Assessment evidence guide for enterprise IT - Potential Evidence Sources OSCAL Control Mapping 2026-10-15T00:30:23Z

2026-10-15T00:30:23Z

2026.10.15

1.2.3

Document creator Australian Cyber Security Centre

ACSC

asd.assist@defence.gov.au

Australian Cyber Security Centre

General enquiries

PO Box 5076

Kingston ACT

2604

15ea53b3-4eae-5a76-b56f-393a0a7bd5c5

Consumers of this file should refer to the Essentials OSCAL NS 1.0 page for information regarding the Essentials specific representation used in this OSCAL file.

This file is generated from the Potential Evidence Sources in the Assessment evidence guide for enterprise IT.

Potential Evidence Sources

Organisations may choose to leverage controls from a variety of sources when addressing the Essentials principles. The effectiveness of a mitigation must also be considered in context of each individual domain, rather than organisation wide; a set of controls that may be effective for one domain does not automatically guarantee effectiveness for another domain.

References to independent cyber security frameworks have been included for each action, which indicate where supporting evidence of that action’s effectiveness may exist (if an organisation has adopted that framework already). The list is not intended to define the controls required to meet the intent of the actions.

intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with intersects-with

E4EIT to ISM (excl. E8)

E4EIT to E8

E4EIT to CSF

E4EIT to 800-171r3

The mapped resource is a control catalog that is not provided in an OSCAL format.

E4EIT to AESCSF

Assessment evidence guide for enterprise IT OSCAL mapping-collection v2026.10.15 Assessment evidence guide for enterprise IT OSCAL mapping-collection - latest version Assessment evidence guide for enterprise IT OSCAL mapping-collection v2026.10.15 - predecessor version Assessment evidence guide for enterprise IT OSCAL mapping-collection v2026.10.15 - successor version Assessment evidence guide for enterprise IT OSCAL catalog v2026.10.15 Assessment evidence guide for enterprise IT ASD’s Information Security Manual v2026.09.4 ASD’s Essential Eight 02 Oct 2024 NIST Cybersecurity Framework 2.0 NIST SP 800-171r3 publication, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations” AEMO’s Australian Energy Sector Cyber Security Framework v2 Essentials OSCAL NS 1.0