AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
An ASD Essentials assessment rates each applicable action, domain by domain, on the evidence that its intended outcome is being achieved.
Those ratings roll up into principle ratings and a percentage for each domain.
Unlike an Essential Eight maturity assessment, it produces no single maturity level. The question is whether each outcome is achieved consistently across the assets in scope, and a configured control answers only part of it.
ASD published its assessment process guide, assessment evidence guide and Excel assessment workbook for enterprise IT on October 15, 2026. This guide follows the process, ratings, evidence and reporting they describe, and adds an ASD Essentials checklist for the enterprise IT domains. For the framework’s structure and scope, see ASD Essentials explained.
ASD Essentials assessment ratings sit on an outcome-based scale, and each applicable action is rated separately in each domain. The same action can be fully effective in Identity services and partially effective in User devices, because the assets, the implementation and the evidence differ.
The assessor looks at coverage, consistency, currency and evidence quality. A configuration setting on its own says little about effectiveness. A control deployed across most assets can still be partially effective if important systems are excluded or enforcement is inconsistent. A typical case is patching that reaches most domain controllers on time while federation servers or certificate authorities are routinely late.
ASD’s assessment process guide sets out the stages of an assessment in order: planning and preparation, plan approval, assessment, then aggregation and reporting.
Planning decides which domains and assets are in scope, which methods the assessor will use and what evidence already exists. The plan names the assessor and stakeholders and covers technical testing, access, sampling, evidence handling, reporting and timing.
ASD’s asset scoping guidance helps identify the relevant systems, including non-production environments and AI systems. An asset that supports more than one domain may need to be assessed separately in each. A customer-facing internet application that delivers a critical business service, for example, can sit in both Boundary services and Critical processes and services.
Check existing inventories and architecture records against the current environment before relying on them, and write down each exclusion with its reason.
The accountable executive or appropriate authority approves the scope and methods before work begins. The approval covers evidence collection, access arrangements, tools and technical testing.
Live testing can affect production, so the plan records which systems may be tested, by which methods and within what limits. Material changes to the plan go back for approval. Access restrictions and tests that could not be completed are reported with the results.
The assessor works through each applicable action in every domain in scope, collects evidence and records the effectiveness rating. Each record lists the assets covered, the supporting evidence and the gaps that stop the action being fully effective.
Where sampling is used, the record states the asset population, the systems selected and the basis for choosing them. Evidence from selected systems does not automatically carry across an entire domain. A handful of well-managed servers put forward by the team that runs them says little about the rest.
Aggregation turns action ratings into principle and domain results, which are reported with the findings and remediation behind each. Scope shapes the result directly. Leaving out a remote site, an acquired business or a SaaS platform may produce a favourable result that does not represent the wider environment.
ASD wrote the process for organisations assessing their own environments. It does not replace regulatory requirements, and it does not cover suppliers. ASD has indicated that separate supplier assessment guidance will follow.
Assessment ratings roll up by a weakest-link method: a principle receives the lowest rating among its applicable actions in the domain. A principle with three applicable actions in Identity services, two fully effective and one partially effective, is rated partially effective.
Each assessed domain then receives a weighted percentage. A not effective principle scores 0, partially effective 0.5 and fully effective 1, and the total is divided by the number of applicable principles. A domain with four principles rated fully effective, fully effective, partially effective and not effective scores 2.5 out of 4, or 62.5%.
A principle stays not assessed when the evidence is too thin to rate it. A domain with no assessed applicable principles is reported as not assessed, and never as 0%. Keep both visible and separate from confirmed failures. A gap in knowledge and a failed control call for different work.
ASD reports results by domain and priority phase. Priority phases describe the recommended order of implementation. They carry no maturity rating, so no organisation receives an outcome of having “reached phase 2”. The domain percentage is a summary, and a 62.5% result still has to name the principles and actions behind it.
The evidence to collect for an assessment is whatever shows an action operating across the domain’s assets over time. For patching identity infrastructure, ASD identifies vulnerability reports, patch compliance data, change records and configuration management records as potential evidence. The table covers the records most assessments rely on. The collection methods are common practice rather than ASD requirements.
vulnerability reports, patch compliance data, change records and configuration management records
the primary working paper for self-assessment.
do not automatically demonstrate an outcome across the entire domain.
