AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
ASD Essentials, ISO 27001, NIST CSF 2.0 and SOC 2 each answer a different question, so a result under one cannot stand in for a result under another.
ASD Essentials rates how effective security actions are within specific domains. ISO/IEC 27001 supports certification of a management system. NIST CSF 2.0 organises cyber security outcomes, and SOC 2 produces a CPA attestation report.
The Essential Eight belongs in the comparison too, because it is the framework Australian regulatory and government requirements still name. This guide sets out how the frameworks differ, where they overlap and how existing evidence can support more than one assessment while each result keeps its own meaning.
Compared side by side, the frameworks differ most in what each one assesses and what its result shows. An organisation may use several of them, but a certificate, a maturity assessment, an attestation report and an action effectiveness rating are different kinds of result.
whether the intended security outcome is being achieved rather than on the controls themselves.
ASD Essentials and the Essential Eight both come from ASD, but they are assessed differently. The Essential Eight measures maturity against mitigation strategies. ASD Essentials looks at how effective each action is for the assets and functions within each applicable domain.
Neither has an ASD certification scheme for organisations. ASD’s Essential Eight assessment course certifies individuals only.
ISO/IEC 27001 and SOC 2 both give independent assurance, through different processes. NIST CSF 2.0 gives a structure for assessing and communicating cyber security outcomes. It produces no directly equivalent certification or attestation result.
ASD Essentials draws its principles from ASD’s Information Security Manual (ISM). Relevant controls and evidence can be reused across frameworks, but each resulting assessment keeps its own meaning.
ISO/IEC 27001 gives assurance over an organisation’s information security management system. ASD Essentials measures how effective security actions are within the domains assessed. An ISO 27001 program can supply useful supporting records, but an ISO certificate does not produce an ASD Essentials rating.
Australian government assurance draws a similar line. Section 14.3 of PSPF Release 2026 recognises ISO/IEC 27001 and similar standards as useful, but says they are not suitable for use as an alternative authorisation to operate pathway. Commonwealth entities relying on such standards must explain the deviation in their annual security report.
not suitable for use as an alternative authorisation to operate pathway
ASD’s assessment evidence guide does not cross-reference ISO/IEC 27001. The assessment process guide still permits controls from other frameworks to be mapped against ASD Essentials actions as “a starting point”. The assessor must still determine whether the action achieves its intended security outcome.
GOV-03 is an example. Its action IT.GOV-03.1 calls for an approved risk management methodology and plan. In our reading, an organisation’s ISO 27001 risk management processes, risk register and treatment plans may already contain relevant material.
an approved risk management methodology and plan
The useful evidence is the approved methodology, its use in practice and the records it produces. The certificate shows something different: that a certification body assessed the management system against ISO/IEC 27001 within its stated scope.
A security manager can keep ISO 27001 certification and draw on the same underlying records for an ASD Essentials assessment. Each record is checked against the applicable action and domain. No result is converted from one framework into the other.
NIST CSF 2.0 is the closest structural match to ASD Essentials among the frameworks compared here. Both organise cyber security around outcomes, and ASD Essentials uses ISM principle prefixes that correspond closely to the NIST CSF functions.
The NIST CSF 2.0 functions are Govern, Identify, Protect, Detect, Respond and Recover. ASD Essentials for enterprise IT uses GOV, IDE, PRO, DET and RES for govern, identify, protect, detect and respond.
Recovery has no separate principle family in enterprise IT, although the OT chapter adds a REC principle. Backup and restoration testing appear under protect principles instead. ASD’s enterprise IT assessment evidence guide links restoration testing action IT.PRO-10.3 to NIST CSF 2.0 subcategories RC.RP-03, RC.RP-04 and RC.RP-05.
ASD gives NIST CSF 2.0 references for every enterprise IT action in its evidence guide. An organisation already using NIST CSF can follow those references to existing assessment results, control tests and operational records.
