AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Monitoring, evidence and a 24x7 SOC in one platform
Compliance monitoring, evidence and board reporting
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
How the framework is structured and what changes from the Essential Eight
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
The Essential Eight checks whether prescribed requirements have been implemented, while ASD Essentials rates whether each security action achieves its intended outcome in every domain where it applies.
The Essential Eight is still published, and the regulatory, policy and contractual obligations that name it still apply.
ASD published ASD Essentials and its transition guidance, Transitioning from the Essential Eight, on October 15, 2026. Most existing protective controls stay relevant. The transition work is to check what they cover, map them to the new actions and show that they are effective as well as implemented. A previous Essential Eight maturity rating does not automatically convert into an ASD Essentials rating.
ASD’s transition guide puts the difference between the Essential Eight and ASD Essentials in one sentence: Existing investment carries forward, but it is assessed differently. Controls are now grouped by domain, work is ordered by priority phase and each action is rated on its outcome.
Existing investment carries forward, but it is assessed differently.
An Essential Eight assessment checks whether the prescribed requirements for each mitigation strategy have been implemented. An ASD Essentials assessment looks at the security outcome, the assets covered and whether the action stays effective within each applicable domain.
The same control can be effective in one domain and only partially effective in another. A typical case is application hardening that is consistent across User devices but incomplete in Business systems. The hardening work still counts, but its coverage has to be confirmed separately for each domain.
Governance, supplier assurance, detection and response are also assessed in their own right, through dedicated principles that sit alongside the protective controls.
For the framework structure, priority phases and environment-specific chapters, see ASD Essentials explained.
ASD describes ASD Essentials as an evolution of the Essential Eight, although its FAQ also uses replacement terminology. Its stakeholder guidance says the framework builds on existing investments rather than replacing them.
rather than replacing them.
Every Essential Eight mitigation strategy maps to at least one ASD Essentials principle. Existing security controls, tooling, assessment records and approved improvements can all support the new framework, and ASD states that previous Essential Eight investment “remains valuable.”
The Essential Eight itself is still published. ASD maintains both frameworks on cyber.gov.au during the transition, the latest Essential Eight Maturity Model is still the November 2023 release and ASD has announced no retirement date.
Some organisations are bound by government policy, a contract or another obligation that specifies an Essential Eight maturity level. Publication of ASD Essentials does not remove those obligations or automatically change the required reporting method.
An organisation can begin adopting ASD Essentials while keeping its existing Essential Eight commitments. The transition builds on controls already in place, so it does not need a separate security program.
ASD Essentials does not use Essential Eight maturity levels as implementation targets or assessment ratings. Assessors rate the effectiveness of each applicable action within each domain.
The assessment uses these ratings:
The action has not been assessed, or sufficient evidence is unavailable to determine effectiveness.
The action does not achieve its intended outcome within the assessed scope.
The action provides some security benefit but does not fully achieve its intended outcome.
The action achieves its intended outcome for the applicable assets within the domain and is supported by sufficient evidence.
Action ratings contribute to principle and domain results. The detailed method is covered in ASD Essentials assessment and reporting.
Priority phases do a different job. They set the recommended order for implementing technical domains, based on where ASD assesses that effort delivers the greatest and most rapid reduction in risk. ASD states that priority phases are not maturity or assurance ratings.
are not maturity or assurance ratings.
An organisation previously assessed at Essential Eight Maturity Level Two, for example, may already have phishing-resistant multi-factor authentication (MFA), application control, privileged access restrictions and patching capabilities that contribute to early-phase actions. Those controls still need to be reviewed against the applicable ASD Essentials domain and action.
The same applies at Maturity Level One or Three. A higher previous maturity level may bring more reusable controls and evidence, but it does not produce a corresponding ASD Essentials effectiveness rating.
Previous assessment results are a documented starting position. A domain-specific gap analysis comes next.
The Essential Eight and its maturity model explains the original maturity assessment approach.