A dated system export showing consistent operation is generally stronger than a screenshot. Keep enough detail to repeat the collection and to show which assets and dates a result covers. ASD’s assessment process guide states that Evidence must be current, and warns that older records may no longer reflect the current environment.
Evidence must be current,
may no longer reflect the current environment.
ASD’s assessment evidence guide for enterprise IT gives Indicators of Good Practice for each action, describing what not effective, partially effective and fully effective outcomes look like. They are optional aids for consistent judgement. They do not replace the assessor’s expertise and are not meant to be worked through as a checklist. An alternative implementation may still achieve the outcome when the evidence supports that conclusion.
The guide also points to potential evidence from the ISM, the Essential Eight, NIST CSF 2.0, NIST SP 800-171r3 and AESCSF v2. ISO/IEC 27001 and SOC 2 are outside that mapping. Their reports may supply supporting records, but the applicable ASD Essentials actions still have to be assessed.
This ASD Essentials checklist turns the enterprise IT chapter into practical checks for finding gaps, assigning remediation and collecting evidence. For every item, record the owner, the assets covered, where the evidence is kept, the date last checked and the next review date, plus:
Classify the implementation using the gap categories in ASD’s transition guidance. Gap findings support planning and stay separate from formal effectiveness ratings.
Phishing-resistant MFA, configuration baselines, patching and logging span several technical domains. Check coverage separately in each domain where the action applies.
Keep dated configuration reports, drift records, restoration tests and security alerts showing the control still operates.
Start with Governance and culture and Visibility and response alongside the priority phase 1 technical domains, Boundary services and Identity services. Fix gaps on exposed and privileged assets first, then move through phases 2 and 3.
The checklist supports an Essential Eight gap analysis and a transition assessment. It is no substitute for the official ASD assessment workbook, which remains the authority on which actions apply to each domain. Mapped action IDs follow each description.
Governance and culture checks cover executive accountability, risk management, supplier assurance and resourcing. Most have no direct Essential Eight equivalent.
Define board and executive responsibilities for cyber security, including reporting, risk appetite and a review cycle (IT.GOV-01.1). Evidence: Documented accountabilities, board papers and reviewed risk appetite statements.
Cover internally developed, third-party and embedded AI, with approval and risk assessment per use case (IT.GOV-08.1). Evidence: AI approval records and risk register entries.
Plan the personnel, skills and contracted services to implement, operate, monitor and maintain controls (IT.GOV-04.1). Evidence: Resourcing plans, security role descriptions and dated reviews.
Assess risks across in-scope assets within the review cycle and track treatments (IT.GOV-03.1). Evidence: Approved methodology, current risk register and treatment progress.
Assess suppliers by risk before onboarding, and set what assurance evidence is acceptable and how current it has to be (IT.GOV-11.1, IT.GOV-11.2). Evidence: Supplier evaluations, current assurance reports and action taken when assurance lapses.
Keep a register with legacy criteria, compensating controls and a tracked replacement path (IT.GOV-14.1). Evidence: Legacy register, approved risk treatments and replacement progress.
Review content on a defined cycle, adding lessons from incidents and emerging threats (IT.PRO-14.2). Evidence: Training review records and dated updates.
Visibility and response checks cover asset identification, monitoring, alert investigation and incident response, including outside business hours where required.
Use discovery to identify new and changed physical and non-physical assets (IT.IDE-01.1). Evidence: Discovery results reconciled against the inventory.
Consider known weaknesses, attacker techniques and threat information when evaluating risks (IT.IDE-04.1). Evidence: Risk assessments citing current threat intelligence.
Regularly inspect code, configuration files, file shares and collaboration platforms for exposed keys, tokens and credentials (IT.PRO-13.3). Evidence: Scan results and dated remediation records.
Collect security-relevant events in a central store protected against unauthorised access and modification (IT.DET-01.3). Evidence: Log source inventory with the latest event per source, plus storage access controls.
Maintain detections for unauthorised configuration changes, anomalous authentication and suspicious execution (IT.DET-02.2). Evidence: Detection inventory mapped to domains.
