AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
An MSP can deliver ASD Essentials across its client base with one assessment method, as long as each client’s scope, responsibilities, ratings and evidence stay separate.
The separation follows from how ASD Essentials works. It rates applicable actions separately in each domain, so a control deployed through an MSP’s shared tooling may be fully effective in one domain and partially effective in another. As of late 2026, the framework was mandatory for no one, and clients may still need Essential Eight reporting alongside ASD Essentials.
This guide covers delivery across clients: assigning responsibilities, collecting evidence, preparing supplier assurance and writing client reports. The MSP’s own legal and security obligations, including existing Essential Eight requirements, are in MSP compliance in Australia.
The client stays accountable for its security outcomes when an MSP implements or operates its controls. ASD’s Which chapter should I start with? guidance is plain on the point: outsourcing hands over the work and leaves accountability for the outcome where it was.
Which chapter should I start with?
A control available through the MSP’s service is not automatically effective in the client’s environment. The client may still have to enable a capability, approve a configuration or complete a task that sits outside the provider’s responsibility. Each action is assessed in its relevant domain, whoever does the work.
For example, an MSP may deploy a configuration baseline across managed endpoints while devices outside its management platform go without it. The client’s assessment has to count those devices. A deployed baseline proves coverage only for the assets it reached.
Where a responsibility is unmet or cannot be evidenced, the client works with the provider to close the gap, puts compensating controls in place, changes the arrangement or documents and formally accepts the residual risk.
Every applicable ASD Essentials action needs a named owner, an operating responsibility and a source of evidence. A responsibility register records who implements each control, who maintains it and who supplies the records for assessment.
The markers below adapt the cloud chapter’s Customer, Supplied and Provider markers for MSP delivery. They are our suggested operational categories. ASD does not use these terms.
Keep one register per client and domain. The same action can have a different owner from one client to the next, because technologies, permissions and managed service arrangements differ.
For shared actions, record where providing a capability ends and operating it begins. If the MSP supplies a security setting but the client must authorise its deployment, the register shows both jobs. Without that line, a setting can sit undeployed while each party waits for the other.
Review the register when services, permissions or responsibilities change. An assessor should be able to read off who provides the evidence, who resolves a control gap and which client decisions are outstanding, without piecing the arrangement together from support tickets.
Each client needs its own documented assessment scope, listing the domains, assets and functions its ratings cover. A shared MSP assessment template standardises the paperwork. It does not make client environments interchangeable.
ASD’s implementation planning guide says the scope statement establishes what constitutes coverage. The scope has to reflect what the client actually operates and depends on, including relevant systems managed through the MSP.
establishes what constitutes coverage
Start with the client’s obligations, risk appetite and budget. Choose the applicable enterprise IT or cloud chapter and begin with the priority phase 1 domains.
Apply the domain’s consequence test to the MSP’s own management plane too: remote management tools, technician identities and remote access. The result decides which management capabilities belong in the client’s domain scope.
For each domain, issue a version-controlled scope statement covering the relevant assets and functions. Link assessment evidence to the scope version it was collected against. When asset coverage changes later, the earlier rating still reads as a rating of the earlier scope.
The client’s assessment then states both the assets assessed and where the assessment stopped.
An MSP gets consistent results across clients by standardising the assessment process and running it on each client’s own scope and evidence. ASD’s process covers planning, approval, assessment, aggregation and reporting.
The ASD Essentials assessment guide explains the rating method and assessment rules in detail.
Use the same assessment plan template for every client and complete it for that client’s environment.
List the domains, assets and applicable actions to be assessed.
Record the assessment techniques and tools selected for each action.
Note the records already available, including evidence from previous assessments.
Define required permissions, representative samples and known restrictions.
Specify collection, protection, storage and access arrangements.
Record assessment activities and reporting dates.
An appropriate client authority approves the plan before assessment work begins, including any active testing. Approval from one client does not authorise the same activity in another client’s environment.
Assessors record the evidence reviewed, the rating assigned and the reasoning behind it. Where expert judgement departs from the assessment indicators, the record explains why.
An unavailable system, a restricted test or a missing record is an assessment limitation. Document it as one. It is never evidence that a control works.
An MSP assessing a control it implemented is reviewing its own work. The assessment can still be useful, provided the client can see who built the control and who rated it.
ASD’s planning guide makes independent assessment optional while recognising the value of a fresh assessment perspective. Where practical, use assessors outside the team that implemented the control.
Periodic calibration helps as well. Assessors rate the same evidence independently, compare conclusions and settle differences in how they read the indicators. Calibration is common audit practice. ASD does not ask for it.
Consistent judgement matters because of the way ratings roll up. In each domain, a principle takes the rating of its weakest applicable action, so one assessor reading a single indicator more leniently than another can change the reported result for the whole principle.
Every client needs its own evidence register, linking each applicable ASD Essentials action to the controls, assets and records behind its rating. ASD’s planning guide recommends a register for each domain that identifies control coverage, evidence sources and the self-assessed rating.
