What does ASD Essentials mean for Australian businesses?
What is ASD Essentials and what does it mean for your business?
ASD Essentials is the Australian Signals Directorate’s cyber security framework for protecting enterprise IT, cloud and operational technology environments. It defines the security outcomes organisations should achieve, the actions needed to achieve them and the business functions and assets those actions apply to.
ASD’s Framework Overview
For business leaders, the practical shift is to connect security measures to the operations, information and services the business depends on. That requires clear ownership, evidence that protection works and sufficient resources to maintain it.
ASD’s Executive Guidance
If you have already invested in Essential Eight, you do not need to start again. Establish which controls and evidence remain useful, where protection needs to extend and what additional capability the business needs.
ASD Transition Guidance
ASD Essentials is particularly relevant to Commonwealth entities, critical infrastructure owners and operators, and large organisations. Smaller businesses can also apply relevant guidance according to their environment, risks and the responsibilities retained by the business and its service providers.
For Defence Suppliers
Is ASD Essentials replacing the Essential Eight (E8)?
Yes. ASD Essentials is the evolution of Essential Eight, with the introduced enterprise IT chapter building directly on it. ASD is maintaining both frameworks during the transition. Organisations should continue meeting current regulatory obligations until relevant changes are communicated by regulators.
If you are already implementing Essential Eight, do not abandon that work. Existing controls and evidence can contribute to ASD Essentials, although their scope, effectiveness and supporting evidence may need to be reassessed.
For what changes in an existing program and current timing guidance, read our Essential Eight transition update.
How is ASD Essentials different from Essential Eight?
Essential Eight organises security uplift around eight mitigation strategies and maturity levels reflecting different adversary capabilities. ASD Essentials takes a broader approach, organising security outcomes, implementation activities and business scope through principles, actions, domains and priority phases.
These terms are important because they describe different parts of the framework. Principles define the security outcomes an organisation is working towards, actions describe what needs to be done, domains identify where those actions apply, and priority phases help organisations decide where to start.
| Term | What it means for the business |
|---|---|
| Principles | The security outcomes you need to achieve. |
| Actions | The work required to deliver those outcomes. |
| Domains | The business functions and assets to which that work applies. |
| Priority phases | The recommended order for addressing the domains. |
This changes the management conversation. Rather than looking only at whether individual controls have been implemented, organisations need to consider what security outcome they are trying to achieve, where protection needs to apply and whether it is effective.
ASD Essentials retains defined actions while allowing organisations to select controls suited to their technology and risk, without prescribing a particular product, vendor or architecture.
Essential Eight was designed for Microsoft Windows based, internet connected networks, although ASD also published guidance for applying relevant protections in cloud environments.
ASD Essentials for enterprise IT still specifies measures such as phishing resistant multi factor authentication and defined risk based patching timeframes, or automatic updates where operational impact is low. Flexibility requires defensible decisions and evidence.
Existing macro restrictions can support broader software trust and configuration outcomes. Changed terminology is no reason to remove effective protection.
Essential Eight maturity model FAQ · What is ASD Essentials? · ASD’s case for change · Transitioning from Essential Eight
Which ASD Essentials chapters apply to your business?
ASD Essentials is organised into chapters for different technology environments. The right starting point depends on what your organisation operates and which security responsibilities it retains. More than one chapter may apply to the same business.
Enterprise IT: This covers traditional enterprise technology environments, including on premises, hybrid and infrastructure as a service environments where the organisation retains responsibility for systems and infrastructure.
Cloud: Applies to environments delivered through software as a service (SaaS) and platform as a service (PaaS), where security responsibilities are divided between the customer and cloud service provider.
Operational technology: Targets systems that monitor or control physical processes, where cyber security decisions also need to consider operational continuity and safety.
Using cloud services does not mean the cloud chapter is your only relevant guidance. A business may, for example, use SaaS applications while still operating enterprise IT, identities, user devices or infrastructure for which it retains security responsibilities.
