from the evaluation without an allowlist entry, and the compliance result refreshes as soon as the annotation is saved. The non-vulnerability rule sets (feed currency, effective user, and application control) do not depend on annotation state.

SBOM Rule Sets

The pack ships parallel rule sets bound to the SBOM mapping, so the patching strategies apply to imported SBOMs as well as scanned images: Patch Applications ISM-1690 - KEV (SBOM), Patch Applications ISM-1876 (SBOM), Patch Applications ISM-1690 (SBOM), Patch OS ISM-1877 (SBOM), and Patch OS ISM-1694 (SBOM). They carry the same VEX rule pairing as their image counterparts.

Restrict administrative privileges, application control, and the feed-currency checks depend on image content or deployment state and are bound to the image mapping only.

Use the Pack

Import the pack like any other policy. See Manage Policies for the GUI, AnchoreCTL, and API workflows. Once imported, scope it to the registries and repositories it should apply to through Policy Mappings, and attach any allowlists you need before activating it as the account’s default policy.

The ASD Essential 8 pack is intended as a starting point. Most teams customize mappings, attach allowlists for accepted risks, or layer additional rule sets on top before activating the pack against production registries.

Configure Rule Sets

Application Control - ISM-1657 ships with a placeholder denied package, openssh at version 1.0.1, that stands in for the organization-approved software set the control calls for. It is tagged [CONFIGURE] in its rule set name in the GUI. Replace the placeholder with the packages you prohibit, using the policy’s Edit action in the Anchore Enterprise GUI (see Manage Policies), before you rely on the pack’s results.

The pack’s other rule sets are usable as shipped, though the two feed-currency thresholds (7 days) and the two patch-age thresholds (14 days) are worth reviewing against the scanning cadence and maturity level you are certifying to.