Every Essential Eight mitigation strategy contributes to ASD Essentials, but the mapping is rarely one-to-one. One strategy may support several principles, and a single ASD Essentials action may depend on controls that used to sit across several strategies.
The practical task is to identify what existing controls already achieve, which assets they cover and where the broader ASD Essentials outcome needs more work.
ASD’s transition guidance lists the principles each strategy maps to and says where current controls and evidence are still useful.
Application control contributes to the Trustworthy software and Secure configuration management principles.
Approved software lists, application control rulesets, execution restrictions, exception registers and policy enforcement records all remain relevant. ASD Essentials also considers whether permitted software is supported, verified and organisation-authorised.
ASD asks for administrative and management tools to be restricted to approved software sets and authorised locations. Exceptions need to be minimised, formally risk accepted, time-bound, monitored and regularly reviewed.
minimised, formally risk accepted, time-bound, monitored and regularly reviewed.
Check where the existing policies actually apply. A ruleset that protects user workstations may not give the same coverage for servers, management systems or other applicable domains.
Application control events, ruleset validation and review records can also support centralised logging and configuration drift evidence.
Application patching contributes to Vulnerability management, Asset identification and Legacy system management.
Vulnerability scans, patch deployment records, exception registers and remediation reports remain useful. ASD Essentials takes vulnerability treatment further than whether patches were installed.
Treatment decisions need to weigh exploitation, exposure, asset criticality, impact and compensating controls. Once a fix is applied, verify that it has addressed the identified weakness.
Asset identification covers identities, credentials and data as well as software and devices. Review vulnerability coverage against the complete set of applicable assets, which may be wider than the original Essential Eight scanning scope.
Risk-based prioritisation does not remove existing mandatory patching obligations. Applicable ISM, regulatory and other mandatory timeframes continue to apply.
Operating system patching contributes to Vulnerability management, Asset identification and Legacy system management.
Operating system inventories, patch schedules, deployment results, vulnerability treatment records and remediation exceptions provide the starting evidence.
Confirm that the relevant systems are included in assessment and treatment processes. A patch deployment report shows that an update was distributed. Validation is still needed to confirm that the vulnerability was addressed.
Unsupported and legacy systems need documented risk treatment until they are decommissioned or replaced. Compensating controls may reduce exposure, but they need review against the threats affecting those systems.
The transition is also the time to identify infrastructure outside the original Essential Eight implementation scope and check whether the same vulnerability management capabilities apply to it.
Multi-factor authentication contributes to the broader Identity, credential and access management principle.
MFA policies, phishing-resistant authentication, conditional access settings, authentication records and coverage reports remain important.
ASD Essentials also addresses default and unused accounts, approved storage for keys and secrets, exposed credentials and legacy authentication protocols, which need to be disabled or restricted.
Review MFA coverage domain by domain. A single organisation-wide result hides the detail, because authentication that protects ordinary users may not show equivalent protection for privileged accounts or important services.
Records of successful and unsuccessful authentication can also support centralised logging and the detection of identity or credential misuse. Note which authentication events are available, where they are collected and whether they support an investigation.
Restrictions on administrative privileges contribute to Identity, credential and access management and to Least privilege access. They also support Secure administration and Network segmentation and segregation.
Privileged account inventories, administrative workstations, restricted management environments, access approvals and privileged activity logs remain relevant.
The broader actions include time-bound privilege grants, explicit session establishment, least privilege for service accounts and administrative records identifying the user, timestamp and target.
Look at the pathways through which privileged activity is performed. A restricted account protects less if administrative access can still start from an ordinary user workstation or move through unexpected network paths.
The Privileged environments domain also needs a defined scope. Identify the systems, functions and assets involved in privileged administration. An enterprise-wide administrative account policy does not do that on its own.
Microsoft Office macro restrictions contribute to Trustworthy software and Secure configuration management.
Macro policies, trusted publisher arrangements, restrictions on macros originating from the internet and enforced security settings remain useful.
ASD notes that existing macro protections address only part of the broader requirement to control software execution.
address only part of the broader requirement to control software execution.
