Tag: ASD Essentials

ASD Essentials for Boards: Ten Questions to Ask Before You Approve the Plan

Posted on by Greg Spencer

Latest advisory

ASD Essentials for Boards: Ten Questions to Ask Before You Approve the Plan

21 October 2026 2,225 words

ASD Essentials makes cyber security a formally defined executive and board responsibility, and the Australian Signals Directorate now treats executive commitment as something an assessor can rate. Boards will see posture reported by domain rather than as a single maturity level, with gaps and untested areas shown openly. ASD’s guidance for senior executives lists ten questions to ask before approving an implementation proposal, and they make a good agenda for the first board discussion.

For years, a board could ask “where are we on the Essential Eight?” and get a one-line answer. The ASD Essentials series ends that. Its reporting is more detailed, its sequencing says nothing about how secure the organisation is, and its Governance and culture domain puts the board’s own arrangements in scope.

This article is for directors, CEOs and executive committees. It covers what ASD now expects of them, how reporting changes, the ten questions ASD recommends and what to put on the agenda next.

Key takeaways

  • ASD’s first governance principle asks organisations to “formally define and establish executive and board-level accountabilities for cyber security”, including risk appetite, and to review them at a defined cadence.
  • Executive commitment “is now assessable content within the Governance and culture domain”.
  • Board reports should show posture by domain, with both a summary view and a detailed view of gaps. ASD warns the summary alone “may obscure outstanding risk”.
  • Reaching a priority phase is not a security rating. A phase describes scope, “not how secure the organisation is”.
  • The board or executive committee is also accountable for AI being “secure, controllable, human-supervised and used in an ethical and accountable manner”.
  • ASD’s ten questions focus on consequence, investment, reporting, validation, ongoing cost and accepted risk.
  • Boards may need to seek independent advice from an organisation like Beyond Technology to ensure they understand the information they should be provided and know how to respond.

Summary table: what ASD says senior executives should expect

ASD expectationWhat it means at board level
A clear understanding of the sequencing modelPriority phases set implementation order. They are not maturity ratings and do not indicate assurance
Formal executive and board-level accountabilityNamed accountabilities, including setting, monitoring and adjusting risk appetite
Alignment with operating contextThe plan reflects regulatory obligations, critical functions, risk appetite and resources
A current-state baselineApplicable actions assessed and gaps identified, including existing Essential Eight investment
Realistic implementation and sustainment expectations“There is no completion date for effective cyber security”
Sustainable resourcingFunding separates implementation, ongoing operation and assessment or assurance costs
Evidence of effectivenessClaims backed by evidence, which may include simulated exercises and independent testing
Clear reporting arrangementsAgreed content, frequency and audience, including material gaps, accepted risk and domains not assessed
Continued regulatory complianceExisting legal and regulatory obligations still met during the transition

What does ASD now expect of executives and boards?

The Essential Eight was a technical maturity model. Governance sat outside it. ASD Essentials brings it inside through the Governance and culture domain, which applies from the first priority phase onwards.

The first principle in that domain, Executive cyber security accountability, reads in full: “Formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence.”

ASD’s implementation planning guide spells out what follows from it. The board of directors or executive committee is accountable for cyber security. The same executive body monitors and assures the Cyber security resourcing principle, which requires that suitable and sufficient people and resources be identified, acquired and maintained. And risk management activities are subject to ongoing monitoring and assurance.

The sentence that matters most for directors is this one: “Executive commitment is now assessable content within the Governance and culture domain.” An assessor can now rate the board’s arrangements as not effective. Good intentions recorded in a strategy document are not enough. The evidence needs to show named accountability, defined reporting and reviews that happen on schedule.

How will cyber security reporting to the board change?

Domains instead of a maturity level

Posture is reported by domain, for example Boundary services, Identity services or Privileged environments, showing how many principles are fully effective, partially effective, not effective or not assessed. Each domain also gets a percentage score, which lets the board track progress between assessments.

Phases are not a security rating

A management report that says “we have completed priority phase 1” tells the board where the programme is up to. It does not say how well protected the organisation is. ASD’s guidance for executives says a statement like “we have reached priority phase 2” describes implementation scope, “not how secure the organisation is”. Posture comes from the effectiveness ratings.

Gaps are shown, not averaged away

ASD’s assessment guide requires both a summary view showing progress across domains and a detailed view identifying the principles and actions behind each rating, along with the remediation under way. It suggests a domain-level radar chart suits board and regulator reporting. It also warns that “the summary view alone may obscure outstanding risk”, which is why both views should reach the board.

Not assessed is reported, not hidden

Domains and actions that haven’t been assessed are labelled not assessed. ASD treats this as a neutral status and insists it stay distinct from not effective. Boards should expect to see it in early reports and should ask whether the reasons for leaving assets unassessed are justified.

The ten questions ASD says senior executives should ask

ASD lists these questions for executives considering an implementation proposal, and recommends revisiting them as the programme progresses. They are quoted below as ASD publishes them, with a note on what a useful answer looks like.

1. “Which of our key functions and assets sit in each domain, and which domains hold the assets whose compromise would be most consequential for the organisation?”

A useful answer names systems, not categories. It should identify where the organisation’s critical services sit and which domain carries the most consequential risk, so the board can judge whether the plan’s priorities match.

2. “What did our Essential Eight investment buy us under the ASD Essentials framework, and what is genuinely new work, such as the governance principles and the expanded detection and response capability?”

This separates reused investment from new spend. Expect a gap analysis that classifies each action as already addressed, partially addressed or not addressed, rather than a claim that previous maturity levels carry over.

3. “When will we see the first posture report, what will it cover and what will be reported as not assessed? Are the reasons justified for the assets deemed not assessed?”

The board should get a date and a scope. Anything excluded should come with a reason, and that reason should be revisited at each report.

4. “What specific risk reduction do priority phase 1 investments provide? Which observed attack paths does hardening those domains disrupt for us?”

Priority phase 1 covers Boundary services and Identity services, plus establishing governance and detection. A good answer links that work to the ways attackers commonly get in and escalate access, in this organisation’s environment.

