Get ready for ASD Essentials — without throwing away your Essential Eight work.
On 15 October 2026 the Australian Signals Directorate (ASD) published ASD Essentials, the framework that is gradually taking over from the Essential Eight. We assess where you stand against the four domains ASD asks you to start with, reuse your existing evidence where it's still current and relevant, and give you a plain-English plan your board and IT provider can act on.
- 10+ years across IT, cloud & cyber
- Enterprise & government experience
- Principal consultant-led delivery
- Independent & Australian-owned
- Melbourne-based · Australia-wide
You walk away with
- Scope of the two priority phase 1 domains (Boundary services and Identity services) and the two that apply across every phase (Governance and culture, and Visibility and response)
- A rating for each in-scope action (not assessed, not effective, partially effective or fully effective), with the evidence behind it
- Your existing Essential Eight evidence mapped across and reused wherever it is still current and relevant
- A roadmap sequenced by ASD's priority phases, with quick wins first
ASD Essentials replaces the Essential Eight's eight mitigation strategies with eight domains. Instead of maturity levels, each action is rated for effectiveness, and three priority phases set the order you work in. Each action is rated not assessed, not effective, partially effective or fully effective, based on coverage, consistency, currency and the quality of the evidence.
ASD is keeping both frameworks during the transition and hasn't set an end date for the Essential Eight. ASD's advice is that existing Essential Eight controls and evidence can be reused where they remain current and relevant, but maturity levels don't convert into Essentials ratings: each action is rated again on its evidence. ASD also advises that you shouldn't start new work just to reach a superseded Essential Eight target unless a regulator, contract or material risk still requires it.
We work with organisations of about 15 to 200 staff, most of them on Microsoft 365, alongside your existing IT provider. We're independent: we check your IT provider's work, we don't sell it. That matters because outsourcing your IT doesn't outsource accountability. Under ASD Essentials, leadership still owns the risk and needs evidence it's being managed.
ASD wrote the Essentials series mainly for government, critical infrastructure and large organisations, but its outcomes apply to smaller organisations too, especially when clients, insurers or tenders ask about it.
Not sure where you stand? Try the free ASD Essentials Quick Check at cyberbyte.au/asd-essentials-quick-check, or book a free 30-minute online ASD Essentials briefing for your board or leadership team. Prices for each step are below.
We don't hold, and don't claim, any ASD certification or endorsement: ASD hasn't created an assessor accreditation scheme for ASD Essentials.
Is this you?
You're probably here because…
If one of these is true, this may be the right starting engagement — with senior attention.
Your board, insurer or a client has asked what ASD Essentials means for you.
You've done Essential Eight work and want to know what still counts.
You have no security team and need to know where to start.
You want governance, AI accountability and supplier assurance covered, not just technical settings.
You bid for government or large-company supply-chain work. ASD has said guidance on assessing suppliers against ASD Essentials will follow, so expect questionnaires to start asking about it.
You want an independent view of what your IT provider has, and hasn't, put in place.
What you get
Executive-ready deliverables, in business language
Everything is prioritised and written to be acted on, with indicative effort, dependencies and cost ranges where supportable.
- Scope of the two priority phase 1 domains (Boundary services and Identity services) and the two that apply across every phase (Governance and culture, and Visibility and response)
- A rating for each in-scope action (not assessed, not effective, partially effective or fully effective), with the evidence behind it
- Your existing Essential Eight evidence mapped across and reused wherever it is still current and relevant
- A roadmap sequenced by ASD's priority phases, with quick wins first
- A one-page board summary in plain English
- Fix steps written for your IT provider or MSP
Productised package
ASD Essentials Readiness Snapshot
Start with the Readiness Snapshot (from $4,500): a quick evidence-based gap view, a board one-pager and a top-10 action list, credited in full if you book the full ASD Essentials Assessment (from $7,500 for about 15–50 staff, $12,000 for 51–200) within 60 days.
$4,500
from · ex GST
1 week
typical timeline
Prices
Choose your starting point
Fixed prices, ex GST, for the agreed scope. Not sure which fits? The free Quick Check suggests one, or we'll tell you on a 20-minute call.
ASD Essentials Readiness Snapshot
From $4,500
ex GST · 1 week
Quick evidence-based gap view of the four starting domains, a board one-pager and a top-10 action list. Credited in full against an Assessment booked within 60 days.