The broader Trustworthy software outcome takes in other relevant execution mechanisms. Check whether existing execution controls address those mechanisms and whether the permitted software is supported, verified and authorised.
Macro settings also belong in approved configuration baselines. The evidence to keep shows that the settings were deployed, are still enforced and are reviewed when the configuration changes.
Configuration drift detection picks up devices or systems that move away from those approved settings.
User application hardening contributes to Secure configuration management and Content filtering.
Hardening settings for browsers, office productivity suites, PDF software and other applications can support approved configuration baselines.
ASD Essentials extends configuration management beyond user applications. Work out which baselines apply to infrastructure, operating systems and applications within each relevant domain.
Evidence needs to show that baselines are approved, deployed, maintained and monitored for configuration drift. A baseline document alone does not show that the settings are still applied across the intended assets.
Content filtering also reaches beyond browser-based restrictions. Assess the controls that prevent outbound connections to known malicious or untrusted destinations across relevant applications and services.
Regular backups contribute to Regular and proven backups and Least privilege access.
Backup schedules, retention settings, backup access controls, restoration tests and disaster recovery exercises remain valuable evidence.
ASD Essentials asks for backup arrangements that protect important data, applications and settings using secure, resilient storage, including immutable, offline or logically isolated copies. Backup repositories need to be separated from primary systems and production environments to reduce the risk of unauthorised modification or deletion.
Check that backups cover the assets and functions needed within each applicable domain. Protection of business data may need to be examined alongside the recovery requirements of identity, boundary or privileged systems.
Restoration testing shows whether the defined recovery time and recovery point objectives can be met. A successful backup job shows that data was copied. A restoration test shows that the organisation can recover it.
The domain guides give further implementation detail, beginning with Boundary services and Identity services in priority phase 1.
ASD recommends a set order for an ASD Essentials transition plan: record the baseline, scope the domains, run a gap analysis, plan the implementation, deliver and measure, then move through the priority phases. The sequence works without discarding the existing Essential Eight program.
ASD’s Transitioning from the Essential Eight guidance is written for organisations that have implemented, or are implementing, the Essential Eight. Its intended readers are security architects, program leads, CISOs, assessors and the executives responsible for security investment and assurance.
The guidance focuses on enterprise IT. Its planning method may also help organisations working with cloud and OT, provided they use the applicable requirements for those environments.
The transition baseline records the current Essential Eight position, existing controls, available evidence, exceptions and planned improvements.
Start with the latest Essential Eight assessment and identify which systems were assessed, what controls were implemented and where gaps remain.
Collect the supporting records:
Record the latest ratings, assessed scope, findings and supporting evidence.
Identify deployed security capabilities and the assets they protect.
Capture approved deviations, compensating controls and outstanding risk treatments.
Record work already approved, underway or awaiting implementation.
Identify contractual, regulatory and policy requirements that still specify Essential Eight maturity levels, including their owners and reporting dates.
Separate controls already operating from proposed improvements. A project that is approved or funded is not evidence of an effective control until it has been implemented and validated.
Map existing and planned work to ASD Essentials before changing priorities.
ASD advises against starting work solely to meet a superseded Essential Eight target unless an existing obligation requires it or the activity addresses material cyber security risk.
Initial scoping covers Boundary services and Identity services, the priority phase 1 technical domains, together with Governance and culture and Visibility and response.
The capability domains continue across the later implementation phases and expand as implementation progresses. They are never finished once and set aside.
Identify the business functions, systems, services and assets associated with each initial domain. Reuse available asset inventories, architecture diagrams and business impact assessments, but validate them against the operating environment.
Where an asset supports more than one domain, include it in each relevant domain.
Assign responsibility for keeping domain scope current as systems change. An omitted asset can create a control coverage gap even where the underlying technology is correctly configured.
The enterprise IT chapter guide explains domain scoping and priority phases in more detail.
