ASD Essentials guide

The ASD Essentials
Explained

By Michael, Founder · Reviewed October 2026

ASD launched the ASD Essentials on 15 October 2026. The Essential Eight is being superseded by it, and both apply during the transition. Here is how the new framework works, which chapter fits your business and what to do now.

Get a free security assessment
Talk to us
  • Reviewed October 2026
  • Sourced from ASD
  • SMB1001 Gold achieved
IT consultant and office manager planning security improvements
Both apply

The Essential Eight and ASD Essentials run side by side for now.

15 Oct 2026

ASD Essentials launched

3

Chapters so far

8

Domains in enterprise IT

No end date

Set for the Essential Eight

The basics

What is the ASD Essentials?

The ASD Essentials is a cyber security framework from the Australian Signals Directorate (ASD). ASD describes it as principles-based and threat-informed, giving organisations a consistent approach to security across different technology environments. It sets out the outcomes to achieve rather than prescribing a product, vendor or architecture, and it aligns with ASD’s Information Security Manual.

ASD launched it as an evolution of the Essential Eight, and its own FAQ asks “Why is ASD replacing the Essential Eight?”. The answer: threats have moved on, and the environments organisations run are more complex.

Who it is written for

ASD wrote the Essentials primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations. Smaller businesses can still use it where relevant. In ASD’s words, the outcomes “are equally important for smaller organisations. What differs is how those outcomes are achieved and how much responsibility sits with service providers and vendors.”

The publications
  • ASD Essentials for enterprise IT
  • ASD Essentials for cloud
  • ASD Essentials for OT
  • AI considerations within the Essentials
  • Guides on transition, planning and assessment
How it is built

Principles, actions and domains

Every chapter uses the same three layers.

The outcome

Principles

Describe the security outcomes an organisation should achieve. They come from the cyber security principles in ASD’s Information Security Manual, and their codes (such as GOV-01) are for traceability, not an order of work.

What to do

Actions

Describe what needs to be done to reach each outcome. They are written in technology-agnostic terms, so you meet them with controls that suit your environment, risk and obligations. Many are mapped to known attacker techniques.

Where it applies

Domains

Describe the business functions and assets the actions apply to, such as identity services or user devices. A domain is a logical grouping, not a network or team boundary. Enterprise IT has six technical and two capability domains.

Choosing a chapter

Which chapter fits your business?

It comes down to the services you use and how much of the underlying technology you control. No organisation has to use every chapter or follow a set order.

Entirely on cloud services

ASD Essentials for cloud

For organisations whose technology is delivered entirely as software-as-a-service or platform-as-a-service. For a small business, that usually means running only on Microsoft 365 or Google Workspace and other cloud apps, with no servers. Your part concentrates on identity, data, tenant configuration, the integrations you connect and assurance from your providers. The laptops and phones your team uses are covered too.

Servers, on-premises or hybrid

ASD Essentials for enterprise IT

ASD’s starting point for on-premises, hybrid or infrastructure-as-a-service environments, where you’re responsible for operating systems, applications, identity infrastructure and the network. It is the evolution of the Essential Eight, so it’s where existing Essential Eight work maps across.

ASD: “Most organisations will need both chapters over time.” ASD Essentials for OT supports critical infrastructure operators protecting operational technology. AI is handled across every chapter by AI considerations within the Essentials, which treats AI as another asset.

Quick check

Where would you start with the Essentials?

See which chapter fits your business and which areas to look at first. It is a guide only, and your answers stay in your browser.

12 questionsAbout 3 minutesNo email needed

Twelve quick questions on the areas ASD puts first in the new ASD Essentials. You'll see which chapter fits your business and where to start.

Question 1 of 12How does your business run its IT?

Servers include a computer in the office that stores shared files or runs software, and virtual servers you rent from a cloud provider and manage yourselves.

Question 2 of 12: Identity servicesHow do staff sign in to email and business apps?

MFA (multi-factor authentication) means a code from your phone or an app as well as your password. Passkeys and security keys go further: you sign in with a fingerprint, face, PIN or a small USB key, and a fake sign-in page can't capture them.

Question 3 of 12: Identity servicesAre accounts nobody uses any more switched off?

Think former staff, old shared mailboxes, trial and test accounts, and default logins that came with a device or system, such as the built-in admin login on a router.

Question 4 of 12: Identity servicesIs admin access limited to the people who need it, with a separate admin account they use only for admin work?

Admin access lets someone change settings for everyone, add users or install software. A separate admin account means nobody reads email or browses the web while signed in with admin rights.