Define triage timeframes and incident thresholds, including outside business hours, and correlate identity, application, data and infrastructure activity (IT.DET-03.1, IT.DET-03.2). Evidence: Alert and investigation records with timestamps and decisions.
Reassess monitoring when systems, services or architecture change (IT.DET-05.1). Evidence: Dated coverage reviews and test results.
Document, approve and regularly test response procedures (IT.RES-03.1). Evidence: Approved response plans and recent exercise reports.
Build regulator, ASD and contractual notification steps into the response procedures where they apply (IT.RES-05.1). Evidence: Notification procedures and records from previous incidents.
Examine how incidents progressed, identify gaps and reassess monitoring and response (IT.RES-04.1, IT.RES-04.2). Evidence: Post-incident reviews with tracked improvement actions.
Boundary services checks cover internet-facing systems and services connecting environments of different trust levels, including cloud-hosted, supplier-operated and non-production services.
Identify all externally accessible systems, including test services. Evidence: External discovery results reconciled against the inventory.
Apply updates within risk-based timeframes and prioritise vulnerabilities exceeding risk thresholds on exposed systems (IT.PRO-06.2, IT.PRO-06.3). Evidence: Vulnerability scans and per-finding time-to-remediate records.
Remove unnecessary services, insecure settings and weak protocols, and monitor against approved baselines (IT.PRO-04.1, IT.PRO-04.3). Evidence: Configuration standards and drift reports.
Inspect content from untrusted sources and block known malicious destinations (IT.PRO-09.3, IT.PRO-09.2). Evidence: Filtering policies and blocked activity records.
Require phishing-resistant MFA for remote access and exposed management interfaces (IT.PRO-13.4). Evidence: Authentication policy exports and sign-in records by method.
Place boundary systems in appropriate network zones and restrict traffic to approved pathways (IT.PRO-18.1). Evidence: Segmentation rules and connection records.
Check the integrity and source of software, components and updates before use, and track vendor advisories (IT.PRO-16.1, IT.PRO-16.2). Evidence: Integrity verification and advisory tracking records.
Identity services checks cover directories, identity providers, credential stores and their accounts. Phishing-resistant MFA is the working target, and the assessment extends to enforcement, exceptions and credential protection.
Apply phishing-resistant authentication for users and review exclusions, fallback methods and enforcement gaps (IT.PRO-13.4). Evidence: Per-user authentication method reports and policy exports.
Turn off legacy protocols, or restrict and monitor them under a time-bound decommissioning plan (IT.PRO-13.5). Evidence: Protocol policies and sign-in records by protocol.
Disable unnecessary accounts, keeping exceptions only where documented, justified, hardened and monitored (IT.PRO-13.1). Evidence: Stale-account reports and approved exceptions.
Keep distinct credentials for users, machines and service accounts, with no shared local administrator passwords (IT.PRO-13.6). Evidence: Local administrator password management reports.
Keep keys, secrets and tokens in approved access-controlled repositories protected by MFA (IT.PRO-13.2). Evidence: Repository access lists and policy settings.
Reassess permissions to sensitive applications and information on a defined schedule (IT.PRO-12.1). Evidence: Completed and approved access reviews.
Baseline directory and identity tenant configurations and detect unauthorised drift (IT.PRO-04.3). Evidence: Configuration snapshots and change alerts.
Critical processes and services checks show whether the systems and dependencies behind an organisation’s primary outcomes can be protected, isolated and recovered.
Identify the applications, information, infrastructure and suppliers each critical process depends on. Evidence: Dependency maps approved by business owners.
Back up important data, applications and configurations to encrypted storage with immutable, offline or equivalent protection (IT.PRO-10.1). Evidence: Backup job reports and storage protection settings.
Show restoration meets defined recovery time and recovery point objectives for important assets (IT.PRO-10.3). Evidence: Restoration test results with the times and points achieved.
Separate backup storage from user environments, production workloads and their administrators (IT.PRO-10.2). Evidence: Repository permissions and isolation configurations.
Restrict communication and lateral movement to explicitly approved pathways (IT.PRO-18.2). Evidence: Segmentation policies and validation test results.
Inspect outbound traffic for unauthorised movement of sensitive or high-value information (IT.PRO-09.1). Evidence: Inspection policies and transfer alerts.
