ASD Essentials vs Essential Eight: What Australian Businesses Need to Know

ASD Essentials expands Australian cyber security guidance beyond the Essential Eight. Existing controls remain valuable, but organisations now need to consider security outcomes across enterprise IT, cloud and operational technology.

By the Compuloop editorial team | Practical guidance for Australian businesses

For Australian businesses, this means cyber security can no longer be reduced to a checklist of eight controls. Identity, cloud services, governance, incident visibility, suppliers, privileged systems, AI and evidence of ongoing effectiveness all need to be considered as part of the operating environment.

This guide explains what has changed, what remains valuable and how to begin without turning the transition into an uncontrolled technology project.

What is ASD Essentials?

ASD Essentials is a series of Australian Government cyber security publications for different technology environments. Each chapter uses the same three-layer model:

• Principles describe the cyber security outcomes an organisation should achieve.
• Actions describe what needs to be done to achieve those outcomes.
• Domains group the business functions and assets to which the actions apply.

That structure changes the question from “Have we installed this control?” to “Is this security outcome being achieved consistently in the part of the business where it matters?”

The initial series contains chapters for:

• enterprise IT, including on-premises, hybrid and infrastructure-as-a-service environments;
• cloud, focused on organisations relying primarily on software-as-a-service and platform-as-a-service; and
• operational technology, covering systems that monitor or control physical equipment and processes.

An organisation may need one chapter or several. A manufacturer might use the enterprise IT, cloud and operational technology chapters. A professional services firm operating almost entirely in Microsoft 365 and other SaaS platforms may begin with the cloud chapter. A business with servers, hybrid identity and cloud applications may need both enterprise IT and cloud guidance.

ASD does not require organisations to work through the chapters in a fixed order. The recommended starting point depends on the environments operated, legal and contractual obligations, the largest control gaps and the consequences and likelihood of compromise.

ASD Essentials vs Essential Eight

The Essential Eight remains a valuable security baseline, but ASD Essentials changes the scope, implementation model and way effectiveness is assessed.

The distinction between priority phases and maturity levels matters. They are not interchangeable.

Essential Eight maturity levels describe implementation against requirements associated with increasing adversary tradecraft. ASD Essentials priority phases recommend the order in which domains should be addressed so organisations can reduce important risks earlier. Reaching a later phase is not, by itself, proof that controls are effective.

Is ASD Essentials replacing the Essential Eight?

ASD says it has evolved the Essential Eight into ASD Essentials for enterprise IT to address contemporary threats and modern enterprise environments. However, this is not a reset that makes existing work worthless.

Every Essential Eight mitigation strategy maps to at least one principle in ASD Essentials for enterprise IT. Existing controls, tools and evidence may directly satisfy or contribute to actions in the new framework.

What changes is the context in which that work is evaluated.

A control that met an Essential Eight requirement might need to cover more assets, operate differently in a high-risk domain or be supported by stronger evidence. For example, enabling multi-factor authentication is valuable, but ASD Essentials also considers the identity services, access pathways and domains where authentication must work. Deployment alone does not prove that the outcome is consistently effective.

Organisations should therefore use their Essential Eight implementation as the starting point for a gap analysis—not assume an old maturity rating automatically converts into a new effectiveness rating.

This is also why Compuloop’s existing guide to the Essential Eight for Australian businesses remains useful. The eight mitigation strategies still address real attack paths. ASD Essentials builds a broader security and governance model around that foundation.

Businesses that still need to establish or strengthen those baseline controls can also review Compuloop’s Essential Eight cyber security services.

The eight enterprise IT domains

ASD Essentials for enterprise IT organises business functions and supporting assets into eight domains with similar risk characteristics.

Two capability domains apply throughout the program:

1. Governance and culture — policies, risk management, defined responsibilities and the security culture required to sustain the program.
2. Visibility and response — the ability to identify assets and events, analyse activity and respond to cyber incidents.

Six technical domains are then addressed through three recommended priority phases.

Priority phase 1

• Boundary services — internet-facing services, network edges and other systems that connect environments with different levels of trust.
• Identity services — directories, credentials, authentication, authorisation and other systems controlling access.

These areas are often targeted early in an attack. Strengthening them can make initial access, credential abuse and movement through the environment more difficult.

Priority phase 2

• Critical processes and services — the systems and services the organisation depends on to deliver its most important outcomes.
• Privileged environments — administrative systems, management services and other high-impact privileged functions.