Question 5 of 12: Boundary servicesDo you know everything your business has reachable from the internet?

For example, your firewall or router, remote desktop or VPN access, a server or device staff reach from home, web admin pages and your website.

Question 6 of 12: Boundary servicesAre security updates for your internet-facing systems installed within a set timeframe, and checked?

Internet-facing systems include your firewall or router, VPN or remote access, and any server people reach from outside the office. Updates (patches) fix weaknesses attackers look for.

Question 7 of 12: Regular and proven backupsIs your business data backed up somewhere an attacker can't delete it, and has a restore been tested?

An isolated backup is a copy that can't be changed or deleted from your normal accounts, such as an immutable or offline copy. Microsoft 365 and Google Workspace keep deleted items for a while, but that isn't a separate backup.

Question 8 of 12: Governance and cultureIs a named owner, director or senior manager accountable for cyber security, including how the business uses AI?

Accountable means they make the decisions, approve the budget and hear about the risks, even when an IT provider does the work.

Question 9 of 12: Governance and cultureDo you know what your IT provider and key software suppliers are responsible for in security, and do you get current evidence they are doing it?

Evidence means things like regular reports showing updates, backups and security alerts being handled, not just what the contract said at the start.

Question 10 of 12: Governance and cultureDo staff get cyber security awareness training before they start using your systems, with refreshers after that?

For example, short online lessons on spotting scam emails, fake invoices and fake sign-in pages, and how to report something suspicious.

Question 11 of 12: Visibility and responseAre sign-in and security records kept in one place, and does someone look at the alerts and act on them?

Logs are the records of who signed in, from where, and what changed. Microsoft 365 and Google Workspace record a lot of this, but someone has to keep the records and look at them.

Question 12 of 12: Visibility and responseDo you have a written incident response plan that says who to call, who decides and who must be told, and has the team walked through it?

Who must be told can include your insurer, your bank, your clients and, for some businesses, the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

Your answers stay in your browser. Nothing is stored or sent unless you choose to add your result to the enquiry form.

Indicative only. This check is not an ASD assessment and does not give an effectiveness rating, a maturity level or any statement of compliance. ASD's own assessment rates each action in each domain as not assessed, not effective, partially effective or fully effective, based on evidence. The questions summarise ASD's priority phase 1 domains (Identity services and Boundary services), regular and proven backups, and the two capability domains that apply throughout (Governance and culture, and Visibility and response), from the ASD Essentials published by the Australian Signals Directorate on 15 October 2026. Reviewed October 2026.

Enterprise IT

Eight domains, three priority phases

In ASD Essentials for enterprise IT, the six technical domains are grouped into three priority phases. The two capability domains apply across every phase and expand as the work progresses.

Domain
What it covers
Priority phase
Governance and culture

Policies, risk management, roles and the security culture that underpin the security program.

All phases
Visibility and response

Detecting, analysing and responding to cyber security events and incidents.

All phases
Boundary services

Internet-facing services and edge devices at the boundary of your network.

Phase 1
Identity services

Directories, sign-in and authorisation services, and credential stores.

Phase 1
Critical processes and services

The core processes and services your organisation exists to deliver.

Phase 2
Privileged environments

Admin activity, management services and high-impact administrative functions.

Phase 2
Business systems

The supporting systems that keep day-to-day operations running.

Phase 3
User devices

Endpoints issued to staff, including desktops and laptops.

Phase 3

The cloud chapter shows the same grouping in its priority phase diagram, and ASD Essentials for OT orders its domains differently. Non-production environments such as testing and staging are in scope.

Phases and ratings

Phases set the order. Ratings show the result.

Priority phases are a sequence

ASD is direct about this: “Priority phases are a sequencing mechanism, not a rating.” A phase says nothing about how effective your controls are, whether you comply with a standard or how mature your security is. Reaching phase 2 describes the scope of the work, not how secure you are. ASD calls its order “a starting position, not a constraint”, so you can change it if your risks call for it, as long as you write down why.

Effectiveness ratings measure the outcome

Each action is rated for each domain it applies to. A principle takes the lowest rating of its actions, and a domain only counts as addressed when every applicable action is fully effective. Switching a control on isn’t enough: ASD says deployment alone does not demonstrate effectiveness. There is no finish line either. In ASD’s words, “There is no completion date for effective cyber security.”

Rating

Not assessed

Not assessed yet, or not enough evidence to decide. Reported separately from not effective.