5. “Where does the plan depart from ASD’s recommended sequencing, and what is the documented, risk-based justification?”

Departing from ASD’s order can be sensible, for example where a critical service faces a specific threat. It should be a documented decision, not a convenience.

6. “How will effectiveness be validated, and will independent assessment or adversary-simulation testing be used, and on what cycle?”

Effectiveness needs evidence. ASD’s planning guide lists validation methods ranging from control validation testing to penetration testing and red team exercises, and notes that the advanced methods “may not be required for every action”. The board should know which methods will be used, how often and by whom.

7. “What are the ongoing operational costs and resourcing needs once priority phase 3 is reached, and how will resourcing be reviewed against threat trends and incident outcomes?”

ASD says implementation is not a one-time activity, and the planning guide asks business cases to separate the programme end date from the ongoing sustainment run rate. The board should see both numbers.

8. “How are exceptions, compensating controls and accepted risks governed? Who owns them, when do they expire and when do we re-approve or close them?”

Every exception should have an owner, an expiry date and a review point. An exception register that only ever grows is a governance finding in its own right.

9. “What are the anticipated disruptions to operations and user experience during implementation, and how will they be managed?”

Changes such as tighter administrative access, application control and phishing-resistant authentication affect how people work. The board should know where disruption is expected and how it will be handled.

10. “How will we continue to meet our current regulatory reporting obligations during the transition?”

Obligations that refer to the Essential Eight still apply. ASD’s transition guidance says organisations should continue to meet them as directed by the relevant authority, so management may need to report in both frameworks for a while.

ASD adds that the questions are not exhaustive, and that considering them helps senior executives turn the framework “into a well-governed, strategic investment rather than a compliance exercise”.

What about AI?

ASD’s AI guidance places it within the board’s accountability too. Under the Executive artificial intelligence accountability principle, “the board of directors or executive committee is accountable for ensuring AI is secure, controllable, human-supervised and used in an ethical and accountable manner”.

For boards, that means knowing which AI tools the organisation uses, including AI features switched on inside existing software, who approved them, what data they can reach and who is accountable for them. ASD also notes that AI “has made existing attacks faster, cheaper and available to more people”, including synthetic voice and video aimed at staff who approve payments or reset access.

Why independent assurance matters to the board

The board’s job is to know whether the reports it receives are accurate. That is hard when the same party designs the controls, runs them and reports on them.

ASD does not require an independent assessor, and says organisations may engage one where proportionate and affordable. It is clear about the benefit: independent assessors “bring a fresh perspective and judgement, helping to identify gaps and weaknesses that may have become accepted through familiarity”. For a board, that fresh perspective is most valuable at three points: understanding their responsibility when planning starts, at the first baseline, and any time management reports a domain as fully effective.

What to put on the next board agenda

  1. Name the accountable executive and confirm which committee oversees cyber security, so the Executive cyber security accountability principle has an owner.
  2. Determine if independent advice to the board is warranted to ensure they understand responsibilities and how to interpret plans and reports.
  3. Agree the reporting format with management now: domain summary, detailed view of gaps, accepted risks and domains not assessed, and how often the board sees it.
  4. Ask for a current-state baseline, including what the Essential Eight investment already covers.
  5. Set the risk appetite the plan should be built against, and the cadence for reviewing it.
  6. Decide how effectiveness will be validated, and whether an independent assessment is warranted for the baseline.

More in the ASD Essentials series

How Beyond Technology can help

Beyond Technology is an independent technology advisory firm. We don’t sell technology, software, hosting or support, and we take no referral fees. We work with boards and executive teams on cyber security governance and assurance, and, building on our Essential Eight audit, we can provide an independent ASD Essentials baseline that a board can rely on. If you are working out what the transition will cost, our guide to budgeting for ASD Essentials covers the business case.

FAQs

Is the board responsible for cyber security under ASD Essentials?

ASD’s governance principles make the board of directors or executive committee accountable for cyber security, including setting, monitoring and adjusting risk appetite. Executive commitment is assessed as part of the Governance and culture domain.

What should a board cyber security report look like under ASD Essentials?

It should show posture by domain and priority phase, with counts of principles at each rating and a percentage per domain. ASD requires a summary view and a detailed view of the principles and actions behind each rating, including remediation in progress and domains not assessed.

Does reaching a priority phase mean we are secure?

Priority phases set the order of implementation, so reaching one shows where the programme is up to. ASD says a statement such as “we have reached priority phase 2” describes implementation scope, not how secure the organisation is. Security posture comes from the effectiveness ratings.

What questions should directors ask about ASD Essentials?

ASD’s guide for senior executives lists ten, covering which assets sit in each domain, what the Essential Eight investment already covers, when the first posture report arrives, how effectiveness will be validated, ongoing costs, and how exceptions and accepted risks are governed.

Do we need an independent assessment or advice?

ASD does not require independent assessment and leaves each organisation to judge what is proportionate and affordable. It also says independent assessors help identify gaps that may have become accepted through familiarity. Independent advice can be critical if your board does not have the skills and experience to provide critical review and judgement.

References

  • Australian Signals Directorate, ASD Essentials overview: The Essentials for senior executives (2026)
  • Australian Signals Directorate, ASD Essentials for enterprise IT (2026)
  • Australian Signals Directorate, Implementation planning guide (2026)
  • Australian Signals Directorate, Assessment process guide (2026)
  • Australian Signals Directorate, AI considerations within the Essentials (2026)
  • Australian Signals Directorate, Transitioning from the Essential Eight (2026)

ASD Essentials Explained: What Changes After the Essential Eight

Posted on by Greg Spencer

Latest advisory

ASD Essentials Explained: What Changes After the Essential Eight

21 October 2026 2,524 words

ASD Essentials is the Australian Signals Directorate’s successor to the Essential Eight. It replaces eight mitigation strategies and their maturity levels with principles, actions and eight domains, worked through in priority phases and rated by how effective each action is. Existing Essential Eight work carries forward, but it gets assessed again, domain by domain, and executive accountability for cyber security becomes part of the assessment.