Compromise in these domains can disrupt essential operations or give an attacker extensive control.

Priority phase 3

• Business systems — the applications and services supporting normal organisational operations.
• User devices — workforce endpoints such as desktops and laptops.

These systems remain important, but ASD’s sequencing helps organisations concentrate finite resources on the domains likely to deliver the most immediate risk reduction.

The order is a recommended starting point, not a rigid rule. A business may change the sequence because of an active threat, regulatory requirement, technology replacement or a particularly serious gap. The reason should be documented so executives, assessors and future decision-makers can understand the trade-off.

Which ASD Essentials chapter should your business use?

The answer depends on what the business operates and what responsibility it retains.

Start with enterprise IT when you control the underlying environment

The enterprise IT chapter is generally the stronger starting point for organisations operating on-premises systems, hybrid environments or infrastructure-as-a-service. These businesses retain substantial responsibility for operating systems, applications, identity infrastructure, networking and administration—even where some infrastructure runs in a public cloud.

Smaller organisations can still use the enterprise IT principles where relevant. The outcomes do not become unimportant because a business has fewer employees. The difference is how controls are implemented and how much responsibility is shared with technology providers.

Start with cloud when the business mainly consumes SaaS and PaaS

The cloud chapter is designed for environments delivered primarily through software-as-a-service and platform-as-a-service. It focuses on the areas a customer can and must control: identities, data, configuration, applications, integrations and provider assurance.

This matters for businesses that operate through Microsoft 365, cloud accounting, customer-management platforms and other hosted applications. The provider may secure the underlying platform, but the customer still owns decisions about users, permissions, external sharing, integrations, data handling and configuration.

For many Compuloop clients, Microsoft 365 security and administration will sit at the centre of this work.

Use the operational technology chapter when technology controls physical processes

Operational technology includes systems that monitor or control physical equipment and processes. It can be relevant to manufacturing, utilities, logistics, mining, building systems and other environments where cyber incidents may affect production, service continuity, equipment or safety.

OT often involves long asset lifecycles, legacy platforms and strict availability requirements. Controls that are straightforward in office IT may require different engineering and risk decisions in an operational environment.

Expect more than one chapter over time

Many organisations will ultimately use more than one chapter. The practical question is usually which environment to assess first—not which single chapter the organisation will use forever.

Evidence now matters as much as deployment

One of the most useful changes in ASD Essentials is the emphasis on whether a security action is actually effective.

Actions are assessed in each applicable domain using four ratings:

• not assessed;
• not effective;
• partially effective; and
• fully effective.

“Not assessed” is deliberately different from “not effective”. It means the action has not yet been examined or there is insufficient evidence to reach a conclusion.

Evidence must also be current and relevant. A policy written three years ago, an expired exception, a screenshot showing that a setting was enabled once or a backup report that does not demonstrate recovery may not prove sustained effectiveness.

Depending on the action, better evidence might include:

• current asset and identity inventories;
• configuration and deployment records;
• patch and vulnerability reports;
• privileged-access reviews;
• authentication and security-event logs;
• tested backup restoration records;
• incident simulations and follow-up actions;
• supplier assurance evidence;
• exception owners, expiry dates and review records; and
• independent testing where the risk justifies it.

This is a healthier standard than treating cyber security as a collection of products. Buying a tool may provide a capability. It does not prove the capability covers the right assets, is configured correctly or continues to work.

What changes for directors and senior executives?

ASD Essentials makes leadership accountability more explicit.

Boards and executives are expected to understand the organisation’s important functions and assets, define accountability, consider risk appetite, approve sustainable resourcing and receive reporting that shows both progress and material gaps.

That does not mean directors need to configure security tools. It means they should be able to ask informed questions:

• Which business functions and assets sit in each domain?
• Which domains would create the greatest consequence if compromised?
• What existing Essential Eight work carries forward?
• Which actions are new or need broader coverage?
• What evidence shows that controls are effective?
• Which risks or exceptions have been accepted, by whom and until when?
• What must be funded after implementation to keep the controls working?
• How will an incident affect customers, staff, operations and regulatory obligations?

Cyber security investment is not finished when a project closes. Identities change, new services are introduced, suppliers update platforms and controls degrade. Sustainment, reassessment and reporting must be planned as operating responsibilities.

How does ASD Essentials apply to AI?