Rating

Not effective

Missing, or in place but not achieving the intended outcome.

Rating

Partially effective

Working in part, with gaps in coverage, consistency or enforcement. A plan alone doesn’t count.

Rating

Fully effective

Achieves the outcome across the domain, backed by enough evidence.

Free check

Want to know where your controls stand today?

Our free cyber security assessment looks at MFA, patching, admin access and backups and shows your biggest gaps. It’s a practical starting point, not an Essentials rating.

Get a free security assessment
Talk to us
Coming from the Essential Eight

Your maturity level doesn't convert

ASD says Essential Eight maturity level ratings do not automatically convert into ratings under ASD Essentials for enterprise IT, because the two approaches assess different things. Under the Essentials, organisations no longer pick a target maturity level at all.

What carries over is your investment: controls, tooling and evidence. ASD suggests using your existing implementation and assessment evidence as the starting point for a gap analysis, reusing evidence where it is still current and relevant. Its guide gives a rough idea of what to expect by level:

  • Maturity Level 1: a larger share of actions will need more work
  • Maturity Level 2: many controls contribute to the early priority phases
  • Maturity Level 3: wider reuse, but no automatic fully effective ratings
  • Never adopted the Essential Eight? ASD says go straight to the Essentials

What carries over

Controls, tooling and evidence, where they are still current and relevant to the domain.

What is new

Executive accountability, resourcing, risk management, supplier assurance, AI accountability and legacy systems, plus content filtering, awareness training, cyber supply chain security and wider identity controls.

ASD's mapping

Each Essential Eight strategy in the Essentials

ASD says every Essential Eight strategy maps to at least one principle in ASD Essentials for enterprise IT. Existing controls often satisfy or contribute to actions, but the scope they need to cover and the evidence expected are wider.

Essential Eight strategy
What ASD says to strengthen
Essentials principles
Patch applications

Asset coverage, risk-based treatment within any mandatory timeframes, and legacy systems.

Vulnerability management; Asset identification; Legacy system management
Patch operating systems

The same as for patching applications.

Vulnerability management; Asset identification; Legacy system management
Multi-factor authentication

Phishing-resistant MFA in each domain, not just remote access, plus unused accounts, secret storage, legacy sign-in protocols and unique credentials.

Identity, credential and access management
Restrict administrative privileges

A defined privileged environment, time-bound admin access, recorded admin actions, service accounts and network segmentation.

Identity, credential and access management; Least privilege access; Secure administration; Network segmentation and segregation
Application control

Supported and verified software only, admin tools included, with few exceptions, each approved, time-bound and reviewed.

Trustworthy software; Secure configuration management
Restrict Microsoft Office macros

Control over other ways software can run, not only macros, and detecting configuration drift.

Trustworthy software; Secure configuration management
User application hardening

Approved baselines kept from drifting, coverage beyond user devices, and broader content filtering.

Secure configuration management (the strategy section adds Content filtering)
Regular backups

Encrypted, isolated or immutable storage, separate backup repositories, and restore tests against recovery objectives.

Regular and proven backups; Least privilege access

Source: ASD, Transitioning from the Essential Eight (October 2026), Table 2 and the strategy sections. Logging, detection and incident response sit in the Visibility and response domain. ASD says the enterprise IT chapter is the authoritative source for requirements.

Next steps

What to do now

ASD’s advice for the transition, applied to a small or medium business.

Get a free security assessment
01

Keep meeting current obligations

If a regulator, government client or contract uses Essential Eight terms, keep meeting it as directed until they announce changes.

02

Keep your security work going

ASD doesn’t recommend slowing or stopping work already under way. Every Essential Eight strategy maps into the Essentials, so the effort counts.

03

Pick your starting chapter

Cloud if you run entirely on cloud services. Enterprise IT if you have servers, on-premises systems or a hybrid set-up.

04

Start where ASD starts

ASD’s transition guide suggests recording a baseline of what you have, then starting with governance, visibility and response, boundary services and identity services, and keeping evidence current.

Working with an IT provider

You stay accountable. We do the work.

ASD makes a point every business with an IT provider should hear: “outsourcing a service does not transfer accountability for the security outcomes that service is expected to achieve.” If a provider offers a security feature that nobody has turned on or set up, the responsibility hasn’t been met. A domain isn’t effective just because someone else looks after it.

That’s the basis we work on: you stay accountable for your security, and we do the hands-on work, keep the controls running and hand you the evidence.