Privileged environments checks cover administrator accounts, management systems and the pathways used to control other systems, separating privileged activity from ordinary user access.
Administer from hardened environments separated from routine email and web browsing (IT.PRO-05.1). Evidence: Administrative workstation build standards and access records.
Require explicit session establishment and time-bound elevation, and review standing access (IT.PRO-05.2). Evidence: Elevation logs and completed access reviews.
Capture the user, timestamp and target when administrators modify systems, configurations or security controls (IT.PRO-05.3). Evidence: Audit records containing those fields.
Permit approved management software to run only from authorised locations (IT.PRO-07.2). Evidence: Application control policies for administrative tooling.
Review enforcement across privileged accounts, including break-glass and service administration accounts (IT.PRO-13.4). Evidence: Authentication method reports and policy settings for privileged identities.
Monitor built-in utilities and administrative software for suspicious use. ASD applies this action across phase 1 and phase 2 domains (IT.DET-04.1). Evidence: Detection rules and generated alerts.
Business systems checks cover the servers and applications behind everyday operations.
Permit only authorised software on servers, with maintained application control rules and time-bound exceptions (IT.PRO-07.1). Evidence: Policy exports and blocked-execution records.
Apply updates within defined timeframes and track compliance (IT.PRO-06.2). Evidence: Patch compliance reports by system.
Remove unnecessary functions, insecure settings and default accounts (IT.PRO-04.1). Evidence: Configuration baselines and deviation reports.
Validate service account privileges against their current purpose on a defined schedule (IT.PRO-12.1). Evidence: Service account inventories with review dates.
Include application configurations and important data in backup and recovery testing (IT.PRO-10.1, IT.PRO-10.3). Evidence: Backup reports and restoration test records.
User devices checks cover staff laptops, desktops and mobile devices. Evidence has to cover the whole device population. A report drawn only from compliant devices leaves out the ones an assessor most needs to see.
Restrict unapproved executables, scripts and installers through application control (IT.PRO-07.1). Evidence: Policy coverage and blocked-execution records.
Permit macros only from trusted, signed sources. Evidence: Macro policy settings and execution records.
Apply centrally managed security settings to browsers and office applications, disabling risky functionality (IT.PRO-04.2). Evidence: Configuration compliance reports.
Keep devices and user applications updated within defined timeframes (IT.PRO-06.2). Evidence: Device patch compliance reports.
Forward device telemetry to centralised monitoring so investigations can connect endpoint, identity and network activity (IT.DET-01.2). Evidence: Monitoring coverage reconciled against the device inventory.
An organisation can run a self-assessment with ASD’s published process and workbook. Independent assessment adds assurance where a regulator, policy or contract calls for it, or where management wants an outside check on its own conclusions.
Several Australian government assurance arrangements already use self-assessment:
PSPF reporting uses an annual self-assessment. Entities report Essential Eight requirements as fully implemented, risk managed or not yet implemented. Home Affairs may request supporting evidence during quality assurance.
The NSW Cyber Security Policy 2026-2027 requires annual evidence-based attestation by October 31.
VMIA’s Cyber Maturity Benchmark provides a voluntary self-assessment based on the Essential Eight.
The weakness of self-assessment is that the people who implement the controls may also be the ones judging them. The ANAO has identified overstated maturity in Commonwealth self-reporting. Separately, its June 2026 interim report found that one of 22 major entities reported full compliance with all Essential Eight strategies as at June 30, 2025.
A self-assessment holds up when every rating traces to evidence and the report shows the unresolved gaps and limitations.
Independent assessment helps most where the team running the controls also conducts the self-assessment. It gives greater confidence in the scope, the evidence and the ratings. ASD’s implementation planning guide says organisations may engage an independent assessor where proportionate and affordable, but this is not required.
but this is not required.
An internal audit team or an external assessor can apply the same scope, rating method and evidence expectations.
Before selecting an assessor, agree how scope will be set, how technical testing will be approved, which evidence will be accepted, how existing Essential Eight records will be reused and who will get evidence from managed service providers or other operators. The organisation stays responsible for making the agreed scope assessable, even where a third party operates some of the systems. If a managed service provider cannot supply its firewall or backup records in time, for example, the affected actions end up not assessed.