The register belongs to the client’s assurance process, even where the MSP builds and maintains it. Client staff and authorised assessors should be able to pull supporting evidence themselves, without waiting on an individual MSP technician.
The collection methods are common practice rather than ASD requirements.
Evidence has to show the control operating. A policy that exists in an MSP platform is only the starting point. An enrolment report proves managed coverage only once it is reconciled against the client’s in-scope assets, and a baseline export says far more when it comes with the drift and remediation records showing how the configuration was kept in place.
Dated exports from MSP tooling are generally stronger assessment evidence than screenshots alone. A screenshot can support the record when it clearly identifies the client tenant, the date and the scope.
ASD’s assessment approach considers coverage, consistency, currency and evidence quality. A configuration captured on the export date is one point in time. The records need to show the control operating across the whole period being assessed.
Keep supporting logs, assessment findings and evidence requests separated by client. Agree retention, access and export arrangements so records remain available during assessment, stay current between reviews through continuous evidence monitoring and can be returned when the managed service ends.
GOV-11 Supplier cyber security assurance applies to each client’s supplier relationships, and the MSP is one of them. A GOV-11 assurance pack gives the client what it needs to assess and monitor the cyber security risk its MSP introduces.
For many clients, the MSP is a significant supplier because it holds management access and operates important security controls. A weakness in the MSP’s own security practices can reach several client environments, however carefully the clients’ assessment evidence is kept apart.
In the enterprise IT chapter, the first GOV-11 action calls for supplier selection based on a cyber supply chain risk assessment proportionate to the risk the supplier introduces. The second calls for current assurance and action when assurance lapses or supplier risk changes. The cloud chapter also calls for a register of inherited and retained security responsibilities for each provider.
proportionate to the risk the supplier introduces
ASD’s assessment indicators look at supplier evaluation before onboarding, proportionate assessment criteria, current assurance evidence, review of findings and action when assurance lapses.
A reusable MSP assurance pack contains:
Relevant certifications and attestation reports, including scope, reporting period, findings and exceptions.
How management platforms, technician identities and remote access are protected.
The client’s current record of which party implements and operates each applicable action.
Relevant supporting providers and the locations where client information, logs and other service data are processed.
Incident notification commitments, material service changes and procedures for returning client records.
A shared pack cuts down repeated evidence requests, but each client still has to judge whether it addresses that client’s own supplier risk. An assurance report scoped to one service or one reporting period, for example, may say little about a different managed capability.
Keep a versioned master pack and record which version each client received. When a report in the pack expires, read the findings and exceptions in its replacement before swapping it in, and consider whether they change the risk for any client.
ASD has indicated that dedicated supplier assessment guidance is still to come. Until then, clients decide whether the available evidence adequately addresses the risks their suppliers introduce.
ASD also recommends engaging the MSP early in assessment planning. Nominate an assessment contact who can coordinate evidence access, explain responsibilities and say at the outset which assurance material cannot be supplied.
The ASD Essentials Governance and culture guide covers GOV-11 from the client’s perspective.
Each client receives its own ASD Essentials assessment report, with its domain ratings, supporting evidence, limitations and remediation priorities. ASD’s assessment process guide calls for a summary view and a detailed view.
An MSP can add responsibility and operational service information so the client can act on the findings.
The summary and detailed views follow ASD’s reporting guidance. The responsibility and service views are our suggested additions for managed services.
ASD permits visual summaries, including radar charts, but states that visualisations must not be used in isolation. A percentage or chart goes out with the domain and action results underneath it, so readers can see what the figure is made of.
must not be used in isolation
Keep not assessed actions and domains separate from those rated not effective. Explain restricted testing, missing evidence and other limitations in the report itself. Left unexplained, an overall percentage implies coverage the assessment did not have.
MSP-delivered gaps belong in the client’s report alongside client-managed gaps. Show which party owns the remediation, whether a client decision is outstanding and what evidence will show the issue is resolved.
An MSP may also keep an internal portfolio view of assessment progress, outstanding evidence requests and remediation activity across clients. Each client’s ratings and evidence stay separate within it, with no aggregation that hides a weak domain in an individual environment.
An MSP can sell ASD Essentials work as separate service components: assessment support, evidence maintenance, security monitoring and remediation, with a clear boundary between each. Clients may need different combinations depending on where they start and which controls the MSP already manages.
Common service components include:
Select the relevant chapter, document priority phase 1 scope and set a starting position from existing Essential Eight evidence.
Apply a consistent assessment method while the client approves the plan and keeps ownership of its ratings.
Maintain current records for MSP-delivered actions, review exceptions and report configuration or control drift.
Provide security visibility, investigation and authorised response through a 24x7 SOC. See ASD Essentials and the SOC and 24x7 SOC for MSPs.
Address identified gaps through separately scoped implementation work.
White-label SOC pricing models explains pricing approaches for managed service components.
Describe assessment results as ratings against ASD Essentials actions within applicable domains. ASD does not operate an organisational certification scheme for ASD Essentials, so no service should promise certification or assign a general compliant status.
