Before approving more Essential Eight spend, map it to ASD Essentials. ASD advises against starting work “solely to achieve a superseded Essential Eight target” unless an obligation or material risk still requires it. Most existing investment carries forward. ASD suggests funding the transition in three tranches that follow its priority phases, each costed separately for capability build, operating uplift and assessment.

The ASD Essentials series changes what a cyber security budget is buying. Under the Essential Eight, the goal was usually a maturity level. Under the new framework there is no level to reach and no completion date, and the board will see whether each action works rather than whether it was bought.

This article is for CFOs, CEOs and finance committees who sign off cyber security spend. It covers what to pause, what carries forward, where new money is likely to go, how ASD suggests structuring the business case and what to watch for in vendor proposals.

Key takeaways

• Map planned Essential Eight work to the new framework before committing the next stage. Keep what remains relevant, pause what only chases a superseded target.
• Every Essential Eight strategy maps to at least one ASD Essentials principle. The new programme “redirects and extends prior investment rather than replacing it”.
• New spend is most likely in governance, detection and response, identity and credential management, supply chain assurance and evidence of effectiveness.
• ASD suggests three tranches aligned to the priority phases, with each one costed as capability build, operating uplift and assessment.
• Capability build tends to fall across the tranches while operating costs rise. Budget for the run rate, not just the project.
• The framework is technology agnostic. No product makes an organisation compliant, and the assessment rates outcomes rather than purchases.

Summary table: ASD’s example funding tranches

ASD’s implementation planning guide gives this example for an organisation securing its enterprise IT environment.

Should we pause our Essential Eight programme?

Pause and check, not stop. ASD’s transition guidance is specific: “Do not initiate work solely to achieve a superseded Essential Eight target unless it remains required by a regulator or other obligation or continues to address material cyber security risk.” It adds that existing and planned work should be mapped to the enterprise IT chapter “before deciding whether it should continue unchanged”.

In practice that means three questions for each planned item:

1. Does a regulator, contract or other obligation still require it? Then it continues.
2. Does it reduce a material cyber security risk? It probably continues, and it will count towards the new framework.
3. Is its only purpose reaching a maturity level? Hold it until it has been mapped to the new actions.

Organisations with obligations that still refer to the Essential Eight should keep meeting them. ASD says to continue “as directed by the relevant authority”.

What existing investment carries forward?

ASD is clear that the Essential Eight money is not wasted. The implementation planning guide says “every Essential Eight mitigation strategy maps to at least one cyber security principle” and that a new programme “redirects and extends prior investment rather than replacing it”.

The transition guide gives examples of what carries forward:

• phishing-resistant multi-factor authentication and its logging
• application control rulesets, approved software lists and exception registers
• patch deployment processes, vulnerability scanning and asset discovery
• privileged access workstations, separate admin accounts and access reviews
• backup schedules, access restrictions and restoration testing
• central logging, incident response plans and escalation processes.

Existing evidence counts too. ASD says organisations “do not need to generate new evidence simply because it was originally collected for another framework or assessment”, provided it is current, reliable and covers the domain. That matters for budgeting, because evidence collection is a real cost.

Where will new money be needed?

The enterprise IT chapter covers outcomes the Essential Eight never assessed. ASD’s transition guide flags these as the areas most likely to need additional work and resourcing.

Governance and culture

Principles cover executive cyber security accountability, cyber security resourcing, security risk management assurance, supplier cyber security assurance, AI accountability and legacy system management. Some of this may already exist in risk and audit processes. Most organisations will still need to formalise it so an assessor can see it working.

Visibility and response

Logging, detection and incident response now form a domain that applies across every phase and grows as more domains come into scope. Expect investment in central log correlation, detection coverage reviews, tested response procedures and post-incident reviews.

Identity and credentials

Multi-factor authentication is now one part of a broader principle. Removing default and unused accounts, managing secrets in approved repositories, scanning for exposed credentials, retiring legacy authentication and introducing time-bound privilege are the items most likely to need new effort.

Supply chain and content filtering

Cyber supply chain security and content filtering have no direct Essential Eight equivalent. Supplier assurance in particular tends to need process and contract work as well as technology.

Evidence of effectiveness

This is the cost most often missed. ASD’s assessment guide says “deployment is not effectiveness”, and its planning guide says “deployment evidence alone is insufficient to support or maintain an effective rating”. Organisations need a validation programme that produces operational evidence over time. ASD lists methods from control validation testing to penetration testing and red team exercises, and notes the advanced methods “may not be required for every action”.

How should the business case be structured?

ASD suggests “structuring the investment ask in project tranches that mirror the priority phases”, because a business case built that way “is easier to defend than one built on a bespoke narrative”. Every element traces to something the executive will later see in a posture report.

Within each tranche, ASD says costs should distinguish capability build (tooling, licensing and engineering), operating uplift (the ongoing people and process cost) and assessment (internal assessment effort plus periodic independent assessment).

ASD also tells decision-makers to expect the shape of spending to change, not just its size. Capability build declines in later tranches, because patterns built early, such as logging, baselines and authentication, get reapplied rather than redesigned. Operating uplift grows as each tranche moves more of the environment into sustainment. Assessment costs stay broadly steady.

For a CFO, the practical consequence is that tranche 1 looks like a project and tranche 3 looks like a permanent increase in operating cost. Both need to be in the first business case.