For cloud services, establish what the business operates itself, which security capabilities the provider supplies for you to configure and operate, and which security outcomes the provider delivers that you need to verify.
What are the ASD Essentials domains and priority phases?
Domains group related business functions and assets so security actions can be considered in the context in which they operate. Priority phases provide a recommended sequence for addressing those domains.
For Essentials for enterprise IT, the recommended sequence is:
| Phase | Domains addressed |
|---|---|
| 1 | Boundary services; Identity services |
| 2 | Critical processes and services; Privileged environments |
| 3 | Business systems; User devices |
| Throughout | Governance and culture; Visibility and response |
Phase 2 does not mean Maturity Level 2. Priority phases organise implementation; they do not establish a security maturity or assessment rating.
The sequence starts with services exposed at the organisation’s boundaries and the identities used to access its environment, then moves through critical operations and privileged environments before addressing broader business systems and user devices. Governance, visibility and response continue throughout implementation.
Operational technology uses a different sequence, reflecting the operational and safety considerations of those environments.
ASD recommends following the priority phase order. Where an organisation changes that sequence because of specific threat intelligence or regulatory requirements, the decision should be documented and justified through risk.
Official ASD Guidance:
What does ASD Essentials require from business leaders?
ASD Essentials places clear responsibility on senior leadership for cyber security governance, risk and resourcing. Leaders need to understand what the organisation depends on, what is being protected effectively, where material risks remain and whether the organisation has the capability to sustain its security measures.
This does not mean executives need to make technical security decisions. It means they need sufficient information to make informed business decisions about risk, priorities and investment, and clear accountability for carrying those decisions through.
In practice, leadership should know who can accept a security exception, who is responsible for addressing a supplier assurance gap, whether important risks have an accountable owner, and whether the organisation has the people and resources to maintain the protection being funded.
Governance and culture, and Visibility and response, operate throughout implementation rather than being activities addressed once other technical work is complete. Prevention, leadership, visibility and the ability to respond to incidents need to develop together.
Official ASD Guidance:
How does ASD Essentials address AI?
ASD Essentials explicitly considers artificial intelligence as part of the cyber security environment organisations now need to govern. AI can be an asset requiring protection, a source of new security risk and a capability used to support cyber defence.
For organisations adopting AI, this means understanding what information AI systems can access, how they connect to other systems, what permissions and non person identities they use, and who is accountable for their use.
For example, if an AI assistant can access engineering or commercially sensitive documents, the business should understand what information it can read or share, which systems it can interact with and who authorised that access.
These questions extend beyond the AI tool itself. They connect AI adoption to identity, access control, data security, third party services and governance across the wider technology environment.
Official ASD Guidance:
How is ASD Essentials assessed?
ASD Essentials assesses whether security actions are effective within each applicable domain. Actions receive one of four ratings: not assessed, not effective, partially effective or fully effective.
Not assessed means an action has not yet been assessed for that domain, or the available evidence is insufficient to establish whether it achieves the intended security outcome. It is distinct from a rating of not effective.
A principle is fully effective within a domain when all of its applicable actions are assessed as fully effective. Indicators of good practice support assessor judgement, while gaps and assessment limitations remain visible.
This makes evidence important, but the assessment is not simply a document check. The objective is to establish whether the security action achieves its intended outcome in the environment being assessed.
For example, an engineering business may have reliable patching records for staff laptops but gaps in the systems used to administer production services. Effective protection of user devices does not establish that the same security outcome is being achieved in privileged environments. Each applicable domain needs its own coverage and evidence.
For business leaders, the result should provide a clearer view of where protection is effective, where improvement is required and where there is not yet enough evidence to reach a conclusion.
Official ASD Guidance:
How should a business prepare for ASD Essentials?
Preparing for ASD Essentials should start with understanding your current position, not replacing controls or purchasing new technology.
Establish what the business depends on, which obligations apply, what protection is already in place and who is responsible for maintaining it. Use that baseline to identify genuine gaps and decide where additional investment is justified.