ASD publishes the assessment workbook for enterprise IT as an Excel file, alongside a machine-readable OSCAL release, for recording and managing assessment information. The workbook includes:
Records controls and evidence carried forward from Essential Eight implementation.
Support assessment of the applicable actions within each domain.
Consolidates domain-level assessment results.
Presents a heatmap of principle effectiveness.
Fill in the workbook from the agreed domain scope and the evidence collected. Existing Essential Eight information saves collecting the same records twice. Action ratings still have to reflect the relevant assets and outcomes, and the assessor decides whether the carried-forward evidence is current, complete and sufficient for each action.
ASD also published the enterprise IT chapter in Open Security Controls Assessment Language (OSCAL), with the release labelled E4EIT OSCAL v2026.10.15 and a GitHub mirror. Governance, risk and compliance tools can use it to link controls, domains, evidence and findings to ASD action identifiers. OSCAL is a way of recording an assessment. Whether an action is effective still depends on the evidence.
ASD has published the workbook and the OSCAL material. It has not published a product called an “Essentials tracker”, and tools promoted under that name are vendor offerings. For systems that collect control evidence continuously, see ASD Essentials monitoring and reporting.
An ASD Essentials assessment, an Essential Eight audit and organisational certification are different forms of assurance. Whoever commissions the work should state the framework, the method, the scope and how the results will be used.
An internal assessment supports remediation planning and management reporting. An independent review examines implementation and evidence with greater separation from the teams running the controls. A formal audit may operate under separate statutory, regulatory or contractual authority.
An Essential Eight security audit in Australia should state whether it follows ASD’s Essential Eight Assessment Process Guide or another defined audit method.
ASD does not provide organisational certification under either ASD Essentials or the Essential Eight. Its three-day Essential Eight assessment course, delivered with TAFEcyber, provides an individual certificate following an examination.
IRAP assessors are ASD-endorsed individuals. They do not accredit, endorse or register systems on ASD’s behalf. ASD has indicated that a training course for ASD Essentials assessors will be developed.
An assessment report names the framework, scope, methods, evidence, assessor and findings, and presents its conclusions as assessment results. Describing them as ASD-issued organisational certification claims something ASD does not offer.
Essential Eight assessments are still needed wherever a policy, regulatory obligation or contract explicitly names the Essential Eight, as the PSPF, DISP and SOCI rules do. ASD Essentials does not replace those obligations or invalidate existing Essential Eight assessments, and the Essential Eight Assessment Process Guide continues to apply to them.
That process has its own rules. Exceptions should not be approved for more than one year, and accepting risk cannot justify omitting an entire mitigation strategy.
An Essential Eight maturity level does not convert into an ASD Essentials effectiveness rating. Where both frameworks apply, reuse the relevant technical evidence and keep the judgements separate. A patch compliance report may support both, but its relevance and coverage need checking against each framework.
The transition guide explains how to coordinate the work and identify actions that existing Essential Eight evidence may not address.
For reporting to the board, ASD expects both a summary view, showing progression by domain and priority phase, and a detailed view of the underlying action ratings, evidence, gaps and remediation.
A useful board report includes:
Effectiveness percentages for the applicable capability and technical domains, with the assessed scope stated.
The principles and underlying actions limiting each domain’s result.
Incomplete coverage shown separately from confirmed weaknesses, with the reasons evidence was unavailable.
Improvements, deterioration and scope changes, so results remain comparable.
The improvements required, responsible owners and expected completion dates.
Exceptions, accountability, compensating controls and expiry dates.
A favourable percentage can hide a material weakness in an important control, so pair it with the findings driving the result. Report remediation progress and proven effectiveness separately. Deploying a control does not show that the action achieves its outcome.
Executive accountability is itself an ASD Essentials principle, GOV-01, and evidence-backed reporting lets governing bodies review risk and monitor corrective action.
ASD has published no reassessment interval for ASD Essentials. Annual assessment is a practical starting point for organisations already on annual assurance cycles, such as PSPF reporting or NSW attestation, adjusted for reporting needs and change in the environment. A cloud migration, acquisition, new identity provider or major incident may justify reassessing affected domains earlier.