In June we wrote about ASD’s plans to retire the Essential Eight, when the first chapter was still out for consultation. ASD has now released the series: overview guidance for executives, chapters for enterprise IT, cloud and operational technology, and supporting guides for transition, implementation planning and assessment.

This article explains what the series is, how it is structured, what is new compared with the Essential Eight and where to start. It is written for CEOs, CFOs, boards and IT leaders in mid-sized Australian organisations who have been using the Essential Eight as their yardstick and now need to know what replaces it.

Key takeaways

  • ASD describes the Essentials series as “an evolution of the Essential Eight”. It builds on the work organisations have already done rather than starting again.
  • Maturity levels are gone. Priority phases set the order of work, and ASD is explicit that they are not maturity or assurance ratings.
  • Every action is rated not assessed, not effective, partially effective or fully effective, separately in each domain where it applies.
  • A Governance and culture domain makes executive and board accountability, resourcing and supplier assurance part of the assessment. None of that was assessed under the Essential Eight maturity model.
  • Evidence has to show that a control works over time. ASD’s assessment guide puts it in four words: “Deployment is not effectiveness.”
  • The documents set no transition deadline, and existing regulatory obligations that refer to the Essential Eight still apply.

Summary table: the Essential Eight and ASD Essentials side by side

Essential EightASD Essentials (enterprise IT)
Building blocksEight mitigation strategiesPrinciples supported by actions
Where controls applyAcross the whole environmentEight domains of assets and functions that share similar risks
Progress measureMaturity levels One to ThreePriority phases that sequence the work
How ratings workMet or not met against maturity requirementsFour-tier effectiveness rating per action, per domain
ApproachPrescriptive and solution specificOutcome-driven and technology agnostic
GovernanceNot assessedAssessed through the Governance and culture domain
EvidenceImplementation against requirementsCoverage, consistency, currency and evidence quality

What is the ASD Essentials series?

The series is a set of publications from ASD’s Australian Cyber Security Centre, arranged in three layers.

The overview publications explain the framework and the case for change. They include a guide written specifically for senior executives and a short paper on how artificial intelligence fits across the series.

The chapters apply the framework to a particular technology environment. There are three so far:

  • Enterprise IT, for organisations “whose scale, complexity, regulatory exposure or reliance on technology requires a structured and deliberate approach” to cyber security. This is the direct successor to the Essential Eight for most organisations.
  • Cloud, for organisations whose technology environment “is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS)”. Each action is marked as a customer, supplied or provider responsibility, because the provider does part of the work.
  • Operational technology, for organisations running industrial and control systems. It uses a different phase order and treats every device inside the OT system as privileged.

ASD’s reading guide notes that “further chapters may be added as the series covers additional environments”.

Supplemental publications support the work: a guide to transitioning from the Essential Eight, an implementation planning guide, an assessment process guide, asset scoping guides and an assessment evidence guide for enterprise IT. ASD also provides an assessment workbook for enterprise IT.

How do principles, actions and domains work?

Every chapter uses the same three-part model, and ASD frames each part as a question. A principle asks what outcome the organisation is trying to achieve. An action sets out what needs to be done to achieve it. A domain says where it applies.

The Essential Eight told organisations which controls to implement. The Essentials series describes outcomes. In ASD’s words, actions “describe what must be achieved without prescribing a particular vendor, product or architecture”. Organisations can choose controls that suit their environment, as long as the evidence shows the outcome is being achieved.

That flexibility cuts both ways. An organisation can no longer point to a product and say the requirement is met. It has to show that the action works across every asset in scope.

What are the eight domains?

Domains group business functions and assets that share similar risks. Two are capability domains that run across everything; six are technical domains.

DomainWhat it coversWhy it matters
Governance and culturePolicies, risk management, roles and security cultureUnclear ownership leads to inconsistent decisions and controls that degrade over time
Visibility and responseDetecting, analysing and responding to cyber security eventsLimited visibility delays detection and containment of intrusions
Boundary servicesInternet-facing services and edge devicesThese are routinely scanned and exploited for initial access
Identity servicesDirectories, authentication, authorisation and credential storesCompromise can give an adversary persistent or privileged access
Critical processes and servicesThe core services the organisation exists to deliverLoss can stop critical services and may affect health and safety
Privileged environmentsAdministrative and management systemsCompromise gives extensive control over systems and security controls
Business systemsSupporting enterprise functionsCompromise disrupts operations and opens paths to more sensitive systems
User devicesDesktops and laptops issued to staffCommon entry points because of their number and exposure

Assets that support more than one domain are considered in each of them. A directory server, for example, may sit in Identity services and in Privileged environments.

What are priority phases, and why are they not maturity levels?

Priority phases set the order in which ASD recommends the domains are addressed, based on where effort reduces risk fastest. For enterprise IT:

  • Phase 1 covers Boundary services and Identity services, and establishes Governance and culture and Visibility and response.
  • Phase 2 moves to Critical processes and services, and Privileged environments.
  • Phase 3 completes the set with Business systems and User devices.

The two capability domains continue across all three phases and grow as more technical domains come into scope.

This is the change most likely to be misread in boardrooms. Under the Essential Eight, “we are at Maturity Level Two” was a statement about how well protected the organisation was. A priority phase says nothing of the kind. ASD’s guidance for senior executives is direct: a statement such as “we have reached priority phase 2” describes implementation scope, “not how secure the organisation is”. Security posture is expressed through the effectiveness ratings.

Organisations also no longer pick a target level and stop there. ASD’s implementation planning guide describes the phases as “interim stages of progression, not levels at which an organisation should remain indefinitely”, and says ASD does “not recommend skipping domains or deferring priority phases indefinitely”.

How is security posture rated?

Each action is assessed against the assets in each domain where it applies, and given one of four ratings:

RatingWhat it means
Not assessedNot yet assessed, or not enough evidence to decide. ASD calls this “a neutral rating”, and it must stay distinct from not effective
Not effectiveThe action is absent, or present in a form that delivers no meaningful security benefit
Partially effectiveThe action works in part, but gaps in coverage, consistency or enforcement limit it
Fully effectiveThe action demonstrably achieves its outcome across the domain and is backed by sufficient evidence

The partially effective rating is not a reward for effort. ASD says “partial activity alone, such as work commencing or a plan existing, is not partial effectiveness”.

