Every E8 control, mapped to a config you can deploy

ASD updated the Essential Eight maturity model (November 2023 and subsequent guidance), tightening what each level requires. The gap for most agencies is not knowing the controls, it is translating them into settings that are actually deployed and checkable. That translation is the whole product.

1. The translation problem. Why control text is not a configuration.
2. The mapping. Each of the eight, tied to a named Azure or Entra setting.
3. Toggleable modules. How agencies self-select what they deploy.
4. Checkable, not claimed. How each mapped control is verified.
5. Where the map is honest. Controls that config alone cannot satisfy.

A delivery and engineering reference piece that is the backbone of the Essential 8 product: pre-canned IaC modules, self-selected, deployed. It proves the anti-strategy-document positioning better than any other page.

• Lead with the how, not the threat; this is a build reference.
• Make the toggleable-module model explicit; it is the Deploy tier.
• Flag where config is not enough, setting up the assurance dive.
• Keep it evergreen but anchored to the current maturity model.