AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
ASD Essentials does not yet change what a government agency has to meet or report.
The Protective Security Policy Framework (PSPF) and the state policies covered here are still written around the Essential Eight.
The Australian Signals Directorate published ASD Essentials on October 15, 2026 as its new cyber security framework. It builds on the Essential Eight with principles and actions that describe security outcomes across different technology environments. Agencies must continue meeting their existing requirements while they work out how ASD Essentials applies to their own environments.
The ASD Essentials explained guide covers the framework, its structure and its regulatory status.
PSPF Release 2026 still requires non-corporate Commonwealth entities to implement all eight Essential Eight strategies at Maturity Level Two. ASD Essentials has not been written into the PSPF as a replacement for those requirements.
Section 14.2 of PSPF Release 2026, issued on July 1, 2026, sets out the obligations:
Implement all eight Essential Eight strategies to Maturity Level Two.
Consider the remaining Strategies to Mitigate Cyber Security Incidents.
The numbered requirements carry the date October 31, 2024, from PSPF Release 2024. The Maturity Level Two mandate itself is older. It began on July 1, 2022, under PSPF Policy 10, later moved to Policy 14 and now sits in section 14.2.
The PSPF applies to non-corporate Commonwealth entities. For corporate Commonwealth entities and Commonwealth companies, applying it is better practice and carries no mandatory obligation.
Section 14.3 deals with other security standards. ISO/IEC 27001 and similar standards are useful, but the PSPF states that they are not suitable for use as an alternative authorisation to operate pathway. An entity relying on such a standard must explain the deviation in its annual security report.
not suitable for use as an alternative authorisation to operate pathway
The ASD Essentials framework comparison explains what each of these standards is for.
The Essential Eight requirements that apply are still those in the November 2023 Essential Eight Maturity Model, which is the current release. The Essential Eight Maturity Model guide covers the requirements at each level.
For a Commonwealth agency today, the PSPF sets the mandatory Essential Eight target. ASD Essentials is additional guidance for assessing and improving security outcomes.
Every non-corporate Commonwealth entity must report its security position to its minister and the Department of Home Affairs each financial year. Since November 1, 2024, this annual PSPF reporting has been compliance-based, replacing the previous PSPF maturity self-assessment model.
An entity places each Essential Eight requirement in one of these reporting categories:
The requirement has been implemented.
The requirement is reported under the PSPF’s risk-managed category.
The requirement remains outstanding.
The categories describe the entity’s PSPF compliance position and nothing more. They are separate from ASD Essentials effectiveness ratings, and a risk-managed PSPF response says nothing about how the same control would be rated under ASD Essentials.
ANAO Report No. 38 2025-26, published June 11, 2026, notes that Home Affairs does not require entities to submit supporting evidence with their annual reports. Home Affairs can still request that evidence through its quality assurance process.
Independent ANAO audits can also examine the basis for reported compliance. ANAO’s Insights on cyber security, published June 14, 2023, identified cases where entities overstated their PSPF maturity.
An agency therefore needs evidence that can back its reported position, even though none of it travels with the annual report. A typical case is a requirement reported as fully implemented and queried a year later. The agency then has to show which systems were assessed and on what date, from records made at the time.
ASD’s transition guidance says Maturity Level Two was the required baseline for Commonwealth entities, and that organisations at that level can expect many existing controls to contribute to actions in the early ASD Essentials priority phases.
was the required baseline
One current evidence base can feed both reports, with a PSPF view and an ASD Essentials view drawn from it. The collection methods are common practice rather than ASD requirements. The PSPF does not prescribe them either.
where it remains current and relevant
A dated system export or a signed assessment report usually carries more weight than a screenshot by itself. A screenshot earns its place in the file when it identifies the system or tenant, the relevant scope and the date.
ASD’s assessment guidance expects evidence recent enough to reflect current operation. Records gathered in the final week of preparation show that week only. The file needs records from across the reporting period, such as monthly exports, to show how the controls operated throughout it.
The same evidence can support both reporting processes, but each puts a different question to it. A PSPF report records the entity’s position against specific obligations. An ASD Essentials assessment asks whether the applicable actions achieve their intended security outcomes within each domain.
The published Commonwealth cyber posture results each measure Essential Eight implementation in a different population and by a different method. Their percentages cannot be read against one another as a single measure of government cyber security maturity.
The ASD figure describes overall Essential Eight maturity, including compensating controls. The Home Affairs figures describe compliance categories across section 14 performance questions. The ANAO figure counts how many of the 22 major entities reported full compliance with every Essential Eight strategy.
An agency can sit inside one report’s population and still fall short of the measure another report uses. In executive reporting, each result belongs with its own population and measure.
The drop in ASD’s 2024 maturity figure followed the November 2023 update to the Essential Eight Maturity Model.
The Commonwealth Cyber Security Posture in 2025 also found a gap between incident response planning and external reporting. While 90% of entities had an incident response plan, only 35% reported at least half of their observed incidents to ASD.