Action ratings roll up to principles using a weakest link rule: a principle takes the lowest rating of its actions in that domain. Each domain then gets a percentage, with fully effective principles scored 1, partially effective 0.5 and not effective 0. ASD’s worked example has five principles fully effective, four partially effective and one not effective in a domain, which gives 70%.

Reports must include a summary view showing progress across domains and a detailed view showing the principles and actions behind each rating. ASD warns that “the summary view alone may obscure outstanding risk”.

What is new compared with the Essential Eight?

Every Essential Eight mitigation strategy maps to at least one principle in the new framework, so nothing already built is wasted. But the enterprise IT chapter also covers ground the Essential Eight never assessed.

Governance and culture

ASD lists principles covering executive cyber security accountability, cyber security resourcing, security risk management assurance, supplier cyber security assurance, artificial intelligence accountability and legacy system management. Many organisations already handle some of this through their risk or audit processes. Until now, none of it formed part of an Essential Eight assessment.

New protect principles

Content filtering, cyber security awareness training and cyber supply chain security have no direct Essential Eight equivalent.

Broader identity requirements

Multi-factor authentication becomes one part of a wider identity, credential and access management principle. It now sits alongside removing default and unused accounts, storing secrets in approved repositories, scanning for exposed credentials, retiring legacy authentication protocols and keeping credentials unique per system.

Asset identification

Organisations need to “continuously identify and document infrastructure, operating systems, applications, identities, credentials and data as distinct assets”. Most existing inventories cover a subset of that list.

Visibility and response as its own domain

Logging, detection and incident response were scattered across individual Essential Eight strategies. They now form a domain with dedicated principles, including detection efficacy and post-incident insights.

Evidence of effectiveness

Configuration records and policies still count, but they show a control was deployed. Assessors now look for proof that it keeps working, such as validation results, monitoring records, restoration tests and exercises.

Where does artificial intelligence fit?

AI is not a separate chapter. ASD says the framework “applies regardless of whether an organisation consumes, develops or deploys artificial intelligence (AI)”, and a supporting paper explains how AI considerations run through each chapter.

Three points stand out for executives. First, ASD’s view is that AI “has made existing attacks faster, cheaper and available to more people”, including synthetic voice and video aimed at staff who approve payments or reset access. Second, AI tools can hold identities and permissions of their own, and ASD says to “identify and govern these in the same way as other identities and access pathways”. Third, the board or executive committee is accountable for ensuring “AI is secure, controllable, human-supervised and used in an ethical and accountable manner”.

Is ASD Essentials mandatory, and is there a deadline?

The published documents set no transition deadline. ASD’s implementation planning guide says “the framework does not prescribe implementation timeframes”.

Existing obligations stay in place. Maturity Level Two of the Essential Eight was the required baseline for Commonwealth entities and many critical infrastructure operators. ASD’s transition guide says organisations whose reporting still requires Essential Eight terminology should “continue to meet those obligations as directed by the relevant authority”.

For most private organisations the series is guidance rather than a mandate. Where a customer contract, insurer questionnaire or tender asks for Essential Eight evidence today, check what that party will accept during the transition rather than assume either framework is enough.

Where should an organisation start?

Organisations that have never implemented the Essential Eight can go straight to the enterprise IT chapter. Those with an Essential Eight programme should follow ASD’s transition guidance, which we cover step by step in a companion article. In short:

  1. Record the current Essential Eight position: latest assessment results, controls, exception and risk registers, and planned uplift work.
  2. Scope the priority phase 1 domains and identify the assets in each.
  3. Run a gap analysis that classifies each action as already effectively addressed, partially addressed or not addressed.
  4. Plan the implementation around the gaps.
  5. Deliver and measure, collecting evidence as controls are built rather than afterwards.
  6. Move through the remaining priority phases, with a set reassessment cadence.

ASD’s guidance for senior executives makes the point that matters most at the start: “The introduction of the Essential series does not mean organisations are expected to start again.”

Read the rest of the series

This article is the overview. Three companion pieces go deeper:

How Beyond Technology can help

Beyond Technology is an independent technology advisory firm. We don’t sell technology, software, hosting or support, and we take no referral fees, so our gap analysis is not a prelude to a quote for the tools that close the gaps.

Building on our Essential Eight audit, we can map your existing controls and evidence to the ASD Essentials principles, domain by domain, and give you a current-state baseline and a phased plan you can take to the board. If you need a wider view of your security position first, start with our cyber security audit.

FAQs

What is ASD Essentials?

ASD Essentials is a cyber security framework from the Australian Signals Directorate that succeeds the Essential Eight. It organises security outcomes into principles and actions, applies them across eight domains of assets that share similar risks, and rates each action as not assessed, not effective, partially effective or fully effective.

Does ASD Essentials replace the Essential Eight?

ASD describes the series as an evolution of the Essential Eight that builds on it rather than discarding it. Every Essential Eight mitigation strategy maps to at least one principle in the new framework, so existing controls and evidence can be reused where they remain current and relevant.

Does our Maturity Level Two rating carry over?

Not automatically. ASD says previous Essential Eight maturity level ratings “do not automatically translate” into effectiveness ratings, because the two approaches assess different things. A Maturity Level Two result is a useful starting point for a gap analysis, and many of its controls will contribute to the early priority phases.

What are the eight domains in ASD Essentials for enterprise IT?

Governance and culture, Visibility and response, Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems and User devices. The first two are capability domains that apply across all priority phases.

Do we need an independent assessor or independent advice?

ASD does not require one, and leaves each organisation to judge what is proportionate and affordable. Its implementation planning guide notes that independent assessors “bring a fresh perspective and judgement, helping to identify gaps and weaknesses that may have become accepted through familiarity”. Independent advice however can be critical to help planning an effective implementation strategy that focuses on your best interests rather than a vendors sales goals.