The mapping shows where evidence may exist. A NIST CSF profile describes an organisation’s position against CSF outcomes. The ASD Essentials assessment must still determine how effectively the relevant action operates in each applicable domain.
An organisation using both frameworks can keep its NIST CSF profile and trace the supporting evidence to ASD’s action-level indicators. The same record may support both assessments without making the ratings equivalent.
The Essential Eight and SOC 2 assess different aspects of cyber security assurance. An Essential Eight assessment measures how far ASD’s mitigation strategies are implemented, against maturity levels. SOC 2 is a CPA attestation examination of controls against the AICPA Trust Services Criteria.
SOC 2 is a US attestation report. It is neither an ASD framework nor an Australian regulatory assessment method, and it is absent from the PSPF, the SOCI risk management program rules and ASD’s assessment evidence guide. A SOC 2 report does not, by itself, satisfy any of those named obligations.
Where SOC 2 can still contribute is supplier assurance under ASD Essentials. GOV-11 Supplier cyber security assurance asks organisations to select suppliers following a proportionate cyber supply chain risk assessment and retain appropriate assurance evidence to support the decision. Its second action calls for current assurance that suppliers continue to meet their cyber security commitments.
retain appropriate assurance evidence to support the decision.
In our reading, a supplier’s SOC 2 report may contribute to this evidence. The organisation should check which system the report covers, the reporting period, any exceptions and whether the findings affect the service it consumes. A report scoped to a different product from the one the organisation buys, for example, adds little.
Contract terms, supplier questionnaires and other relevant assessment material may be needed alongside the report. The aim is appropriate assurance about the supplier. A file note that a SOC 2 report exists falls short of that.
For cloud services, the ASD Essentials cloud chapter also identifies an IRAP assessment scoped to the service consumed as a potential source of provider assurance.
ASD says separate guidance on assessing suppliers will follow. The Governance and culture guide examines GOV-11 in more detail.
ASD’s enterprise IT assessment evidence guide also references NIST SP 800-171r3 and AESCSF v2. An organisation that already assesses against either framework can use the mappings to find records relevant to ASD Essentials.
Titled Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. The mapping is likely to matter most to organisations handling that class of US government information.
Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
AEMO’s Australian Energy Sector Cyber Security Framework. The SOCI risk management program rules accept AESCSF as one of the available frameworks.
The enterprise IT evidence guide cross-references AESCSF v2 under every action. Energy sector organisations can use existing AESCSF assessments to locate relevant security evidence, with no need to rebuild their records from the beginning.
The reuse is of evidence only, and the ratings stay separate. An AESCSF assessment result may point to useful records, but an ASD Essentials assessor must still evaluate the corresponding action against the applicable domain.
ASD’s framework cross-references sit at action level in the enterprise IT assessment evidence guide. Each action includes “Potential evidence sources” showing where supporting evidence of that action’s effectiveness may exist when an organisation already follows another framework.
supporting evidence of that action’s effectiveness may exist
The guide references:
ASD’s Information Security Manual, version 2026.09.4, excluding Essential Eight controls.
The Essential Eight as of October 2, 2024, referenced by ISM control number.
Cybersecurity Framework subcategories.
Requirements for protecting controlled unclassified information.
Australian Energy Sector Cyber Security Framework practices.
The table shows the possible evidence sources ASD identifies for specific enterprise IT actions.
These references are a starting point for locating evidence. They do not show that the referenced framework requires exactly the same control, or that an assessment result can be transferred directly. ASD explicitly says the list is not intended to define the controls required for an action.
not intended to define the controls required
For example, an organisation may already hold authentication configuration records and control test results for NIST CSF subcategories PR.AA-01, PR.AA-02, PR.AA-03 and PR.AA-05. Those records may help assess phishing-resistant MFA action IT.PRO-13.4.
The assessor must still decide whether the relevant action is effective for the assets and functions in the domain being assessed. A control that works effectively in one domain does not automatically prove effectiveness in another.
