Are You Really Aligned with Essential Eight and CIS Controls?

A Security Audit in Microsoft 365 Can Give You the Answers

From the field: In this post, A1 Technologies engineer Jarrod shares practical insights from a recent client conversation—highlighting how organisations can assess and improve their alignment with the Essential 8 and CIS Controls using tools already built into Microsoft 365.

I was speaking with a client this week about the Essential 8 framework, and it got me thinking—how many organisations know they can perform their own security audits using Microsoft 365’s Compliance Center?

Across Australia and New Zealand, cyber threats like ransomware, phishing, and data breaches are growing more sophisticated. Organisations now face pressure not just to defend their systems, but to prove they are actively complying with recognised frameworks like the Essential 8 and CIS Controls.

Here’s the challenge: many organisations assume they’re aligned—until an audit shows otherwise.

Why Essential 8 Compliance Isn’t Optional Anymore

If you’re working with government, critical infrastructure, or sensitive customer data, proving compliance is no longer optional. Essential 8 alignment is now commonly required in:

• Supplier contracts

• Cyber insurance policies

• Regulatory assessments

• Board-level risk frameworks

Unlike theoretical models, the Essential 8 focuses on clear, implementable security controls:

• Patch applications

• Patch operating systems

• Multi-factor authentication (MFA)

• Restrict administrative privileges

• Application control

• Restrict Microsoft Office macros

• User application hardening

• Regular backups

The CIS Controls expand on these areas, addressing broader operational readiness such as asset inventory, access management, and incident response.

If your organisation needs help aligning with these security standards, our Microsoft Cloud Security services can support implementation and ongoing compliance.

Where Essential 8 Audits Often Reveal Gaps

In my experience, audits designed to assess Essential 8 maturity often uncover issues in expected places. These include:

• Delayed patching for apps and operating systems

• Legacy admin accounts that haven’t been deactivated

• MFA enabled but not fully enforced

• External data sharing without proper governance

These gaps quietly erode your compliance standing—and your security posture. A well-executed audit connects the dots between security flaws and framework controls, helping you prioritise what to fix first.

What to Include in an Essential 8 Security Audit

At A1 Technologies, we align every audit with the Essential 8 and CIS Controls frameworks. This ensures your organisation isn’t just secure, but verifiably compliant. Our process typically includes:

• Microsoft 365 security configuration review

• Azure Active Directory assessment, including Conditional Access and identity hygiene

• Endpoint protection and patching audit

• Review of administrative privileges and access management

• Backup and disaster recovery procedures

Each finding is mapped to a specific Essential 8 control, so there’s no ambiguity about where you stand—and what action is required. We also integrate visibility tools like Microsoft Sentinel for advanced monitoring and alerting.

How to Use Microsoft 365 Compliance Center for Essential 8 Reviews

Microsoft 365’s Compliance Center provides powerful tools for assessing your environment against the Essential 8 framework. If you’re unfamiliar with how to navigate these tools or interpret the results, our team can help you get started.

1. Log into the Microsoft 365 Compliance Center

2. Open the Compliance Manager section

3. Choose the Essential 8 or CIS Controls assessment template

4. Run a review using the built-in control mappings and scorecard

5. Generate reports that highlight non-compliance areas and suggest remediation steps

We work with IT leaders to interpret these reports, fine-tune configurations, and prioritise remediation based on business risk. If you’d like support navigating this process, our Microsoft 365 Consulting Services are designed to help you leverage tools like Compliance Manager to meet your compliance and security goals.

What If You’re Using Third-Party Security Tools?

Many organisations I work with use third-party tools for antivirus, EDR, backup, or application control. That’s not a problem—you can still demonstrate Essential 8 compliance by uploading manual evidence in Compliance Manager.

To assign a control manually:

1. Identify the required control

2. Gather documentation such as screenshots, policies, or logs

3. Upload these artifacts into Compliance Manager under the appropriate control

4. Assign responsibility to the relevant team or individual

5. Regularly update status and evidence to maintain compliance visibility

Our Microsoft Cloud Security experts can guide you in structuring your documentation and assigning appropriate control owners.

Why the Essential 8 Matters More Than Ever

The ACSC continues to emphasise adoption of the Essential 8 as a minimum cyber resilience baseline. Globally, CIS Controls are being referenced in compliance and cyber insurance contexts.

When something goes wrong, it’s no longer just an IT issue—boards, insurers, and regulators will all be asking:

“What were you doing to protect your environment?”

A security audit gives you the answer. It provides evidence, clarity, and a structured path to improve.

If you’re also looking for proactive monitoring and response, our MDR for Microsoft 365 offering can give you ongoing protection beyond the audit.

Need Help Getting Started?

I’ve supported many Australian and New Zealand organisations through Essential 8 assessments, audits, and remediation. If you’re unsure how to interpret your Microsoft 365 configuration or simply want a second set of eyes—feel free to connect. I’m always happy to share insights or point you in the right direction.

Jarrod Taylor

Jarrod Taylor is a Microsoft Engineer at A1 Technologies, a Microsoft consultancy based in Australia. He specialises in the design, implementation, and support of Microsoft-based platforms, applications, and solutions. Jarrod is passionate about delivering exceptional customer service and helping clients get real results from their IT environments.