References

  • Australian Signals Directorate, ASD Essentials overview: The Essentials for senior executives (2026)
  • Australian Signals Directorate, ASD Essentials series reading guide (2026)
  • Australian Signals Directorate, ASD Essentials for enterprise IT (2026)
  • Australian Signals Directorate, ASD Essentials for cloud (2026)
  • Australian Signals Directorate, ASD Essentials for OT (2026)
  • Australian Signals Directorate, AI considerations within the Essentials (2026)
  • Australian Signals Directorate, Transitioning from the Essential Eight (2026)
  • Australian Signals Directorate, Implementation planning guide (2026)
  • Australian Signals Directorate, Assessment process guide (2026)
  • Australian Cyber Security Centre, Essential Eight

Moving From the Essential Eight to ASD Essentials: Why Your Maturity Level Does Not Carry Over

Posted on by Greg Spencer

Latest advisory

Moving From the Essential Eight to ASD Essentials: Why Your Maturity Level Does Not Carry Over

21 October 2026 2,296 words

An Essential Eight maturity level does not convert into an ASD Essentials rating. ASD says previous ratings “do not automatically translate into effectiveness ratings”, because the new framework assesses something different: whether each action achieves its outcome, in each domain, backed by current evidence. Most existing controls and evidence carry forward. The transition is a gap analysis that shows what already counts and what still needs work.

Many Australian organisations spent years reaching Maturity Level Two, often because a regulator, customer or insurer asked for it. ASD’s new Essentials series changes how that work is measured, and its transition guide is clear that the investment is not lost. It is assessed differently.

This article walks through ASD’s transition guidance: why ratings don’t convert, what carries forward at each maturity level, where controls most often need strengthening, how to reuse evidence and the pitfalls ASD warns about. It is written for IT leaders, security leads and the executives who funded the Essential Eight programme and want to know what it bought them.

Key takeaways

  • ASD’s transition principle: “Existing investment carries forward, but it is assessed differently.”
  • Ratings don’t convert for three reasons: principles describe broader outcomes, actions are assessed in each domain, and evidence must show sustained effectiveness.
  • Organisations at Maturity Level Two can expect many controls to contribute to the early priority phases, but common gaps include governance, detection and response, and evidence of ongoing operation.
  • Maturity Level Three “does not automatically produce fully effective ratings” either. A gap analysis is still needed.
  • If you are part-way through an Essential Eight programme, map the remaining work to the new framework before spending more on it.
  • Existing evidence can be reused where it is current, reliable and covers the domain. Deployment records alone will not support a fully effective rating.

Summary table: where each Essential Eight strategy lands

Essential Eight strategyMaps to these ASD Essentials principlesWhere it most often needs strengthening
Application controlTrustworthy software; Secure configuration managementAdministrative tooling, time-bound exceptions, coverage in each domain
Patch applications and operating systemsVulnerability management; Asset identification; Legacy system managementAsset coverage, risk-based treatment timeframes, legacy systems
Multi-factor authenticationIdentity, credential and access managementDefault accounts, secrets storage, exposed credentials, legacy authentication
Restrict administrative privilegesIdentity, credential and access management; Least privilege access; Secure administration; Network segmentation and segregationTime-bound privilege, recording admin actions, non-person accounts, lateral movement
Restrict Microsoft Office macrosTrustworthy software; Secure configuration managementOther execution mechanisms, configuration baselines and drift
User application hardeningSecure configuration management; Content filteringApproved baselines beyond endpoints, outbound connections
Regular backupsRegular and proven backups; Least privilege accessImmutable or isolated storage, repository separation, recovery objectives
Event logging and response (across strategies)Eight Visibility and response principlesCentral logging and correlation, detection efficacy, tested response

Why doesn’t an Essential Eight maturity level convert?

ASD’s transition guide gives three reasons a control that satisfied an Essential Eight requirement may need more work.

Principle breadth

Many Essential Eight strategies map to principles with a wider outcome. ASD’s example is macros: restricting Microsoft Office macros contributes to the broader Trustworthy software principle, which covers all software execution. Macro controls remain valuable, but they address only part of what the principle asks.

Domain scope

The Essential Eight applied requirements across the whole IT environment. ASD Essentials assesses each action within each domain it is mapped to. ASD notes that an enterprise-wide control can be “fully effective in one domain but only partially effective in another” if its coverage is not proportionate to that domain’s risk. Multi-factor authentication that is strong for remote access but weaker for privileged administration is a typical case.

Evidence

Configuration records, policies and deployment records show how a control was implemented. The new assessment asks whether it achieves its intended outcome, and assessors consider coverage, consistency, currency and evidence quality. Where existing evidence proves deployment but not sustained effectiveness, organisations may need operational evidence such as validation results, testing, exercise results or monitoring records.

What carries forward at each maturity level?

Organisations at Maturity Level Two

ASD notes that Maturity Level Two “was the required baseline for Commonwealth entities and many Australian critical infrastructure operators”. Organisations that reached it can expect many controls to contribute to actions in the early priority phases, including phishing-resistant MFA, patching of internet-facing services, privileged access controls, application control and centralised logging.

ASD lists the common areas likely to need more work:

  • extending controls to assets or domains not previously covered
  • addressing the Governance and culture principles
  • expanding Visibility and response capabilities
  • producing evidence that demonstrates sustained effectiveness rather than deployment alone.

Organisations at Maturity Level Three

Organisations that achieved and sustained Maturity Level Three can likely reuse a broader range of controls and evidence, such as vulnerability management, application control, privileged access, event logging and analysis, configuration hardening and restoration testing. But ASD is explicit that Maturity Level Three “does not automatically produce fully effective ratings”. The enterprise IT chapter has actions with no Essential Eight equivalent, including credential exposure, supply chain security and the two capability domains.

Organisations at Maturity Level One

The same approach applies, but ASD says these organisations “should expect a greater proportion of actions to require additional implementation”.

Organisations part-way through an Essential Eight programme

This is where the guidance has the most immediate financial consequence. ASD’s recommended first step includes this instruction: “Do not initiate work solely to achieve a superseded Essential Eight target unless it remains required by a regulator or other obligation or continues to address material cyber security risk.”