As of late 2026, these detailed framework cross-references cover enterprise IT only. ASD has not published equivalent assessment evidence guides for the cloud or OT chapters.
Current Australian cyber security obligations still name existing frameworks, including the Essential Eight, ISO/IEC 27001 and other recognised approaches. ASD Essentials is mandatory for no one yet, and no regulator has referenced it.
An organisation should keep meeting the frameworks, versions and maturity levels its obligations name.
SOC 2 is named in none of these requirements.
Some of these obligations accept a choice of framework and others fix the result. The SOCI CIRMP rules offer a choice among recognised frameworks, while the PSPF, DISP and the NSW policy set specific Essential Eight expectations.
A customer or contract may separately ask for ISO 27001 certification or a SOC 2 report. Those requests do not replace the framework specified by an Australian regulator.
A register of obligations is a useful starting point. It records the applicable framework, version, required level and reporting expectations for each obligation. An entry for a DISP member, for example, would name the full Essential Eight at Maturity Level Two. Security teams can then prepare evidence for each obligation without treating different forms of assurance as interchangeable.
The government guide covers the Commonwealth and state requirements in more detail.
Existing ISO 27001, SOC 2, NIST and Essential Eight records can support an ASD Essentials assessment when they show the relevant security outcome. ASD’s assessment process guide tells assessors to identify and use relevant existing evidence before generating new evidence, and names configuration baselines, assessment reports, control test results, audit findings and risk registers.
identify and use relevant existing evidence before generating new evidence
Evidence collection starts with the records an organisation already keeps. The collection methods are common practice rather than ASD requirements.
where it remains current and relevant
deployment alone does not demonstrate effectiveness
Collecting these records once cuts duplicate assessment work and still leaves each framework with the evidence it needs.
How strong a record is depends on the outcome being assessed. An ISO 27001 risk register can show that a risk management process exists and is being used. A supplier SOC 2 report can inform a supplier assurance decision. A configuration export or control test may give direct evidence that a particular technical action operates as intended.
ASD’s assessment process guide asks assessors to seek the highest quality evidence reasonably practicable, ranging from evidence that directly proves the outcome to evidence that demonstrates none.
In common practice, a dated assessment report or system export is generally stronger evidence than a screenshot alone. A screenshot can still support an assessment when it clearly shows the system, scope and date.
Evidence also has to reflect how the environment operates now. An ISO certificate or SOC 2 report issued before significant system or process changes may need backing from more recent configuration records, tests or operational evidence. A report whose period ended before a move to a new identity provider is a typical case.
One well-kept set of records can support several assurance activities. Each assessment must still explain what those records show, which assets they cover and where further verification is needed.
ThreatDefence supports cybersecurity monitoring, investigation and evidence collection that can contribute to multiple assurance activities.
ThreatDefence runs a 24x7 SOC with its team based in Australia and a 3 min average response under guaranteed SLAs. Threat hunting and an incident response retainer are included in the standard service.
Response actions remain within the authority approved by each customer. Case records can be exported for an assessor or at the end of a contract. Australian customers’ data and AI processing stay in Australia.
ThreatDefence does not certify organisations. The assessor determines ASD Essentials ratings.
ThreatDefence holds ISO 27001 and PCI DSS certification and a SOC 2 report, providing examples of supplier assurance material relevant to GOV-11.
The free ASD Essentials Navigator maps every principle and action by chapter and priority phase, and turns your ratings into a board summary. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.
Open the ASD Essentials Navigator Start the 5-Minute Explainer Explore ASD Essentials Compliance
See how ThreatDefence automates security monitoring, compliance and cyber risk management in one platform.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
No. PSPF Release 2026 still requires Essential Eight Maturity Level Two for non-corporate Commonwealth entities and does not reference ASD Essentials. Section 14.3 considers ISO/IEC 27001 useful but does not accept it as an alternative authorisation to operate pathway.
An entity relying on ISO 27001 or similar standards must explain the deviation in its annual security report. ISO certification can add supporting assurance. It does not replace the framework named in the PSPF.
