AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
A small business can apply ASD Essentials without a security team of its own.
Most of the work is switching on controls in the cloud services it already pays for and agreeing with its IT provider who does what. Responsibility for the security outcome stays with the business.
ASD published ASD Essentials on October 15, 2026 as its evolution of the Essential Eight, written primarily for Commonwealth entities, critical infrastructure and large organisations. Small and medium businesses can apply the guidance where relevant. It tends to matter first when a larger customer asks for evidence of security controls or a contract calls for formal assurance.
Every chapter of ASD Essentials includes guidance for smaller organisations, and ASD says the outcomes its principles describe remain equally important at any size. A small firm and a federal department both need to know who can sign in, whether backups restore and who acts when something goes wrong.
In ASD’s words, What differs is how those outcomes are achieved and how much responsibility sits with service providers and vendors.
What differs is how those outcomes are achieved
For a very small business, ASD’s small business cyber security handbook is often the simpler place to begin. ASD Essentials becomes more useful as the business grows, depends on more complex systems or has to show its security controls to larger customers.
Having no internal security team does not block any of this. The business can still name who manages access, who checks backups and who responds to incidents, and keep the records showing those jobs get done.
As of late 2026, ASD Essentials is mandatory for no one. The obligations a small business is likely to face still name the Essential Eight, and they still apply.
Start from the requirement the business actually faces. A Defence supplier subject to DISP keeps meeting its Essential Eight obligations, and an ASD Essentials assessment is no substitute. A supplier answering customer security questionnaires first finds out which controls the customer expects and what evidence it will accept.
ASD’s maturity model FAQ suggests Maturity Level One may suit small to medium enterprises. That is general guidance. A higher target set by a contract or program takes precedence.
ASD Essentials for Critical Infrastructure covers the SOCI options.
Most of the evidence a customer asks for already sits in systems the business pays for: the identity service, device management, backup and the IT provider’s reports. The work is exporting it on a schedule and keeping it dated.
Larger customers may ask suppliers to show that security controls keep operating. Customer assurance is one of the more likely ways ASD Essentials will reach small businesses before any regulatory transition.
The enterprise IT chapter includes Supplier cyber security assurance (GOV-11). It asks organisations to select suppliers through a proportionate risk assessment and keep assurance current. ASD has not yet published a supplier assessment method, so each customer writes its own questions.
The evidence pack below covers the controls customers and insurers ask about most. The collection methods are common practice rather than ASD requirements.
A dated export or provider report is generally stronger evidence than a lone screenshot. A screenshot still helps when it shows the account or device, the service and the date.
Evidence has to cover the period the customer asks about. An MFA policy exported today says nothing about whether it was enforced throughout the previous reporting period. Patch history and monthly provider reports fill that gap.
The pack should show what is implemented, what is operating and what is still incomplete. A list of passed checks is no ASD Essentials rating without an assessment behind it, and ASD certifies no organisation under either framework.
A small business can outsource most of its IT operations. Accountability for the security outcome stays where it was. ASD Essentials for cloud explains this split for cloud services.
One page per provider is enough to record where responsibilities sit:
The protections the provider implements, operates and maintains.
The security features the business must enable, configure, approve or operate.
The reports or records that show the provider is meeting its responsibilities.
Who investigates, who can take response actions and who must be contacted.
Unavailable controls, incomplete configurations and work awaiting action.
The register matters most where the provider manages an identity service or backup system but the business controls the subscription settings and authorises changes. That is where each side can assume the other has switched a feature on.
Review the register when subscriptions, providers or managed services change. A provider’s general assurance report covers the provider’s own operations. It does not show that every security feature available to the business has been enabled.
No published regulatory requirement makes the Essential Eight, or a particular maturity level, a condition of purchasing cyber insurance. The claim that insurers universally require Maturity Level Two has no published requirement behind it.
Cyber insurance questionnaires commonly ask about MFA, backups, patching, privileged access and incident response. The exact questions and acceptance criteria vary between insurers, so a business answers the questions on its own policy form. An Essential Eight maturity rating does not answer them by default.
Insurance also cannot stand in for a control. ASD’s Essential Eight maturity model FAQ states that risk transfer, including cyber insurance, cannot justify leaving an entire Essential Eight mitigation strategy unimplemented.
Doing so results in Maturity Level Zero for that strategy and for the overall Essential Eight assessment. Under ASD Essentials, insurance does not change whether an action achieves its intended outcome.
The evidence pack above is the basis for insurance applications and renewals. Answers describe the controls operating at the time of the application, including coverage limits and exceptions.
When presenting an assessment to an insurer:
Identify the domains and assets assessed, the assessment date and exclusions. An early-phase assessment should not be presented as a conclusion about the entire environment.
ASD uses “not assessed” for actions or domains that have not been assessed or lack sufficient evidence for a rating. Keep planned work separate from assessed results.
If the insurer asks about MFA, provide the rating for IT.PRO-13.4 with its scope and exceptions. A favourable overall score does not show that the specific MFA action is fully effective.
A business can score well on backups and patching and still have accounts without the required authentication protection. The insurer’s MFA question is answered from the MFA evidence, whatever the overall assessment result.
Small business security governance comes down to named people: who decides, who accepts risk and who runs each control. The accountable executive may be the owner or a director, with technical work performed by an external IT provider.
The Governance and culture principles can be recorded without extensive documentation:
Name the director accountable for cyber security, record the risk the business is prepared to accept and set a review interval.
Maintain a risk register with an owner, treatment and review date for each identified risk.
Record who operates and monitors each security control, including responsibilities assigned to external providers.
Decide who approves AI tools and features and what business information they may access.
Identify unsupported systems, their compensating controls and the planned replacement date.