What we do

On our managed plans we put in place and run multi-factor authentication, patching and vulnerability scanning, monitored backups with test restores, admin rights removed from everyday accounts, approved software only, email and web filtering, and 24/7 threat monitoring by our security partner’s operations centre. They are the kinds of controls the ASD Essentials covers, and we follow the Essentials as ASD develops it. Where you still have to report against the Essential Eight, we run an Essential Eight maturity assessment.

Keep the evidence current

ASD expects evidence that a provider is meeting its obligations to stay current, rather than relying on assurances given when the contract was signed.

Questions to ask any provider

Which controls are switched on, across which systems, and how do you know they are working? A good provider can show you.

SMB1001

Where SMB1001 fits

SMB1001 is an Australian cyber security standard for small and medium businesses, published by Dynamic Standards International with certification through CyberCert. The ASD Essentials is a framework. They do different jobs: a framework guides and measures your security program, while a standard sets requirements you can be certified against and gives you a certificate others can check.

ASD’s Essentials publications don’t mention SMB1001. SMB1001 is revised every year, and SMB1001:2026 is the current edition. Both cover areas such as multi-factor authentication, patching, backups and admin access.

Certified already?

A CyberCert certificate is valid for 12 months from the date of issue. See SMB1001 certification.

Comparing the options?

See Essential Eight vs SMB1001 for how ASD’s frameworks and the SMB1001 standard compare.

FAQs

ASD Essentials: common questions

It is ASD’s new cyber security framework, launched on 15 October 2026 to evolve the Essential Eight. Instead of eight fixed strategies, it sets out outcomes (principles), the work needed (actions) and where that work applies (domains), in separate chapters for enterprise IT, cloud and operational technology.

Yes. ASD’s own FAQ talks about replacing the Essential Eight, which is being superseded by the ASD Essentials. Both apply during the transition: ASD is maintaining both on cyber.gov.au, and organisations should keep meeting current obligations until regulators announce changes.

ASD hasn’t set an end date. It says it has been talking with regulators about the impact and timeframes of the transition and will advise on expectations in due course. Until then, keep meeting any obligation that names the Essential Eight.

A priority phase is an order of work: which domains to tackle first. ASD says it is not a rating of effectiveness, compliance or maturity. Essential Eight maturity levels were levels to reach for each strategy. Under the Essentials, how well you’re doing is shown by effectiveness ratings instead.

If you run entirely on Microsoft 365 or Google Workspace and other cloud apps, with no servers, ASD Essentials for cloud is the starting point. If you also have servers, on-premises systems or a hybrid set-up, start with ASD Essentials for enterprise IT. ASD expects most organisations to need both in time.

ASD says organisations may engage an independent assessor, but it isn’t required. It recommends periodic independent assessment particularly where external assurance is needed, and plans a training course for assessors. Guidance on assessing suppliers is still to come.

No. ASD calls the Essentials a framework, and none of its publications describe a certificate or certification scheme. Be wary of anyone offering to make you “certified” against it. SMB1001 is one option if you need a certificate others can check.

ASD’s publications don’t mention insurance. In our experience, most cyber insurance questionnaires still ask Essential Eight style questions about MFA, patching, admin access and backups. Answer them accurately, keep your evidence handy, and remember approval and premiums are the insurer’s call. See cyber insurance readiness.

ASD’s Essentials publications don’t mention SMB1001. SMB1001 is still an Australian cyber security standard with certification through CyberCert, revised each year by its publisher. The Essentials is a framework, so the two do different jobs, and controls such as MFA, patching and backups appear in both.

Keep reading

Related pages

01

Essential Eight and ASD Essentials

The transition, maturity levels and Essential Eight assessments.

→
02

Essential Eight vs SMB1001

Where ASD’s two frameworks and the SMB1001 standard differ.

→
03

SMB1001 certification

Get certified at Bronze, Silver or Gold with a CyberCert Partner.

→
04

Cyber security services

The managed controls we run for clients.

→
05

Governance and compliance

The policies, records and evidence behind standards and frameworks.

→
06

SMB1001 readiness check

A free check of which tier you are closest to.

→
Next step

What does the ASD Essentials mean for you?

Tell us what’s behind the question: a contract, a government client, your insurer or your own planning. We’ll explain what applies to your business and where your controls stand today.

  • Essential Eight maturity assessments where you still report
  • Core security controls set up and managed
  • SMB1001 Gold achieved

Prefer to talk? Call 1300 619 750, Monday to Friday.

Talk to us

Tell us what you need and we’ll get back to you.