A practical starting point is:
- Business priorities: identify the information, services and dependencies whose compromise would materially affect operations, customers or trust.
- Current obligations: document the cyber security requirements imposed by your contracts, customers, regulators and other relevant authorities.
- Operating environment: identify the applicable ASD Essentials chapters and the responsibilities retained by the business, managed service provider and cloud providers.
- Existing investment: establish which existing controls and evidence remain useful, which need broader application and which require further validation.
- Ownership and capacity: assign executive and operational responsibility for maintaining security, including supplier oversight and AI use.
- Next investment: prioritise remaining gaps, allocate resources and establish how improvement will be demonstrated.
This provides a basis for planning. It does not establish conformance with ASD Essentials.
ASD Official Planning Guide
What does ASD Essentials mean for Defence suppliers?
For Australian Defence suppliers, existing Essential Eight investment remains relevant. However, an Essential Eight maturity level does not automatically translate into an ASD Essentials assessment result. Existing controls may need broader coverage, different application or stronger evidence under the new framework.
Organisations should continue meeting the Defence requirements that apply to them today rather than assuming future requirements. If Defence adopts ASD Essentials in future requirements for DISP, the scope, assessment expectations and transition arrangements will depend on the direction Defence actually issues.
The practical approach is to maintain the protections supporting current obligations, understand what those protections achieve and retain evidence of their effectiveness. This gives the business a stronger foundation for adapting its security program as Defence requirements evolve.
For Defence suppliers already investing in Essential Eight, the objective should not be to start again. It should be to protect the value of that investment while understanding where ASD Essentials changes the scope, evidence or governance expected.
Defence Industry Security Program eligibility and suitability guidance
How does ASD Essentials relate to other cyber security models and frameworks?
Organisations working across multiple cyber security frameworks should look for opportunities to reuse controls, governance practices and evidence rather than treating each program in isolation.
This does not make the frameworks equivalent. Each has its own purpose, scope and assessment requirements. The comparisons below provide business context rather than a formal mapping to ASD Essentials.
| Framework | Business context |
|---|---|
| SMB1001 | A five level certification pathway for smaller businesses, progressing from preventive controls towards broader risk management and governance. Existing practices may provide a useful foundation, but an SMB1001 result does not establish an ASD Essentials assessment result. |
| ISO/IEC 27001 | A standard for establishing, maintaining and continually improving an information security management system. Its risk management and governance processes can support ASD Essentials implementation planning, but the two retain separate requirements. |
| CMMC Level 2 | Uses NIST SP 800 171 Revision 2 requirements for protecting controlled unclassified information. Controls and evidence may be reusable, but must be considered against CMMC’s own scope and assessment requirements. |
| UK Cyber Essentials | Covers five technical control areas, with Cyber Essentials Plus adding independent technical testing. Certification does not establish an ASD Essentials assessment result. |
How Cyber Wyze can help
Cyber Wyze helps Australian businesses understand their current cyber security position, identify meaningful gaps and build practical improvement programs aligned to operational needs, customer obligations and business priorities.
Our approach starts with understanding what is already in place. For organisations that have invested in Essential Eight, Microsoft security, cloud controls, managed services or broader cyber security programs, the objective should not be to start again. It should be to establish what that investment already achieves, where protection needs to extend and where further investment is justified.
We work across cyber security strategy, Essential Eight and DISP readiness, security assessments, Microsoft cloud security, data security and governance, AI governance and managed security. This means ASD Essentials can be considered as part of the organisation’s wider security program rather than as another isolated compliance exercise.
For Defence suppliers, this includes understanding the requirements that apply today while maintaining a security program capable of responding as customer and Defence requirements evolve.
The objective is straightforward: give leadership a clear view of the current position, material gaps, priorities for improvement and the investment required to address them.
Talk to Cyber Wyze about ASD Essentials, your existing cyber security program and transition planning.