The records should describe how decisions are made in practice. When a provider reports an unsupported device, for example, the business can show who accepted the temporary risk, what protection remains and when the decision comes up for review.
Dated decisions with a named owner and a completed review carry more weight than a policy that does not match how the business runs.
Budgeting for ASD Essentials in a small business separates the one-off work of setting a control up from the recurring cost of running and reviewing it. Existing subscriptions may already include some of the capability, but it still has to be configured, monitored and evidenced.
ASD suggests working through one domain at a time from priority phase 1, with funding released in tranches aligned with implementation phases. The ASD Essentials checklist lists actions by domain.
Review existing subscriptions before purchasing more technology. The first round of work may be enabling available controls, collecting provider reports and listing gaps, with the systems already in use left in place.
Independent assessment is optional. ASD’s implementation planning guide says organisations may engage an assessor where proportionate and affordable, but this is not required.
but this is not required
Between formal reviews, the guide suggests classifying actions as addressed, partially addressed or not addressed. Domains not yet reached are reported as not assessed, which is neither a pass nor a fail.
Reassess when a provider changes, systems are replaced or an incident reveals a control weakness. The same evidence pack carries over: update the affected records and leave the rest.
ThreatDefence runs a 24x7 SOC with its team based in Australia and a 3 min average response under guaranteed SLAs. Threat hunting and an incident response retainer are included in the standard service.
Response actions remain within the authority each customer approves. Case records can be exported for an assessor or at the end of a contract. Australian customers’ data and AI processing stay in Australia.
Through the 24x7 SOC service, analysts can disable an account or block a sender outside business hours. A small business can also check the included incident response retainer against its cyber insurance policy’s responder and consent conditions before an incident occurs.
ThreatDefence does not certify organisations. An assessor determines ASD Essentials ratings based on the applicable scope and evidence.
The free ASD Essentials Navigator maps every principle and action by chapter and priority phase, and turns entered ratings into a board summary. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.
Open the ASD Essentials Navigator Start the 5-Minute Explainer Explore ASD Essentials Compliance
See how ThreatDefence automates security monitoring, compliance and cyber risk management in one platform.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
Partly. ASD developed the framework primarily for Commonwealth entities, critical infrastructure and large organisations, while recognising that small and medium businesses can apply it where relevant. The security outcomes remain important regardless of size. In ASD’s words, What differs is how those outcomes are achieved, including the responsibilities carried by service providers and vendors. Very small businesses may find ASD’s small business guidance a simpler place to begin.
A small business using the enterprise IT chapter starts with the priority phase 1 domains, Boundary services and Identity services, alongside Governance and culture and Visibility and response. Review existing subscriptions and provider responsibilities before purchasing additional tools. A business running entirely on SaaS and PaaS, with no servers or networks of its own, may find the cloud chapter the better starting point. The technology the business actually runs decides which guidance applies.
Yes, particularly where a customer, contract or regulator still requires it. Existing Essential Eight controls also provide a foundation for ASD Essentials. Every Essential Eight mitigation strategy maps to at least one ASD Essentials principle, so much of the implementation and its evidence carries over. ASD advises against pursuing a superseded Essential Eight target that neither an obligation nor current security needs justify. Existing contractual or regulatory requirements should still be met.
No. ASD’s Essential Eight maturity model FAQ says risk transfer, including cyber insurance, cannot justify leaving an entire mitigation strategy unimplemented. An organisation relying on insurance instead of implementing a strategy receives Maturity Level Zero for that strategy and for its overall Essential Eight assessment. The same logic carries into ASD Essentials outcomes: insurance may transfer financial risk, but it does not make a security action effective.
Cyber insurance questionnaires commonly ask about MFA, backups, patching, privileged access and incident response, although requirements vary between insurers. No published regulatory requirement names the Essential Eight or a particular maturity level. Answer each question from dated evidence of controls currently operating, including exceptions. For an MFA question, provide the scope, exceptions and rating for IT.PRO-13.4 phishing-resistant MFA. A favourable overall assessment does not show that this specific action is fully effective.
In ASD’s general guidance, Maturity Level One may suit small to medium enterprises. ASD’s Essential Eight maturity model FAQ also suggests Maturity Level Two for large enterprises and Maturity Level Three for critical infrastructure and high-threat environments. Those are general indications and do not replace a business’s risk assessment or contractual obligations. A customer or program may require a higher level. ASD advises reaching the same level across all eight strategies before progressing, because the least mature strategy determines overall maturity.
Yes, if they are DISP members. Defence’s cyber assessments against the Essential Eight “top 4” concluded on November 15, 2025, and all DISP members must now achieve and maintain the full Essential Eight at Maturity Level Two. Part B of the DISP Cyber Security Questionnaire contains 107 Essential Eight controls aligned with that level. DISP does not reference ASD Essentials, so the existing Essential Eight requirement remains the relevant measure for those suppliers.
No, unless a customer or contract requires one. ASD’s implementation planning guide says organisations may engage an independent assessor where proportionate and affordable, but this is not required. The assessment process guide supports organisations assessing their own environment, so in our view periodic self-assessment with dated evidence suits most small businesses. An independent review may still be useful for customer assurance. Neither an internal nor an independent assessment results in ASD certification, because ASD certifies no organisation under either framework.
Likely, in our view, potentially before a regulatory transition. The enterprise IT chapter’s GOV-11 Supplier cyber security assurance principle asks organisations to select suppliers using a risk assessment proportionate to the risk introduced and to keep assurance current. ASD has not yet published a supplier assessment method, so each customer sets its own questions and evidence expectations. A short, dated pack covering MFA, internet-facing services, backups, provider responsibilities and incident response prepares a small business to respond.
ASD Essentials Assessment and Checklist
ASD Essentials for Cloud
The Essential Eight and Its Maturity Model