That gap falls under the Cyber security incident coordination principle (RES-05) in ASD Essentials, which covers building external coordination obligations into incident response. ASD’s assessment evidence guide also lists ISM-0140, reporting incidents to ASD, as related evidence.
An agency’s incident response plan can say when to contact ASD. The record of reports actually made helps show whether that coordination took place. With detection times, reporting times and report references kept together, an assessor or auditor can compare the plan with what happened.
State and territory governments set their own cyber security requirements, separate from the Commonwealth PSPF. The policies in the table below still reference the Essential Eight. As of late 2026, none of them had adopted ASD Essentials as a mandatory replacement.
Maturity targets and reporting arrangements differ substantially from one jurisdiction to the next.
does not mandate any specific maturity level
The NSW Cyber Security Policy 2026-2027 makes Essential Eight Maturity Level One controls part of its mandatory baseline. Requirements 3.3 to 3.10 set out those controls, and agencies provide an evidence-based assurance assessment and annual attestation by October 31.
A NSW agency that also runs an ASD Essentials assessment keeps the two apart. The attestation covers the mandatory controls, and the ASD Essentials results are reported beside it. ASD Essentials does not move the attestation deadline.
Western Australia’s 2026 policy sets a different target. Its key controls are the Essential Eight at Maturity Level Two plus five further ACSC strategies, and all Protect-domain controls are required by December 2028.
That is a step up from the 2024 policy, which targeted Maturity Level One. Both versions remain listed on the WA Government policy page, and some secondary guidance still describes the earlier position.
Agencies should work out their obligations from the 2026 policy itself. A summary written against the earlier version gives the lower target.
Queensland adopts the Essential Eight without prescribing a particular maturity level. Agencies set their own targets through risk assessment under the QGEA guideline and IS18.
South Australia also leaves the target maturity level to agencies, and recommends Maturity Level One across all strategies as a minimum. Essential Eight maturity is reported in the annual SACSF attestation.
Victoria’s Cyber Maturity Benchmark is voluntary. Agencies can use its Essential Eight results to inform VPDSS Standard 11 reporting, but the benchmark does not replace that reporting obligation.
This guide does not cover Tasmania, the Australian Capital Territory or the Northern Territory. Agencies there should go to their own government’s cyber security policy.
No single maturity target describes government as a whole. Each agency starts from its own jurisdiction’s requirements, then decides how ASD Essentials will sit alongside its existing assurance work.
No. ASD Essentials is not currently a mandatory requirement under PSPF Release 2026 or under any of the state policies covered in this guide.
ASD’s transition guidance says organisations whose reporting obligations still use Essential Eight terminology should continue meeting those obligations as directed by the relevant authority.
as directed by the relevant authority
Publishing ASD Essentials did not, by itself, amend the PSPF, change an Essential Eight maturity target or create a new state reporting requirement.
For Commonwealth entities, any change to mandatory PSPF requirements must come through the relevant policy or regulatory process. State agencies must likewise follow their jurisdiction’s own policy updates and directions.
Agencies can start using ASD Essentials now to assess their environments and understand broader security outcomes. Until the relevant authority changes its requirements, that work should be labelled clearly enough that nobody reads it as mandatory reporting.
The ASD Essentials chapter that applies depends on the technology environment an agency operates. Whether the agency belongs to the Commonwealth, a state or local government makes no difference.
ASD’s Which chapter should I start with? guidance recommends the enterprise IT chapter for on-premises, hybrid and infrastructure-as-a-service environments.
Which chapter should I start with?
It recommends the cloud chapter for environments delivered predominantly through software-as-a-service and platform-as-a-service.
ASD gives an example that fits smaller government bodies: a small Commonwealth entity or statutory body whose entire corporate environment runs on a cloud productivity and collaboration suite.
small Commonwealth entity or statutory body whose entire corporate environment runs on a cloud productivity and collaboration suite
In our view, agencies responsible for physical infrastructure, including transport and water systems, may also need the ASD Essentials OT chapter.
One government portfolio can hold a conventional enterprise IT environment, cloud-delivered business services and operational systems, each with a substantially different risk profile.
ASD’s implementation planning guidance says that where business units have different risks or regulatory obligations, their environments should keep their own operating context and priorities.
Each environment keeps its own ASD Essentials assessment results. A consolidated portfolio report can bring those results together as long as the domain ratings underneath stay visible.
For example, a strong result for corporate IT can be averaged with a weak domain in a separately assessed operational environment. The combined figure looks healthy and the weak domain drops out of sight.
Domains that have not yet been assessed need the same care. Shown as not assessed, they stop a portfolio summary from appearing more complete than the assessment behind it.
Reporting by domain helps ministers, accountable authorities and executive committees see which government services or business functions a security weakness affects.
ASD organises domains around business functions, so an agency can describe a weakness by the assets and services it touches.
