ASD Essentials explained for small and medium organisations

Who this is for

This guide is for leaders of organisations with about 15 to 200 staff and no in-house security team: not-for-profits, professional services firms, schools, health providers. If your board, insurer or a client has started asking about ASD Essentials, this explains it in plain English, using ASD's own documents as the source. ASD wrote the series mainly for government, critical infrastructure and large organisations; smaller organisations can use it where it's relevant, especially when clients, insurers or tenders ask about it.

What changed from the Essential Eight

The eight domains and three priority phases

• Across all phases: Governance and culture; Visibility and response.
• Priority phase 1: Boundary services (internet-facing systems); Identity services (accounts and sign-in).
• Priority phase 2: Critical processes and services; Privileged environments.
• Priority phase 3: Business systems; User devices.

Priority phase 1 is Boundary services and Identity services, which ASD puts first because they are common pathways for adversaries seeking initial access. Governance and culture, and Visibility and response, apply across every phase, so in practice you start with all four. If you'd like the Microsoft 365 version, the ASD Essentials Phase 1 Checklist for Microsoft 365 is a free PDF, no email needed.

How effectiveness is rated

Each action is rated not assessed, not effective, partially effective or fully effective. Assessors look at coverage (is it applied to every relevant asset?), consistency (is it applied the same way across those assets?), currency (is the evidence recent enough to show how it works today?) and evidence quality (is the evidence reliable and relevant enough to show the outcome is achieved?). A setting that exists but has been left at an insecure default, or applied unevenly, isn't yet effective.

What happens to your Essential Eight work

• The Essential Eight still applies for now. ASD is keeping both frameworks during the transition and hasn't published an end date.
• Maturity level ratings don't automatically convert into Essentials ratings, but existing evidence can be reused where it remains current and relevant.
• ASD advises against starting new work just to reach a superseded Essential Eight target, unless a regulator or other obligation still requires it or it still addresses material risk.
• ASD doesn't recommend stopping programs that are already approved and under way.

What's new for smaller organisations

The biggest change is that leadership and suppliers are now part of the framework. Governance and culture covers executive accountability for cyber risk, accountability for how AI is used, cyber resourcing, supplier cyber assurance, legacy systems and security awareness training. Visibility and response covers knowing your assets, central logging, detection and incident procedures that have actually been tested.

ASD says these outcomes matter just as much for smaller organisations. What differs is how they're achieved and how much responsibility sits with service providers and vendors. For most organisations we work with, that means two things: checking Microsoft 365 settings rather than trusting defaults, and being clear about what your IT provider does and doesn't cover.

Which chapter applies to you: enterprise IT or cloud?

ASD publishes ASD Essentials in chapters. If your environment is delivered entirely through software-as-a-service and platform-as-a-service (such as Microsoft 365, Xero and a hosted CRM), with no servers or virtual machines of your own, the Essentials for cloud chapter is your likely starting point. If you also run your own servers, virtual machines (including in Azure or AWS), office network or on-premises systems, start with Essentials for enterprise IT and use the cloud chapter for your cloud services. Either way, a setting your provider has left at its default isn't the same as a control that's effective.

Not sure where you stand? The free ASD Essentials Quick Check takes about five minutes, needs no email and gives an indicative result for each of the four starting domains.

Isn't our IT provider already doing this?

Your IT provider may run many of the controls, but outsourcing your IT doesn't outsource accountability. ASD Essentials puts accountability with leadership, and leadership needs evidence that controls are effective. An independent assessment checks the provider's work without a stake in selling the fix.

Do you need an independent assessor?

No. ASD says an independent assessor isn't required, and its assessment process guide supports organisations assessing themselves. It suggests periodic independent assessment, particularly where external assurance is required for reporting to regulators and governing bodies. Clients and insurers may also ask for it. ASD also plans an assessor training course, but there is no ASD Essentials accreditation scheme, so a provider can't be "ASD Essentials certified".

Where to start: a practical first 90 days

• Baseline: list your systems, your providers, your Essential Eight work and any obligations that still name the Essential Eight.
• Scope: the priority phase 1 domains (Boundary services, Identity services) plus Governance and culture and Visibility and response, which apply across every phase.
• Gap analysis: rate each phase 1 action and note the evidence behind each rating.
• Plan: a short, sequenced roadmap your board approves and your IT provider can deliver.
• Deliver and measure, then reassess on a regular cadence before moving to phase 2.

If you'd like help, our ASD Essentials service starts with a Readiness Snapshot from $4,500 ex GST, credited in full against a full assessment booked within 60 days. Every published price is on the packages page.

Common questions