That is not a reason to stop. Completed work, implementation evidence and assessment results should be mapped to the new actions, and planned work that remains relevant can be folded into the new plan. The point is to check before committing the next tranche of budget, which we cover in more detail in our guide to budgeting for ASD Essentials.

Where do existing controls most often need strengthening?

The transition guide maps every Essential Eight strategy in detail. These are the gaps we expect to come up most often in mid-sized organisations.

Application control

Administrative and management tools must be restricted to approved software sets running from authorised locations. Exceptions need to be “minimised, formally risk accepted, time-bound, monitored and regularly reviewed”.

Patching

Asset identification now covers “infrastructure, operating systems, applications, identities, credentials and data as distinct assets”, so most inventories need expanding. Treatment timeframes should reflect exploitation, exposure, criticality and impact, and legacy systems that cannot be replaced need their risk managed until decommissioning.

Multi-factor authentication

MFA stays central, but the identity principle also expects organisations to remove default and unused accounts, store keys and secrets in approved repositories, scan code, file shares and collaboration platforms for exposed credentials, retire legacy authentication protocols on a time-bound plan, and keep credentials unique per system.

Administrative privileges

The enterprise IT chapter requires “explicit session establishment controls, including time-bound privilege grants”. Organisations with standing administrator access should check whether their controls achieve this. Administrative actions that change systems must be recorded with user, timestamp and target, and least privilege applies to service and other non-person accounts too.

Macros and application hardening

Settings should sit inside approved configuration baselines that are deployed, maintained and reviewed, with processes for detecting configuration drift.

Backups

Storage should be protected through encryption and “immutable, offline, logically isolated or equivalent controls”, repositories separated from production and user environments, and restoration testing should prove recovery time and recovery point objectives can be met.

Logging and response

Visibility and response now applies across every phase. It expects central logging that supports correlation across systems, detection of unauthorised change and anomalous authentication, regular review of detection coverage, documented and tested incident response procedures, and post-incident reviews.

How do you reuse existing assessment evidence?

Organisations assessed against the Essential Eight often hold a lot of evidence already: assessment reports, configuration extracts, ruleset exports, control test results, logging architecture documents, exception and risk registers, and remediation plans.

ASD’s position is practical. “If existing evidence is current and reliable and demonstrates appropriate coverage and consistency, organisations do not need to generate new evidence simply because it was originally collected for another framework or assessment.”

The limit is that “deployment alone does not demonstrate effectiveness”. Evidence showing how a control operates over time gives stronger support for a rating. ASD lists validation results, monitoring records, configuration drift reports, review records, restoration tests, exercises and detection engineering artefacts.

Existing exceptions need the same scrutiny. ASD warns that “an expired exception, degraded compensating control or risk acceptance based on an outdated threat environment should not be relied on without review”.

ASD’s recommended transition pathway

ASD’s transition guide sets out six steps. They follow its implementation planning guide, but start from the Essential Eight work already done.

  1. Establish the transition baseline. Record the current Essential Eight position: the latest assessment results, existing controls, exception and risk registers, remediation plans and committed uplift work.
  2. Scope the priority phase 1 domains by identifying the assets and functions in Governance and culture, Visibility and response, Boundary services and Identity services, reusing existing inventories, architecture documents and business impact assessments.
  3. Run a gap analysis that classifies each action as already effectively addressed, partially addressed or not addressed. ASD stresses these “are gap analysis findings, not formal assessment ratings”.
  4. Plan the implementation. Gaps specific to one domain can be handled domain by domain. Where the same requirement applies across several domains, design the capability once and roll it out in phase order.
  5. Deliver and measure, preparing for assessment as controls are delivered and checking coverage, consistency, currency and evidence quality for each action and domain.
  6. Progress through the priority phases: move to priority phase 2 (Critical processes and services, Privileged environments) and then priority phase 3 (Business systems, User devices), with a set reassessment cadence.

How should you report during the transition?

Domains and actions not yet assessed are reported as not assessed. ASD is firm that this rating “should not be used to imply that an action is ineffective”. It simply records that the work hasn’t been assessed yet, or that there isn’t enough evidence to decide.

Organisations with regulatory or contractual reporting that still uses Essential Eight terminology should keep meeting those obligations as the relevant authority directs. In practice, that can mean reporting against both frameworks for a period.

Seven transition pitfalls ASD warns about

  1. Treating priority phases as maturity levels. Phases sequence work; they are not compliance or assurance ratings.
  2. Claiming equivalence instead of assessing. A control that met an Essential Eight requirement is evidence, not an automatic rating.
  3. Assessing the enterprise instead of the domain. The same control can rate differently in different domains.
  4. Ignoring the capability domains. Governance and culture and Visibility and response “should not be deferred until the technical domains are complete”.
  5. Attempting to transition every domain at once. Spreading effort across the whole environment dilutes progress.
  6. Reusing stale evidence. ASD says evidence stays useful only where it “continues to represent the current environment and operation of the control”.
  7. Overlooking new requirements. Some actions have no Essential Eight equivalent and need their own planning and resourcing.

More in the ASD Essentials series

Where independent help fits

The gap analysis is the step that decides how much the transition costs. It is also the step most exposed to conflict of interest. A provider that runs your environment has a stake in the result, and a reseller has products to place against every gap it finds.

Beyond Technology doesn’t sell technology, software, hosting or support. Building on our Essential Eight audit, we can map your existing controls and evidence to the ASD Essentials actions, classify each gap using ASD’s own terms, and give you a phased plan with the evidence register already started. For a wider starting point, see our cyber security audit.

FAQs

Does our Essential Eight Maturity Level Two still count?

It counts as a starting point, not as a rating. ASD says Maturity Level Two organisations can expect many existing controls to contribute to the early priority phases, but should not assume that means any action will be fully effective in every domain.

Do we have to start again?

ASD’s senior executive guidance says the introduction of the series “does not mean organisations are expected to start again”. Every Essential Eight strategy maps to at least one ASD Essentials principle, and current evidence can be reused.

Should we stop our Essential Eight uplift programme?

Not automatically. ASD advises against starting work solely to reach a superseded Essential Eight target unless a regulator or other obligation still requires it, or it addresses material cyber security risk. Map planned work to the new framework, keep what remains relevant and redirect the rest.

