Mapping WinSentinel to the ACSC Essential Eight

The Australian Cyber Security Centre's Essential Eight is one of the most pragmatic control frameworks in circulation. Where CIS ships hundreds of settings and NIST 800-53 reads like a legal contract, the Essential Eight distils real-world incident data into eight mitigation strategies and grades your implementation across four maturity levels (0 through 3). It's mandatory for Australian federal entities under the PSPF, and increasingly a contractual baseline for anyone selling into government or critical infrastructure.

The friction is the same as every framework: the strategies are written as policy outcomes, not as Windows registry keys and audit events. This post maps each of the eight strategies to the concrete checks WinSentinel already runs on a Windows host, so you can turn an abstract maturity target into a per-machine gap list.

The eight strategies, mapped to Windows evidence

The Essential Eight groups controls into three objectives: prevent attacks, limit their extent, and recover data. Here is how each maps to host telemetry you can actually collect.

1. Application control

Maturity Level 1 wants execution of unapproved apps prevented in user-writable locations; Level 2+ wants a full allowlist enforced and its rulesets validated against Microsoft's recommended block list. WinSentinel audits WDAC and AppLocker policy state, checks whether enforcement (not just audit) mode is active, and flags the classic gap where a policy exists but only logs. See the deep-dive on WDAC and AppLocker for the enforcement-vs-audit trap.

2. Patch applications

The model demands patching internet-facing apps within 48 hours for critical vulnerabilities and a vulnerability scanner run at least fortnightly. WinSentinel tracks installed software versions and update currency, so you can surface machines where a browser or PDF reader has drifted past the SLA rather than trusting a spreadsheet.

3. Configure Microsoft Office macro settings

Level 1 blocks macros from the internet; higher levels block all macros except in vetted, sandboxed cases and enable macro antivirus scanning. WinSentinel reads the Office trust-center registry policies (VBAWarnings, BlockContentExecutionFromInternet) and reports which are unset — the most common quiet failure, since a fresh Office install ships permissive.

4. User application hardening

This covers blocking Flash (gone, but the policy lingers), web ads, Java, and — critically — disabling or hardening scripting engines and enabling ASR rules. WinSentinel audits Attack Surface Reduction rules, the Windows Script Host surface, and browser security posture in one pass.

5. Restrict administrative privileges

Just-in-time and least-privilege admin, with privileged accounts blocked from email and web browsing. WinSentinel enumerates local administrators, flags standing local-admin accounts, and checks LAPS deployment for rotated local admin passwords — the Level 2 requirement that trips most fleets.

6. Patch operating systems

OS patches for critical vulnerabilities within 48 hours, and unsupported operating systems removed entirely. WinSentinel reports the Windows build, support status, and update history, so an out-of-support host — an automatic Maturity Level 0 — can't hide in the corner of the fleet.

7. Multi-factor authentication

MFA for remote access, privileged actions, and important data repositories. On the host side WinSentinel checks Windows Hello for Business posture and RDP hardening, giving you evidence that phishing-resistant factors are actually provisioned rather than merely licensed.

8. Regular backups

Backups performed, retained, and — the part attackers exploit — protected from tampering. WinSentinel audits VSS shadow copy integrity and detects the deletion patterns ransomware uses before encryption, closing the loop between the backup strategy and the machine that actually holds the data.

From per-host findings to a maturity score

Because every strategy above resolves to a concrete host check, you can express Essential Eight maturity as a per-machine gap list rather than an annual attestation. A useful pattern:

1. Run the relevant WinSentinel modules and export findings.
2. Tag each finding with its strategy number and the maturity level it blocks.
3. The machine's maturity is the minimum level satisfied across all eight — one failing macro policy caps you at Level 0 no matter how good your patching is.

Maturity is a minimum, not an average. This is the single most misunderstood part of the model, and the reason a single unhardened setting can quietly demote an otherwise strong host.

Where Free ends and Pro begins

Every check described here runs on a single machine with the free WinSentinel — all 33 modules, no limits, full application-control, patching, macro, ASR, privilege, MFA, and backup auditing on that host. That is enough to grade one machine against all eight strategies.

What changes at fleet scale is the reporting problem. When you're proving Essential Eight maturity across fifty or five hundred endpoints, you need the Pro capabilities: a central node that rolls each host's per-strategy findings into a fleet-wide maturity view, alerts when a machine drifts below its target level, and produces the compliance rollup an auditor actually wants. Pro doesn't add controls — the controls all live on the host — it aggregates and watches them across the organisation.

Getting started

Pick one representative machine, run WinSentinel, and map the findings to the eight strategies above. You'll almost always discover you're closer on patching and privileges than on macros and application control — the two strategies that require deliberate policy, not just default hygiene. Fix those, re-scan, and you have a repeatable, evidence-backed path from "we think we're compliant" to a maturity level you can defend.