What will it cost to run, not just to build?

ASD’s answer to “when will we be finished?” is that implementation “does not have a definitive completion date”. Once the phases are complete, the organisation moves to a sustainment model that maintains, reassesses and refines controls. ASD’s guidance for senior executives says funding proposals “should distinguish implementation costs, ongoing operation and assessment or assurance costs”.

There is a reason to fund sustainment from the start. ASD notes that identifying sustainment costs early “helps prevent controls from degrading because of insufficient operational funding”, and that the framework’s reassessment cadence will pick up controls that are not maintained. A control that was paid for but not run will show up as not effective in the next report.

What if we can’t fund every tranche now?

Many mid-sized organisations can’t. ASD designed the early phases to “show measurable progress within a realistic timeframe”. A decision to defer a phase “should be guided by risk to the organisation and documented accordingly”, and ASD does “not recommend skipping domains or deferring priority phases indefinitely”.

A reasonable approach is to fund tranche 1 in full, including the governance and detection capabilities that every later phase depends on, and to treat tranches 2 and 3 as forward plans refined after the first assessment. That matches ASD’s own advice that a credible strategy defines “the scope, costs and delivery approach for the priority phase 1 domains, while treating subsequent phases as forward plans”.

Be careful with products sold as the answer

Expect a wave of tools and services marketed as ready for ASD Essentials. The framework doesn’t require any of them. ASD describes the series as technology agnostic, and says actions “describe what must be achieved without prescribing a particular vendor, product or architecture”.

That doesn’t make tools unnecessary. Many actions need technology to achieve them. But an assessment rates whether an action works across the assets in a domain, not whether a product was bought. ASD’s assessment guide puts the difference simply: “A checklist asks whether a control exists, while an Essentials assessment considers whether an action achieves the intended security outcome for the assets in scope.”

Before signing a purchase order, ask which ASD Essentials actions the purchase addresses, in which domains, what evidence it will produce, and what it will cost to run each year. If the seller can’t answer in those terms, the gap analysis hasn’t been done yet.

How will we know the money worked?

ASD’s planning guide answers this directly: through a standardised posture report showing “counts of principles rated fully effective, partially effective, not effective and not assessed per domain, with percentage progression over time, alongside the detail view of specific gaps and remediation”. Charting successive assessments shows where the investment has improved posture.

Agree that reporting format with management before the money is committed. ASD recommends it be settled at programme initiation, because it “avoids later disputes about progress”.

Questions a CFO should ask before approving the plan

• Which planned Essential Eight items have been mapped to the new framework, and which only chase a superseded target?
• What does the existing investment already cover, and what is new work?
• How is each tranche split between capability build, operating uplift and assessment?
• What is the ongoing sustainment run rate after the programme ends, and how does it compare with today’s operating cost?
• Which purchases are proposed, which actions and domains do they address, and what evidence will they produce?
• Where does the plan depart from ASD’s sequencing, and why?
• How will we continue to meet current regulatory reporting obligations during the transition?

More in the ASD Essentials series

• ASD Essentials explained: what changes after the Essential Eight, from the eight domains to priority phases and posture ratings.
• Moving from the Essential Eight to ASD Essentials: why a maturity level doesn’t carry over, and how to reuse the evidence you already hold.
• ASD Essentials for boards: the ten questions ASD says senior executives should ask before they approve the plan.

How Beyond Technology can help

The gap analysis decides how much the transition costs. It should be done by someone with no interest in the answer. Beyond Technology doesn’t sell technology, software, hosting or support, and we take no referral fees.

Building on our Essential Eight audit, we can map your existing controls and planned spend to the ASD Essentials actions and give you a business case structured the way ASD recommends. For the governance side of the decision, see our guide on ASD Essentials for boards.

FAQs

Should we stop spending on the Essential Eight?

Not automatically. ASD advises against starting work solely to reach a superseded Essential Eight target unless a regulator or other obligation still requires it, or it addresses material cyber security risk. Map planned work to the new framework first, then continue, redirect or pause each item.

Is our Essential Eight investment wasted?

ASD says every Essential Eight mitigation strategy maps to at least one ASD Essentials principle, and that a new programme redirects and extends prior investment rather than replacing it. Existing evidence can also be reused where it remains current and relevant.

How should we structure a cyber security business case for ASD Essentials?

ASD suggests project tranches that mirror the priority phases, with costs in each tranche split into capability build, operating uplift and assessment. The business case should also separate the programme end date from the ongoing sustainment run rate.

When will an ASD Essentials programme be finished?

ASD says cyber security implementation does not have a definitive completion date. After the priority phases, organisations move to a sustainment model that maintains, reassesses and refines controls, so ongoing operating and assessment costs need to be budgeted.

Do we need to buy new security products for ASD Essentials?

Not necessarily. The framework is technology agnostic and describes outcomes without prescribing a vendor, product or architecture. Some actions will need new tools, but an assessment rates whether each action works across the assets in scope, not what was purchased.

References

• Australian Signals Directorate, Implementation planning guide (2026)
• Australian Signals Directorate, Transitioning from the Essential Eight (2026)
• Australian Signals Directorate, Assessment process guide (2026)
• Australian Signals Directorate, ASD Essentials overview: The Essentials for senior executives (2026)
• Australian Signals Directorate, ASD Essentials for enterprise IT (2026)