An Essential Eight gap analysis sets existing controls and evidence against the applicable ASD Essentials principles and actions, domain by domain. For each action, the question is whether the intended outcome is already achieved, partially supported or still needs work.
ASD recommends classifying each action as:
Existing controls appear to achieve the action’s intended outcome.
Existing controls contribute to the outcome but leave gaps in implementation, coverage or evidence.
Existing controls do not adequately address the action.
ASD separates these results from formal assessment outcomes: These are gap analysis findings, not formal assessment ratings.
These are gap analysis findings, not formal assessment ratings.
Use the assessment workbook’s Existing E8 Controls sheet and the strategy mapping to connect existing controls with relevant ASD Essentials actions.
Keep a gap register with enough information to trace every conclusion.
Record mappings even where existing controls appear to fully address an action. The mapping shows which controls support the conclusion and helps avoid duplicated work during the transition.
Keep partial coverage explicit. A control that is effective in one domain is not assumed effective in another until implementation and evidence there have been verified.
ASD’s implementation planning guide recommends keeping this information in a per-domain evidence register.
Implementation planning turns the identified gaps into prioritised work, taking account of ASD’s domain sequencing, existing obligations, organisational risk and available resources.
Separate the work that needs a new or modified control from the work that needs better evidence of an existing control.
Where a gap affects only one domain, improvements can be targeted to that environment. Where the same capability supports several domains, ASD suggests designing it once and extending implementation in priority phase order.
For example, existing phishing-resistant MFA or patching improvements may continue to support current Essential Eight requirements while also contributing to applicable ASD Essentials actions.
Actions with no direct Essential Eight equivalent also need attention. Governance, supplier assurance, security awareness, credential exposure, detection and incident response capabilities may need work beyond the original mitigation strategies.
The implementation plan names the relevant domain, action, required change, responsible owner and planned timeframe. Security improvements that were already approved stay visible within the same plan.
Delivery produces working controls and the evidence that their intended outcomes are achieved.
Prepare assessment evidence as controls are configured, validated and operated. Configuration records show implementation. Testing, monitoring and review records help show that the control stays effective.
Assessors consider coverage, consistency, currency and evidence quality for each applicable action and domain.
Where an action is assessed as partially effective, ASD expects the specific deficiencies to be documented with remediation actions and timeframes.
After addressing the priority phase 1 technical domains, organisations can progress through later priority phases while continuing to extend Governance and culture and Visibility and response capabilities.
Essential Eight evidence can be reused for ASD Essentials where it is still current, reliable and relevant to the action and domain being assessed.
ASD lists previous assessments, configuration extracts, ruleset exports, control test results, logging architecture documentation, exception registers, risk registers and remediation plans. Its guidance states that this evidence should be reused where it remains current and relevant.
should be reused where it remains current and relevant.
The table lists the records to keep, how to collect them and what they can show. The collection methods are common practice rather than ASD requirements. Action IDs refer to ASD’s Indicators of Good Practice.
a useful baseline for transition, not an automatic Essentials effectiveness rating.
Each kind of record answers a different question. A device management export shows that a policy was applied. A validation result shows whether the setting operates as intended. Monitoring and configuration drift records help show whether it stays effective over time.
ASD cautions that deployment alone does not demonstrate effectiveness. Validation records, control testing, monitoring, restoration exercises and detection engineering artefacts give stronger support for an effectiveness assessment.
deployment alone does not demonstrate effectiveness.
Reliable evidence that already exists does not need to be recreated simply because it was originally collected for another framework or assessment.
simply because it was originally collected for another framework or assessment.
Check whether each record still represents the current environment. An older assessment gives useful historical context but cannot stand in for current configuration and operational evidence where systems have changed.
Where evidence covers only part of a domain, record the limitation. Do not extend a conclusion from sampled or previously assessed assets to systems that have not been verified.
The result is a traceable evidence record connecting the applicable action, the implemented control, the asset coverage and the outcome shown.
An organisation part-way through an Essential Eight uplift can continue its approved security work and bring ASD Essentials into its planning.