Visibility and response evidence should stay current all year. Monitoring coverage, triage times, detection testing, incident records and exercise results show whether actions keep operating between assessments.
Compare the same scope from one assessment to the next where practical, and explain any change to the assessed assets. Otherwise an apparent improvement may only reflect a narrower assessment.
ThreatDefence supports ASD Essentials assessments through continuous control monitoring, automated evidence collection and security operations records that help show how controls operate.
ThreatDefence runs a 24x7 SOC with its team based in Australia and a 3 min average response under guaranteed SLAs. Threat hunting and an incident response retainer are included in the standard service.
Response actions remain within the authority each customer approves, and case records can be exported for an assessor or at the end of a contract. Australian customers’ data and AI processing stay in Australia.
Continuous monitoring and automated collection provide dated evidence for the relevant domains, allowing assessors to examine current control information rather than relying only on screenshots and interviews.
The SOC produces evidence relevant to Visibility and response through normal operations, including log coverage, detection testing, triage times and incident records. Detections for new MFA methods and privileged role changes directly support the identity and privileged access checks described above.
ThreatDefence does not certify organisations. The assessor determines the applicable ASD Essentials ratings using the agreed scope, methods and evidence.
Organisations can also use the free ASD Essentials Navigator to rate their environments action by action, with principle and domain results updating as assessments progress. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.
Open the ASD Essentials Navigator Start the 5-Minute Explainer Explore ASD Essentials Compliance
See how ThreatDefence automates security monitoring, compliance and cyber risk management in one platform.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
An ASD Essentials assessment rates each applicable action within a domain as not assessed, not effective, partially effective or fully effective. A principle receives the lowest rating among its applicable actions. ASD’s transition guide describes a four-tier scale, while its FAQ treats not assessed as a separate status.
Each applicable principle scores 0 for not effective, 0.5 for partially effective or 1 for fully effective. The scores are added and divided by the number of applicable principles in the domain. ASD’s Visibility and response example has five fully effective, four partially effective and one not effective principle, producing 7 out of 10, or 70%.
Yes. ASD’s assessment process guide supports organisations assessing their own environments, and the official workbook records ratings and supporting evidence. A self-assessment needs a defined scope, approved methods and records showing how effective each applicable action is. Independent assessment is optional unless a regulator, policy or contract calls for it.
No. A completed ASD Essentials checklist shows where the implementation gaps are and organises remediation and evidence collection. ASD’s transition categories, effectively addressed, partially addressed and not addressed, are planning findings rather than formal ratings. An assessment rates each applicable action on evidence and rolls the results up into principle ratings and domain percentages.
No. The checklist on this page is a working reference written in our own words. ASD publishes the official assessment process guide, assessment evidence guide and Excel assessment workbook, which set which actions apply, how ratings are assigned and what evidence supports each judgement. The checklist helps organise the work. It does not replace ASD’s workbook or the assessor’s professional judgement.
Yes. An existing Essential Eight checklist is a useful starting point because many controls and records remain relevant. It misses some ASD Essentials actions, such as executive accountability (IT.GOV-01.1), supplier assurance (IT.GOV-11.1), exposed credential scanning (IT.PRO-13.3) and detection coverage reviews (IT.DET-05.1). Record existing controls in the workbook’s Existing E8 Controls sheet, then assess them against each applicable domain.
No. The checklist follows the ASD Essentials enterprise IT chapter. For OT, implementation phases are reordered and device checks fold into Privileged environments, as explained in ASD Essentials for OT. A cloud assessment also has to consider where responsibility for each action sits, using ASD Essentials for cloud. An enterprise IT checklist is not complete coverage of those environments.
No. ASD uses the term “assessment” in both its Essential Eight and ASD Essentials guidance. An audit generally describes more formal assurance, such as the ANAO’s statutory audits of Commonwealth entities, which examine whether reported implementation is supported by evidence, as the 2026 audit of the Department of Parliamentary Services did. Before engaging anyone, confirm the framework, scope, method and type of work.
ASD Essentials Explained: Framework, Chapters and Enterprise IT
"Essential Eight vs ASD Essentials: What Changed and How to Transition"
ASD Essentials Visibility and Response