The next chapter in Australian cyber security
ASD Essentials. Outcomes you can explain.
The new series looks at the security outcome, the action needed and the systems it applies to. Understand the change before you replace tools or rewrite your policies.
Independent guidance by SuperStack IT · Sources checked 28 October 2026
Principle
What are we trying to protect?
Action
What needs to happen?
Domain
Where does it need to work?
Published 15 October 2026
What is ASD Essentials?
ASD Essentials is a series of security guidance for different technology environments. It expands the approach beyond the Essential Eight, with chapters for enterprise IT, cloud and operational technology. ASD continues to maintain Essential Eight during the transition. Official launch details.
For a business owner, the useful question is whether protection works across the systems that support important work. A familiar product name is the beginning of that discussion, not the conclusion.
Choose the environment before the checklist
Enterprise IT
Start here when reviewing an enterprise IT environment. Our mapping guide focuses on this chapter’s relationship to Essential Eight.
Enterprise IT guidance →Cloud
For environments delivered entirely through software and platform services, or SaaS and PaaS. Check provider responsibilities alongside your own access, data and settings.
Cloud guidance →Operational technology
For technology that operates physical processes. An industrial control system needs a different discussion from a practice’s document library.
Browse ASD’s chapters →Using cloud accounting software does not, by itself, decide the chapter for the rest of your environment.
Enterprise IT sequence
Priorities organise the work. They are not scores.
Phase 1
Boundary services + identity services
Start with the systems at the edge and the services that manage identity.
Phase 2
Critical processes and services + privileged environments
Then address essential operations and environments used for powerful access.
Phase 3
Business systems + user devices
Continue through the wider working environment.
Across every phase: governance and culture, plus visibility and response. These are ongoing capabilities, not tasks to leave until the end. See the enterprise IT sequence.
Record what the evidence can actually show
Essentials assesses actions within each applicable domain. Its ratings distinguish not assessed, not effective, partially effective and fully effective. Missing evidence is not the same as evidence that a control failed. Read the assessment guide.
For example, a successful test with one administrator account says something about that account. It does not establish the result for every identity service. Name the limitation, find the owner of the remaining systems and agree the next check.
Map your existing Essential Eight evidence →
For an example from an accounting practice, read Essential Eight to ASD Essentials: what changes?
Questions before you start
Is ASD Essentials only for large organisations?
ASD primarily addresses government, critical infrastructure and large organisations. Smaller businesses can use relevant guidance, but should choose a scope that fits their environment. A small accounting firm does not need to assume it has the same systems as a large enterprise.
Do phases 1, 2 and 3 replace maturity levels 1, 2 and 3?
No. Phases help sequence work. They are not equivalent maturity levels or assurance ratings. Actions are assessed for effectiveness within the applicable domain.
Does Microsoft 365 mean we should use the cloud chapter?
Not by itself. Review the whole environment, including infrastructure, devices and applications the organisation operates. The cloud chapter addresses environments delivered entirely through SaaS and PaaS. Confirm chapter selection against ASD's guidance.
Is there one changeover deadline for every business?
Do not assume a single deadline. ASD's launch guidance says organisations should keep meeting current regulatory obligations until regulators communicate changes. Contracts and procurement requirements also need to be checked separately.
From reading to a practical plan
Know what to keep. Know what to check.
Tell us which systems matter to your business and what evidence you already have. We can discuss scope, priorities and the help you need before agreeing on any work or fees.
- 01. Describe your environment
- 02. Discuss the evidence gaps
- 03. Agree the next step
Do not send passwords, client records or security reports through the enquiry form.
Sources and scope
- ASD Essentials launch announcement
- Essentials for enterprise IT
- Essentials for cloud
- Essentials assessment process guide
- ASD Essentials frequently asked questions
Checked 28 October 2026. These pages summarise guidance and offer planning examples. They are not an ASD publication, endorsement, certification or assessment of your organisation. Use the current official guidance for exact requirements and confirm any contractual or regulatory obligations separately.