ASD supports transitioning without discarding work already completed, with priority phases informing where future effort goes.
without discarding work already completed,
Review each existing initiative against the obligations it satisfies, the risks it addresses and the ASD Essentials actions it supports.
Keep improvements that current obligations require or that directly support applicable ASD Essentials actions. Existing work on phishing-resistant MFA, application control and patching may remain valuable.
Adjust projects originally scoped to an enterprise-wide maturity target where domain-specific coverage or phased implementation would make the work more effective.
Review new projects intended only to satisfy a superseded Essential Eight target when no existing obligation or material cyber security risk justifies that work.
Some projects need only a change in scope or evidence collection and can otherwise carry on. For example, an existing hardening program can keep its approved configuration baselines while extending coverage to previously excluded assets and adding configuration drift validation.
Maintain shared controls and evidence once where practical. Separate mappings can then show how the same implementation supports Essential Eight requirements and ASD Essentials actions.
Reporting during the transition should keep Essential Eight maturity results and ASD Essentials effectiveness results separate, even where both assessments draw on the same controls and evidence.
Publication of ASD Essentials does not automatically amend regulatory, policy or contractual obligations. The PSPF, DISP, SOCI rules and some state policies still reference the Essential Eight, as discussed in the ASD Essentials guide.
ASD advises organisations subject to existing Essential Eight reporting obligations to continue meeting them as directed by the relevant authority.
as directed by the relevant authority.
Contracts requiring specific maturity levels also remain applicable until amended. Publication alone does not make ASD Essentials mandatory for any organisation.
Before changing reporting arrangements, list the existing obligations with their owners, reporting dates and required maturity targets.
ASD Essentials results follow the separate assessment process guide. Actions and domains that have not been reviewed are recorded as not assessed, because an effectiveness conclusion needs evidence behind it.
Both reporting approaches can be presented together, provided the distinction stays clear.
Report the applicable maturity result, assessment scope, requirements reviewed and supporting evidence.
Report applicable action, principle and domain effectiveness results, with their assessment scope and evidence.
Connect records to both frameworks where appropriate without assuming the assessment conclusions are equivalent.
Identify gaps, remediation actions, responsible owners and planned timeframes.
A PSPF result of “fully implemented” and an ASD Essentials domain effectiveness rating measure different things. Combining them into a single compliance percentage can hide the difference between deployed controls and security outcomes.
The same applies to executive reporting. A maturity rating may still be needed for an existing obligation, while domain effectiveness results add detail about where security controls are working and where they need improvement.
ANAO reported in 2023 that Commonwealth entities had overstated PSPF maturity in self-reporting. The finding shows why conclusions under either framework need verifiable records behind them.
ThreatDefence runs a 24x7 SOC with its team based in Australia and a 3 min average response under guaranteed SLAs. Threat hunting and an incident response retainer are included in the standard service.
Response actions remain within the authority each customer approves, and case records can be exported for an assessor or at the end of a contract. Australian customers’ data and AI processing stay in Australia.
Continuous control monitoring and automated evidence collection support current records for both frameworks. Monitoring tracks configuration drift, helping demonstrate that controls remain effective beyond the assessment date.
Board-ready reports present each framework’s position separately, allowing organisations to maintain Essential Eight reporting while tracking ASD Essentials effectiveness. ThreatDefence does not certify organisations; the assessor determines ASD Essentials ratings.
Before a formal assessment, the free ASD Essentials Navigator lets organisations rate each action for their own environment and see how principles and domains roll up. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.
Open the ASD Essentials Navigator Start the 5-Minute Explainer Explore ASD Essentials Compliance
See how ThreatDefence automates security monitoring, compliance and cyber risk management in one platform.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
The Essential Eight assesses implementation of eight mitigation strategies against prescribed requirements and produces a maturity rating from Zero to Three, set by the weakest strategy. ASD Essentials rates whether individual actions achieve their security outcomes in every applicable domain, and its priority phases guide the order of implementation without defining maturity. ASD summarises the difference: Existing investment carries forward, but it is assessed differently. Existing controls can contribute to the new framework, but previous ratings do not automatically transfer.