An executive report can show both the current mandatory PSPF compliance position and the ASD Essentials assessment of relevant environments. The reader should be able to tell which is which, because they serve different purposes.
ThreatDefence operates a 24x7 SOC with its team based in Australia and a 3 min average response under guaranteed SLAs. Threat hunting and an incident response retainer are included in the standard service.
Response actions remain within the authority approved by each customer. Case records can be exported for an assessor or at the end of a contract, allowing agencies to retain the record of each investigation.
Australian customers’ data and AI processing remain in Australia. ThreatDefence does not certify organisations; the assessor determines ASD Essentials ratings.
Exported case records can support Home Affairs quality assurance requests and ANAO audits where reported compliance depends on security monitoring, incident handling or response evidence.
Local government organisations can review SIEM and SOC services for local government. Agencies responsible for physical infrastructure can explore critical infrastructure security monitoring.
The free ASD Essentials Navigator maps every principle and action by chapter and priority phase. Agencies can enter their ratings and produce a board summary of their ASD Essentials assessment. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.
Open the ASD Essentials Navigator Start the 5-Minute Explainer Explore ASD Essentials Compliance
See how ThreatDefence automates security monitoring, compliance and cyber risk management in one platform.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
No. PSPF Release 2026, issued on July 1, 2026, still requires the eight Essential Eight strategies at Maturity Level Two through Requirements 0099 to 0106. ASD Essentials has not been adopted as the mandatory replacement.
As of late 2026, no published PSPF document or Home Affairs statement had introduced that change. Commonwealth entities should continue reporting against their existing PSPF requirements and watch for policy updates.
State and territory agencies must meet the cyber security requirements of their own jurisdiction. NSW mandates Essential Eight Maturity Level One controls and annual attestation by October 31. WA’s 2026 policy sets the Essential Eight at Maturity Level Two as key controls, plus five further ACSC strategies, with all Protect-domain controls due by December 2028.
Queensland does not mandate a specific maturity level, South Australia recommends Maturity Level One without requiring it, and Victoria’s benchmark is voluntary. This guide does not cover Tasmania, the ACT or the Northern Territory.
Possibly, but no published government guidance confirms a future requirement for dual assessment.
At the framework’s launch in October 2026, the expectation was that agencies would be assessed against both frameworks the following year, and the ACSC head expected regulatory transition timing to be worked out over the next year or two. Neither is a confirmed ASD or Home Affairs requirement. ASD says it will advise on transition expectations in due course.
Non-corporate Commonwealth entities must meet the Essential Eight requirements in the PSPF. Requirements 0099 to 0106 specify Maturity Level Two for all eight strategies.
For corporate Commonwealth entities and Commonwealth companies, the PSPF is better practice and carries no mandatory requirement. State and territory agencies follow their own jurisdiction’s policies, such as the NSW Cyber Security Policy 2026-2027 or the 2026 WA Government Cyber Security Policy. The obligation comes from whichever government policy applies.
The requirement began on July 1, 2022, under PSPF Policy 10. It subsequently moved to Policy 14 and now appears in section 14.2 of PSPF Release 2026.
Requirements 0099 to 0106 carry the date October 31, 2024, from PSPF Release 2024. Those dates trace the policy’s history. The maturity target did not change with them. The November 2023 Essential Eight Maturity Model, still the current release, defines the controls required to achieve Maturity Level Two.
Non-corporate Commonwealth entities report their PSPF security position to their minister and the Department of Home Affairs each financial year. Since November 1, 2024, reporting has used a compliance-based model in place of the previous maturity self-assessment model.
Each Essential Eight requirement is reported as “fully implemented”, “risk managed” or “not yet implemented”. These categories belong to PSPF reporting. None of them translates directly into an ASD Essentials effectiveness rating, which is given to applicable actions within individual domains.
No. ANAO Report No. 38 2025-26, published June 11, 2026, states that Home Affairs does not require supporting evidence to be submitted with annual PSPF reports. Home Affairs can still request evidence through its quality assurance process.
Independent ANAO audits can also test reported compliance. Agencies should keep a record of the systems assessed, requirement references, assessment dates, supporting records and approvals. ANAO has previously identified instances where entities overstated their PSPF maturity, which is why traceable evidence matters even without routine submission.
ASD’s Commonwealth Cyber Security Posture in 2025 reported that 22% of the 194 entities in scope at June 30, 2025, reached overall Maturity Level Two or higher when compensating controls were considered. The comparable figure was 15% in 2024.
Other reports use different measures. Home Affairs recorded 47% fully implemented across section 14 performance questions for 100 entities, while ANAO found that one of 22 major entities self-reported full compliance with every Essential Eight strategy. The percentages measure different things and cannot be compared directly.
ASD Essentials Visibility and Response
"Essential Eight vs ASD Essentials: What Changed and How to Transition"
ASD Essentials Assessment and Checklist