What is the first step in transitioning to ASD Essentials?

Establish a transition baseline: your most recent Essential Eight assessment results, existing controls, exception and risk registers, remediation plans and committed uplift work. Then scope the priority phase 1 domains and run a gap analysis against the enterprise IT chapter.

Can we reuse our Essential Eight assessment evidence?

Yes, where it is current, reliable and covers the domain. ASD says organisations do not need to regenerate evidence simply because it was collected for another framework. Evidence that only shows deployment may need to be supplemented with evidence that the control keeps working.

References

  • Australian Signals Directorate, Transitioning from the Essential Eight (2026)
  • Australian Signals Directorate, ASD Essentials for enterprise IT (2026)
  • Australian Signals Directorate, Implementation planning guide (2026)
  • Australian Signals Directorate, Assessment process guide (2026)
  • Australian Signals Directorate, ASD Essentials overview: The Essentials for senior executives (2026)
  • Australian Cyber Security Centre, Essential Eight

Budgeting for ASD Essentials: What to Fund, What to Pause and What Carries Forward

Posted on by Greg Spencer

Latest advisory

Budgeting for ASD Essentials: What to Fund, What to Pause and What Carries Forward

21 October 2026 2,162 words

Before approving more Essential Eight spend, map it to ASD Essentials. ASD advises against starting work “solely to achieve a superseded Essential Eight target” unless an obligation or material risk still requires it. Most existing investment carries forward. ASD suggests funding the transition in three tranches that follow its priority phases, each costed separately for capability build, operating uplift and assessment.

The ASD Essentials series changes what a cyber security budget is buying. Under the Essential Eight, the goal was usually a maturity level. Under the new framework there is no level to reach and no completion date, and the board will see whether each action works rather than whether it was bought.

This article is for CFOs, CEOs and finance committees who sign off cyber security spend. It covers what to pause, what carries forward, where new money is likely to go, how ASD suggests structuring the business case and what to watch for in vendor proposals.

Key takeaways

  • Map planned Essential Eight work to the new framework before committing the next stage. Keep what remains relevant, pause what only chases a superseded target.
  • Every Essential Eight strategy maps to at least one ASD Essentials principle. The new programme “redirects and extends prior investment rather than replacing it”.
  • New spend is most likely in governance, detection and response, identity and credential management, supply chain assurance and evidence of effectiveness.
  • ASD suggests three tranches aligned to the priority phases, with each one costed as capability build, operating uplift and assessment.
  • Capability build tends to fall across the tranches while operating costs rise. Budget for the run rate, not just the project.
  • The framework is technology agnostic. No product makes an organisation compliant, and the assessment rates outcomes rather than purchases.

Summary table: ASD’s example funding tranches

ASD’s implementation planning guide gives this example for an organisation securing its enterprise IT environment.

TrancheScopeWhat the executive is buying
Tranche 1 (priority phase 1)Boundary services and Identity services, plus establishing Governance and culture and Visibility and responseDisruption of the most common entry and escalation paths, and the governance, detection and assessment capabilities every later phase depends on
Tranche 2 (priority phase 2)Critical processes and services, Privileged environments, and the capability domains extendedHardening of the highest-consequence assets and the elevated access pathways used to administer them
Tranche 3 (priority phase 3)Business systems and User devices, with the capability domains at full coverageCoverage of the remaining enterprise environment, constraining what an adversary can do from any foothold

Should we pause our Essential Eight programme?

Pause and check, not stop. ASD’s transition guidance is specific: “Do not initiate work solely to achieve a superseded Essential Eight target unless it remains required by a regulator or other obligation or continues to address material cyber security risk.” It adds that existing and planned work should be mapped to the enterprise IT chapter “before deciding whether it should continue unchanged”.

In practice that means three questions for each planned item:

  1. Does a regulator, contract or other obligation still require it? Then it continues.
  2. Does it reduce a material cyber security risk? It probably continues, and it will count towards the new framework.
  3. Is its only purpose reaching a maturity level? Hold it until it has been mapped to the new actions.

Organisations with obligations that still refer to the Essential Eight should keep meeting them. ASD says to continue “as directed by the relevant authority”.

What existing investment carries forward?

ASD is clear that the Essential Eight money is not wasted. The implementation planning guide says “every Essential Eight mitigation strategy maps to at least one cyber security principle” and that a new programme “redirects and extends prior investment rather than replacing it”.

The transition guide gives examples of what carries forward:

  • phishing-resistant multi-factor authentication and its logging
  • application control rulesets, approved software lists and exception registers
  • patch deployment processes, vulnerability scanning and asset discovery
  • privileged access workstations, separate admin accounts and access reviews
  • backup schedules, access restrictions and restoration testing
  • central logging, incident response plans and escalation processes.

Existing evidence counts too. ASD says organisations “do not need to generate new evidence simply because it was originally collected for another framework or assessment”, provided it is current, reliable and covers the domain. That matters for budgeting, because evidence collection is a real cost.

Where will new money be needed?

The enterprise IT chapter covers outcomes the Essential Eight never assessed. ASD’s transition guide flags these as the areas most likely to need additional work and resourcing.

Governance and culture

Principles cover executive cyber security accountability, cyber security resourcing, security risk management assurance, supplier cyber security assurance, AI accountability and legacy system management. Some of this may already exist in risk and audit processes. Most organisations will still need to formalise it so an assessor can see it working.

Visibility and response

Logging, detection and incident response now form a domain that applies across every phase and grows as more domains come into scope. Expect investment in central log correlation, detection coverage reviews, tested response procedures and post-incident reviews.

Identity and credentials

Multi-factor authentication is now one part of a broader principle. Removing default and unused accounts, managing secrets in approved repositories, scanning for exposed credentials, retiring legacy authentication and introducing time-bound privilege are the items most likely to need new effort.

Supply chain and content filtering

Cyber supply chain security and content filtering have no direct Essential Eight equivalent. Supplier assurance in particular tends to need process and contract work as well as technology.