Request a scoping callASD Essentials Assessment
From $7,500
ex GST · about 15–50 staff · $12,000 for 51–200 · 2–3 weeks
Each in-scope action rated with evidence, an evidence register, a roadmap by priority phase, a board summary and fix steps for your IT provider.
Request a scoping callEssential Eight to ASD Essentials Transition Review
From $5,500
ex GST · 1–2 weeks
Already done Essential Eight work? We map it across, reuse what's still current and relevant, and tell you what to keep, stop and start. Credited in full within 90 days.
Request a scoping callASD Essentials Accountability Pack
From $6,500
ex GST · 2–3 weeks
Governance documents that help you evidence the Governance and culture actions: executive and AI accountability, supplier assurance, legacy systems and board reporting.
Request a scoping callFree first step: ASD Essentials Quick Check. Want it all in one? The ASD Essentials Foundations bundle (Assessment, Accountability Pack and a remediation sprint) is from $19,500 ex GST on the packages page.
How it works
A clear, documented method
Every engagement starts with written authorisation and a defined scope. Here's the path from start to deliverable.
- 01
Baseline
Confirm what you have today: systems, providers, existing Essential Eight work and any regulatory or contract obligations.
- 02
Scope phase 1
Agree the domains in scope (phase 1 plus the two cross-cutting domains), the evidence sources and the sample, following ASD's assessment process guide.
- 03
Assess and rate
Review evidence for each action and rate its effectiveness on coverage, consistency, currency and evidence quality.
- 04
Plan and report
A prioritised roadmap by priority phase, a board summary and practical fix steps for your IT provider.
Why CyberByte Security
Principal consultant-led delivery, backed by 10+ years across IT, cloud & cyber and enterprise & government experience.
FAQ
Questions buyers ask
Still unsure? A scoping call answers the rest in 20 minutes.
No. ASD is keeping both frameworks during the transition and hasn't published an end date for the Essential Eight. If a regulator, insurer or contract asks for Essential Eight maturity, keep meeting it. ASD Essentials is where new planning should head.
Not directly. ASD says maturity level ratings don't automatically convert into Essentials ratings, but existing evidence can be reused where it remains current and relevant. Our Essential Eight to ASD Essentials Transition Review (from $5,500 ex GST, credited in full against an ASD Essentials Assessment booked within 90 days) maps what you already have.
ASD says an independent assessor isn't required and organisations can assess themselves. It suggests periodic independent assessment, particularly where external assurance is required for reporting to regulators and governing bodies. Clients and insurers may also ask for it. ASD also plans an assessor training course. There is no ASD Essentials accreditation scheme, so be wary of anyone claiming to be certified for it.
The biggest additions sit in Governance and culture and in Visibility and response: executive accountability for cyber risk, accountability for AI use, supplier cyber assurance, legacy systems, asset visibility, logging and tested incident response. These sit alongside technical areas such as identity and internet-facing systems.
Your IT provider may run many of the controls, but ASD Essentials asks leadership to be accountable for whether they're effective. We're independent: we assess and evidence what's in place and write fix steps your provider can act on. We don't sell managed IT, so we have no reason to over- or under-state the gaps.
Yes. A free 30-minute online ASD Essentials briefing covers what's changed, what it means for an organisation your size, and what to ask your IT provider. Request it through the scoping-call form and mention ASD Essentials.
Yes. ASD says the outcomes matter just as much for smaller organisations; what differs is how they're achieved and how much sits with your service providers. For Microsoft 365 that means checking settings rather than trusting defaults, and knowing what your IT provider is responsible for.
Related services
Relevant industries
Not sure this is the right starting point?
Tell us what's prompting this and we'll recommend the smallest credible engagement.
Request a scoping callFree resource
Where do you actually stand?
Get a plain-English checklist to see where you stand and what to fix first. Free, by email, no obligation.
ASD Essentials Phase 1 Checklist for Microsoft 365
We'll email it straight away. Unsubscribe from marketing at any time.
Request a scoping call
Talk to a senior advisor.
A 20-minute scoping call: tell us what's prompting this, and we'll tell you the smallest credible engagement that solves it. Fixed price for the agreed scope, no obligation.