The client agreement names who operates controls, who maintains evidence, who approves assessments and testing, and how notification and evidence return are handled. Those lines stay visible even when several activities are sold as one managed service.
Assess the MSP’s own operating environment first. Supplier assurance material should reflect current controls, current evidence and any known gaps before a client sees it.
Review the management platforms, technician access and remote connections that clients depend on. The results give the MSP its answers to supplier assurance questions.
Run the complete process with one client before offering it widely: scope approval, responsibility allocation, evidence collection, ratings and reporting.
Check that each evidence request reaches the right owner, that records can be retrieved without a technician’s help and that the report explains its rating decisions clearly.
Refine the templates and procedures with what the pilot showed, then apply them across clients, starting with those carrying the greatest risk.
Hold the assessment method constant and let scopes, permissions, evidence sources and remediation priorities vary by client. The MSP can standardise the workflow without standardising away material differences between environments.
ThreatDefence provides MSPs and MSSPs with an AI SOC platform supported by a 24x7 SOC, available as a white-labelled or co-managed service. Each client operates in a separate tenant with its own response authority, case records and board-ready reports.
ThreatDefence’s SOC team is based in Australia, with a 3 min average response under guaranteed SLAs. Threat hunting and an incident response retainer are included in the standard service. Response actions remain within the authority each customer approves, and case records can be exported for assessment or at the end of a contract.
Client data and AI processing stay in the client’s region, which for Australian clients is Australia. ThreatDefence’s ISO 27001 and PCI DSS certification and SOC 2 report support clients’ GOV-11 supplier reviews. ThreatDefence does not certify organisations; the assessor determines ASD Essentials ratings.
Before a formal assessment, the free ASD Essentials Navigator lets users rate each action for their own environment and see how principles and domains roll up. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.
Open the ASD Essentials Navigator Start the 5-Minute Explainer Explore the White-Label SOC Platform
Faster investigations. Clear evidence. Coordinated response.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
No. As of late 2026, ASD Essentials is mandatory for no one, and no regulator references it yet. Clients may still ask for assurance about an MSP’s security through GOV-11 supplier reviews or contracts. An MSP that has assessed its own environment can answer with current evidence of its management platform security, technician access and operational controls. MSP compliance in Australia covers existing obligations, including those relating to the Essential Eight.
Use one assessment method, one evidence register format and one reporting format, and keep each client’s scope and results separate. Apply ASD’s rating rules the same way every time, including the rule that a principle takes the rating of its weakest applicable action within a domain. Record assessment limitations, calibrate assessors periodically and separate assessment from implementation where practical. Shared tooling may simplify evidence collection, but it does not make the clients’ domain ratings interchangeable.
Give each client a summary report and a detailed report, with results by priority phase and domain. Include principle ratings, the actions driving each result, supporting evidence, assessment limitations and remediation progress. Show not assessed domains separately from those rated not effective. Put gaps in MSP-delivered controls alongside client-managed gaps, each with a clear owner. Portfolio reporting can help the MSP manage work, but each client receives only its own results and evidence.
Include independent assurance reports and certifications with their scope, period, findings and exceptions. Explain how management platforms, technician identities and remote access are protected. Add the client’s responsibility register, relevant subcontractors, data-processing locations, incident notification arrangements and procedures for returning records. GOV-11 calls for a supplier risk assessment proportionate to the risk the supplier introduces and action when assurance lapses, so review the pack when its evidence expires or material supplier risks change.
Keep a responsibility register for each client and domain that names who owns, operates and evidences every applicable action. Our suggested categories are MSP delivered, shared, client delivered and third-party provider, adapted from the cloud chapter’s Customer, Supplied and Provider markers. These are operational categories. ASD does not use the terms. Review responsibilities when services, configurations or permissions change, and make outstanding client approvals visible so a shared control is never left incomplete with no named owner.
Yes, where the relevant domain consequence test brings them into scope. Apply that test to the MSP’s management plane, including remote management tools, technician identities and remote access, and record the result in the client’s version-controlled scope statement. ASD’s implementation planning guide says the scope statement establishes what constitutes coverage. The assessment explains how relevant management dependencies were considered. Tools operated outside the client’s tenant are never left out without comment.
The client remains responsible for its assurance process and needs its own evidence register, even when the MSP operates the controls and collects the records. Each applicable action traces to the relevant assets, controls, evidence and rating. Client staff and authorised assessors should be able to retrieve records without relying on individual MSP technicians. Agree retention, access, export and service-exit arrangements so evidence remains available throughout the assessment process and can be returned when the service ends.
Start by assessing the MSP’s own environment and preparing current supplier assurance material. Next, use a pilot client to test domain scoping, responsibility allocation, evidence collection, rating consistency and reporting. Refine the templates before extending the process across clients, starting with those carrying the greatest risk. Keep readiness, assessment, continuous evidence and remediation responsibilities distinct, and describe the results as action and domain ratings, since ASD Essentials carries no organisational certification.
ASD Essentials SOC, MDR and Incident Response
ASD Essentials Assessment and Checklist
ASD Essentials Governance and Culture