Evidence of effectiveness

This is the cost most often missed. ASD’s assessment guide says “deployment is not effectiveness”, and its planning guide says “deployment evidence alone is insufficient to support or maintain an effective rating”. Organisations need a validation programme that produces operational evidence over time. ASD lists methods from control validation testing to penetration testing and red team exercises, and notes the advanced methods “may not be required for every action”.

How should the business case be structured?

ASD suggests “structuring the investment ask in project tranches that mirror the priority phases”, because a business case built that way “is easier to defend than one built on a bespoke narrative”. Every element traces to something the executive will later see in a posture report.

Within each tranche, ASD says costs should distinguish capability build (tooling, licensing and engineering), operating uplift (the ongoing people and process cost) and assessment (internal assessment effort plus periodic independent assessment).

ASD also tells decision-makers to expect the shape of spending to change, not just its size. Capability build declines in later tranches, because patterns built early, such as logging, baselines and authentication, get reapplied rather than redesigned. Operating uplift grows as each tranche moves more of the environment into sustainment. Assessment costs stay broadly steady.

For a CFO, the practical consequence is that tranche 1 looks like a project and tranche 3 looks like a permanent increase in operating cost. Both need to be in the first business case.

What will it cost to run, not just to build?

ASD’s answer to “when will we be finished?” is that implementation “does not have a definitive completion date”. Once the phases are complete, the organisation moves to a sustainment model that maintains, reassesses and refines controls. ASD’s guidance for senior executives says funding proposals “should distinguish implementation costs, ongoing operation and assessment or assurance costs”.

There is a reason to fund sustainment from the start. ASD notes that identifying sustainment costs early “helps prevent controls from degrading because of insufficient operational funding”, and that the framework’s reassessment cadence will pick up controls that are not maintained. A control that was paid for but not run will show up as not effective in the next report.

What if we can’t fund every tranche now?

Many mid-sized organisations can’t. ASD designed the early phases to “show measurable progress within a realistic timeframe”. A decision to defer a phase “should be guided by risk to the organisation and documented accordingly”, and ASD does “not recommend skipping domains or deferring priority phases indefinitely”.

A reasonable approach is to fund tranche 1 in full, including the governance and detection capabilities that every later phase depends on, and to treat tranches 2 and 3 as forward plans refined after the first assessment. That matches ASD’s own advice that a credible strategy defines “the scope, costs and delivery approach for the priority phase 1 domains, while treating subsequent phases as forward plans”.

Be careful with products sold as the answer

Expect a wave of tools and services marketed as ready for ASD Essentials. The framework doesn’t require any of them. ASD describes the series as technology agnostic, and says actions “describe what must be achieved without prescribing a particular vendor, product or architecture”.

That doesn’t make tools unnecessary. Many actions need technology to achieve them. But an assessment rates whether an action works across the assets in a domain, not whether a product was bought. ASD’s assessment guide puts the difference simply: “A checklist asks whether a control exists, while an Essentials assessment considers whether an action achieves the intended security outcome for the assets in scope.”

Before signing a purchase order, ask which ASD Essentials actions the purchase addresses, in which domains, what evidence it will produce, and what it will cost to run each year. If the seller can’t answer in those terms, the gap analysis hasn’t been done yet.

How will we know the money worked?

ASD’s planning guide answers this directly: through a standardised posture report showing “counts of principles rated fully effective, partially effective, not effective and not assessed per domain, with percentage progression over time, alongside the detail view of specific gaps and remediation”. Charting successive assessments shows where the investment has improved posture.

Agree that reporting format with management before the money is committed. ASD recommends it be settled at programme initiation, because it “avoids later disputes about progress”.

Questions a CFO should ask before approving the plan

  • Which planned Essential Eight items have been mapped to the new framework, and which only chase a superseded target?
  • What does the existing investment already cover, and what is new work?
  • How is each tranche split between capability build, operating uplift and assessment?
  • What is the ongoing sustainment run rate after the programme ends, and how does it compare with today’s operating cost?
  • Which purchases are proposed, which actions and domains do they address, and what evidence will they produce?
  • Where does the plan depart from ASD’s sequencing, and why?
  • How will we continue to meet current regulatory reporting obligations during the transition?

More in the ASD Essentials series

How Beyond Technology can help

The gap analysis decides how much the transition costs. It should be done by someone with no interest in the answer. Beyond Technology doesn’t sell technology, software, hosting or support, and we take no referral fees.

Building on our Essential Eight audit, we can map your existing controls and planned spend to the ASD Essentials actions and give you a business case structured the way ASD recommends. For the governance side of the decision, see our guide on ASD Essentials for boards.

FAQs

Should we stop spending on the Essential Eight?

Not automatically. ASD advises against starting work solely to reach a superseded Essential Eight target unless a regulator or other obligation still requires it, or it addresses material cyber security risk. Map planned work to the new framework first, then continue, redirect or pause each item.

Is our Essential Eight investment wasted?

ASD says every Essential Eight mitigation strategy maps to at least one ASD Essentials principle, and that a new programme redirects and extends prior investment rather than replacing it. Existing evidence can also be reused where it remains current and relevant.

How should we structure a cyber security business case for ASD Essentials?

ASD suggests project tranches that mirror the priority phases, with costs in each tranche split into capability build, operating uplift and assessment. The business case should also separate the programme end date from the ongoing sustainment run rate.

When will an ASD Essentials programme be finished?

ASD says cyber security implementation does not have a definitive completion date. After the priority phases, organisations move to a sustainment model that maintains, reassesses and refines controls, so ongoing operating and assessment costs need to be budgeted.

Do we need to buy new security products for ASD Essentials?

Not necessarily. The framework is technology agnostic and describes outcomes without prescribing a vendor, product or architecture. Some actions will need new tools, but an assessment rates whether each action works across the assets in scope, not what was purchased.

References

  • Australian Signals Directorate, Implementation planning guide (2026)
  • Australian Signals Directorate, Transitioning from the Essential Eight (2026)
  • Australian Signals Directorate, Assessment process guide (2026)
  • Australian Signals Directorate, ASD Essentials overview: The Essentials for senior executives (2026)
  • Australian Signals Directorate, ASD Essentials for enterprise IT (2026)