ASD Essentials for Australian business.

From the Essential Eight to ASD Essentials

For nearly a decade, the Essential Eight gave Australian organisations a clear starting point: eight mitigation strategies measured against Maturity Levels 0–3. It worked well for Windows-centric networks, but it was never designed for businesses that run largely on Microsoft 365 and SaaS, manage Macs alongside PCs, or operate industrial and building systems.

The Australian Signals Directorate (ASD) has now evolved it into the ASD Essentials series: broader, outcome-focused and technology-agnostic. Instead of asking which maturity level you’ve reached, it asks which security outcomes are effective, and for which parts of your business.

Still in force for now. The Essential Eight remains published alongside the new series during the transition, and any regulatory, contract or tender requirement that references it still applies.

How ASD Essentials works

Every chapter uses the same three layers, so the logic stays consistent whatever technology you run.

Principle

What outcome am I after? Drawn from ASD’s Information Security Manual, such as least privilege access or regular and proven backups.

Action

What needs to be done? Described in technology-agnostic terms, so you choose controls that fit your environment.

Domain

Where does it apply? Each action is applied and assessed in the parts of the business it’s mapped to.

There are separate chapters for different technology environments:

• Enterprise IT — for organisations running their own mix of servers, networks, identity and endpoints. The direct successor to the Essential Eight.
• Cloud — for organisations that run entirely on SaaS and PaaS, such as Microsoft 365. Focuses on identity, data, tenant configuration, integrations and provider assurance, and marks which actions are yours, the provider’s or shared.
• Operational technology — for building management, industrial control and other systems that affect the physical world, with safety, segmentation and isolation first.

Many businesses sit across two chapters, such as on-premises infrastructure plus Microsoft 365. Each action is rated in each domain as not assessed, not effective, partially effective or fully effective — a much clearer picture for your board than a single maturity number.

Eight domains, tackled in a sensible order

ASD Essentials groups your systems into domains that share similar risks. Two capability domains run across everything, and six technical domains are worked through in priority phases, starting where attackers most often get in.

Always on

Governance and culture, Visibility and response. Accountability, risk, resourcing and supplier assurance, plus logging, detection and incident response. These run across every phase.

Phase 1

Boundary services and Identity services. Internet-facing services and identity are the most common routes to initial access.

Phase 2

Critical processes and services, Privileged environments. Stops an attacker escalating access or reaching what the business depends on.

Phase 3

Business systems and User devices. Builds on earlier protections so one compromised laptop or app can’t spread.

The OT chapter uses a different order to put safety first: boundary services and critical processes, then privileged access and identity, then business systems. Either way, priority phases set the sequence, not a score — “we’ve reached phase 2” describes scope of work, not how secure you are.

Your Essential Eight work carries forward

Every Essential Eight strategy maps to at least one ASD Essentials principle, so your controls, tooling and evidence still count. What changes is the scope they need to cover, the broader outcomes they contribute to, and the evidence needed to show they actually work.

Application control

Trustworthy software, Secure configuration management

Patch applications & OS

Vulnerability management, Asset identification, Legacy system management

Multi-factor authentication

Identity, credential and access management

Restrict admin privileges

Least privilege access, Secure administration, Identity management, Network segmentation

Office macro settings

Trustworthy software, Secure configuration management

User application hardening

Secure configuration management

Regular backups

Regular and proven backups, Least privilege access

ASD Essentials also covers areas the Essential Eight didn’t:

• Executive and board accountability, risk appetite, resourcing and supplier assurance.
• Wider identity hygiene: removing unused accounts, securing secrets and tokens, retiring legacy sign-in methods.
• Content filtering, role-based awareness training and cyber supply chain security.
• Central logging, detection, tested incident response and post-incident review.
• For cloud: app consent grants, third-party integrations, tenant configuration drift and provider assurance.

Essential Eight maturity levels don’t convert directly into ASD Essentials ratings. Maturity Level 2 or 3 means less work, not no work — so a gap analysis is the right first step.

How EduCom IT helps with ASD Essentials

The framework doesn’t install itself. We turn ASD’s actions into real changes across Microsoft 365, Microsoft Intune, Jamf, identity, backup and the other platforms you already use.

Scope

Map your systems to the right chapter and domains, so effort goes where the risk is.

Review

Gap analysis against each applicable action, reusing your current Essential Eight evidence.

Prioritise

A plan that follows ASD’s priority phases, adjusted for your obligations, budget and risk appetite.

Implement

Hands-on rollout: phishing-resistant MFA, conditional access, privileged access, device compliance, app consent controls, logging and immutable backups.

Govern

Board-ready reporting by domain, plus help defining executive accountability and risk appetite.

Sustain

Regular reassessment so controls stay effective as people, devices and services change.

A realistic path from the Essential Eight

You don’t need to start again, and you don’t need to do everything at once. We follow the transition approach ASD recommends.

Step 1 · Baseline

Record where you are today: your last Essential Eight assessment, current controls, exceptions and planned work.

Step 2 · Scope

Identify what sits in the phase 1 domains, plus Governance and culture and Visibility and response.

Step 3 · Gap analysis

Mark each action as addressed, partially addressed or not addressed.

Step 4 · Plan

Design each capability once, then roll it out phase by phase.

Step 5 · Deliver

Implement, then show coverage, consistency and evidence that controls actually work.

Step 6 · Sustain

Move through phases 2 and 3, with regular reassessment.

• Foundations in MFA and endpoint protection.
• Connects to backup and recovery readiness.
• Often paired with CIS / ISO alignment for organisations facing tenders or audits.

Frequently asked questions