ASD Essentials adds outcomes beyond the original eight mitigation strategies, including GOV-01 Executive cyber security accountability, GOV-11 Supplier cyber security assurance, GOV-08 Executive artificial intelligence accountability, cyber security resourcing, security risk management assurance and legacy system management. Dedicated detect and respond principles, DET-01 to DET-05 and RES-03 to RES-05, cover security operations more explicitly. Other additions include content filtering, awareness training, cyber supply chain security and credential exposure. Assess these outcomes alongside the existing protective controls.
Start with the latest Essential Eight assessment, implemented controls, exceptions, remediation plans and existing obligations. Scope Boundary services and Identity services, together with Governance and culture and Visibility and response. Map current controls and evidence to the applicable ASD Essentials actions, classify the gaps and plan remediation. Implement and validate controls in priority phase order while continuing existing Essential Eight reporting. The transition reuses current investment and does not need a separate implementation program.
ASD recommends classifying each action as already effectively addressed, partially addressed or not addressed. Each classification describes how far existing controls appear to cover an ASD Essentials action. ASD states that These are gap analysis findings, not formal assessment ratings. Record the control mapping, applicable domain, available evidence, coverage limitations and remaining work. Actions that appear fully covered stay in the evidence register too, so an assessor can verify the conclusion.
No. ASD supports continuing approved security improvements while organisations transition to ASD Essentials. Work required under existing obligations, including applicable PSPF or DISP requirements, should continue. Improvements that address current security risks or support early-phase ASD Essentials actions also remain relevant. Projects designed only to reach a superseded maturity target may need review if no continuing obligation or material cyber security risk justifies them. Existing work can often be reshaped and kept.
Yes. Existing assessment reports, configuration extracts, application control rulesets, vulnerability records, authentication logs, risk registers and restoration tests may support ASD Essentials where they remain current and relevant. The main difference is the evidence needed to show effectiveness. Deployment records show that a control exists, while validation, monitoring and testing help show that it achieves its outcome. Evidence also has to show appropriate coverage within each applicable domain.
Yes. Contracts requiring Essential Eight Maturity Level Two remain applicable until their requirements are amended. Publication of ASD Essentials does not automatically replace contractual, regulatory or policy obligations. ASD advises organisations to continue existing Essential Eight reporting as directed by the relevant authority. Record each contractual target, responsible owner, reporting date and supporting assessment in the transition baseline. An organisation can adopt ASD Essentials while continuing to show the maturity level its agreements require.
ASD Essentials is broader without being uniformly stricter. ASD states that the enterprise IT chapter in many cases, applies existing controls more broadly. Organisations may need to extend controls into additional domains, improve governance and detection capabilities or provide stronger evidence of effectiveness. Mature implementations may already address many actions. The amount of additional work depends on asset coverage, existing controls, organisational risk and the quality of available evidence.
in many cases, applies existing controls more broadly
No, in most cases. Existing security technologies may already satisfy or contribute to applicable ASD Essentials actions. Application control, MFA, vulnerability management, configuration hardening, logging and backup capabilities can all provide reusable controls and evidence. Wider deployment, additional monitoring, stronger validation or improved reporting may be needed, but ASD Essentials does not automatically call for replacing deployed products. A domain-specific gap analysis identifies capability gaps before new technology is considered.
No. Organisations without an existing Essential Eight implementation can begin directly with ASD Essentials for enterprise IT. ASD’s transition guide is designed for organisations with completed or ongoing Essential Eight work that they want to carry forward. New implementations can use the ASD Essentials implementation planning guide to scope relevant domains, identify applicable actions, assess existing capabilities and begin improvements in priority phase order. Existing regulatory or contractual obligations still need to be checked separately.
ASD Essentials Explained: Framework, Chapters and Enterprise IT
The Essential Eight and Its Maturity Model
ASD Essentials Assessment and Checklist