Yes. ASD’s assessment evidence guide for enterprise IT includes NIST CSF 2.0 references for every action. It also references the ISM, the Essential Eight, NIST SP 800-171r3 and AESCSF v2.
These mappings help organisations find relevant evidence they may already hold. They do not set equivalent control requirements or prove that an ASD Essentials action is effective. The assessor must evaluate the supporting evidence within the applicable domain.
Yes. A SOC 2 report can give useful assurance about a supplier’s controls, although it does not itself satisfy requirements in the PSPF, SOCI CIRMP rules or ASD’s assessment evidence guide.
ASD’s evidence guide does not list SOC 2, but a supplier’s report may contribute to the assurance evidence kept under GOV-11. The organisation should review the report’s scope, period and exceptions, and consider whether the findings are relevant to the service it consumes.
No. The Essential Eight contains ASD mitigation strategies assessed against maturity levels associated with increasing adversary tradecraft. ISO/IEC 27001 is an information security management system standard assessed by third-party certification bodies.
ASD operates no certification scheme for organisations under the Essential Eight or ASD Essentials. Australian requirements also treat the frameworks differently. The SOCI CIRMP rules accept either approach within their framework options, while the PSPF specifically names Essential Eight Maturity Level Two.
Yes, where the evidence is relevant to an ASD Essentials action and shows the required outcome. ASD’s evidence guide does not cross-reference ISO 27001, so each organisation has to build its own mapping.
ASD’s assessment process guide treats controls mapped from other frameworks as “a starting point”. Such a mapping may find that an ISO 27001 risk management program already holds records relevant to GOV-03’s approved risk management methodology and plan. A certificate alone cannot establish an ASD Essentials rating.
approved risk management methodology and plan
NIST CSF 2.0 and ASD Essentials share a similar outcomes-based structure. NIST CSF 2.0, published February 26, 2024, groups cyber security outcomes under Govern, Identify, Protect, Detect, Respond and Recover.
ASD Essentials enterprise IT uses GOV, IDE, PRO, DET and RES, while only the OT chapter adds a REC principle. Backup and restoration testing appear under protect principles. ASD maps restoration testing action IT.PRO-10.3 to NIST CSF subcategories RC.RP-03, RC.RP-04 and RC.RP-05.
The Essential Eight assesses implementation of ASD mitigation strategies against defined maturity levels. SOC 2 is an AICPA attestation examination in which a CPA reports on controls against the Trust Services Criteria.
The results serve different assurance purposes and cannot be converted into one another. The PSPF, DISP and NSW Cyber Security Policy name the Essential Eight. SOC 2 appears in none of the PSPF, SOCI CIRMP rules or ASD’s assessment evidence guide, although it may support supplier assurance.
Often, yes. Australian obligations, customer requirements and supplier assurance needs can call for different forms of evidence. Non-corporate Commonwealth entities work to Essential Eight Maturity Level Two under the PSPF, responsible entities under the SOCI CIRMP rules select an accepted framework, and DISP members need the full Essential Eight at Maturity Level Two.
Customers may separately request ISO 27001 certification or SOC 2 reports. An obligations register and shared evidence collection can support these requirements without duplicating records or treating their assessment results as equivalent.
AESCSF is AEMO’s Australian Energy Sector Cyber Security Framework and is one of the frameworks accepted under the SOCI CIRMP rules. Those rules identify the 2020-21 Framework Core at Security Profile 1 for baseline requirements and the 2023 Framework Core at Security Profile 2 for enhanced requirements.
ASD’s enterprise IT assessment evidence guide references AESCSF v2 under every action. Energy operators can use those references to trace existing AESCSF assessment records to ASD Essentials actions, while assessing effectiveness separately.
"Essential Eight vs ASD Essentials: What Changed and How to Transition"
ASD Essentials Assessment and Checklist
ASD Essentials for OT and Critical Infrastructure