ASD’s guidance treats artificial intelligence in three ways: as a potential threat, as a defensive capability and as an asset that needs to be governed.

AI can make existing attacks faster and cheaper while adding risks such as prompt injection, unapproved data disclosure, compromised models and highly convincing impersonation. AI-enabled security tools may also help analyse events or vulnerabilities, but they do not replace governance or human accountability.

AI systems can include models, training data, prompts, outputs, APIs, connectors, service accounts and AI-agent identities. Those assets need to be identified, assigned appropriate access and placed within the relevant domains.

For businesses adopting Copilot, AI agents or automated workflows, this connects directly with an AI policy for Australian businesses. Approved tools, managed identities, data boundaries, connector permissions, human oversight and incident reporting should be part of the wider security program—not handled as a separate innovation experiment.

What should Australian businesses do next?

The transition does not need to begin with a large purchase. Start by establishing a reliable picture of the current environment.

1. Record the current security baseline

Collect the latest Essential Eight assessment, control register, risk and exception registers, remediation plans, asset records and relevant supplier documentation. Confirm that the information still reflects the live environment.

2. Identify the applicable environments

Document whether the organisation operates enterprise IT, cloud, operational technology or a combination. Include outsourced and hosted services; responsibility may be shared, but the underlying business risk does not disappear.

3. Map the first domains

Begin with governance and culture, visibility and response, boundary services and identity services. Identify the functions and assets that belong in each domain, including the systems operated by service providers.

4. Reuse current Essential Eight evidence

Map existing controls and evidence to the relevant ASD Essentials principles and actions. Record which outcomes are already addressed, partly addressed or not addressed. Treat this as a gap analysis rather than a formal effectiveness rating.

5. Prioritise gaps by business risk

Consider exposure, consequence, legal and contractual obligations, active threats and delivery capacity. Do not spread effort across every domain simply to make the plan look comprehensive.

6. Assign owners, evidence and review dates

Every material action should have an accountable owner, required evidence, target date and a plan for ongoing operation. Exceptions should have a reason, compensating controls, an owner and an expiry or review date.

7. Report outcomes, not product activity

Executive reporting should show which domains have been assessed, where actions are effective, where gaps remain, what risks have been accepted and which improvements need investment. A count of blocked emails or installed agents is not a cyber security posture report.

What does this mean when IT is outsourced?

Outsourcing technology does not outsource accountability for security outcomes.

If a managed service provider, cloud vendor or software supplier performs part of an action, the organisation still needs to understand the division of responsibility and obtain sufficient evidence that the requirement is being met.

Contracts and service reviews should make the following clear:

• which assets and domains the provider supports;
• which security actions the provider performs;
• what the customer must configure or approve;
• what evidence will be supplied and how often;
• how privileged access is protected and reviewed;
• how incidents and control failures are reported;
• how exceptions and residual risks are documented; and
• what happens to access, records and evidence when the relationship ends.

Compuloop’s cybersecurity services for Australian businesses can help connect framework requirements with the systems a business actually operates. That may include Microsoft 365, endpoints, identities, networks, backups, cloud services and supplier access.

Common ASD Essentials transition mistakes

Avoid these early mistakes:

• Treating priority phases as maturity levels. Phases sequence work; they do not certify effectiveness.
• Assuming previous maturity equals a new rating. Existing controls and evidence are inputs to the assessment, not an automatic result.
• Assessing the organisation as one block. The same control may be effective in one domain and incomplete in another.
• Ignoring governance and incident visibility. These capability domains continue across every phase.
• Trying to transition everything at once. A focused sequence is more likely to produce measurable risk reduction.
• Reusing stale evidence. Evidence must describe the current environment and show ongoing operation.
• Confusing a provider promise with proof. Responsibility assigned in a contract still needs current evidence.
• Assuming the framework is automatically a universal legal requirement. Regulatory, contractual and sector obligations vary. Organisations should confirm which requirements apply to them.

Frequently asked questions

What is the difference between ASD Essentials and the Essential Eight?

The Essential Eight focuses on eight mitigation strategies and maturity levels. ASD Essentials uses principles, actions and domains across environment-specific chapters for enterprise IT, cloud and operational technology. It broadens the focus from implementing selected controls to achieving and evidencing security outcomes across business functions and assets.

Is the Essential Eight still relevant?

Yes. Existing Essential Eight controls, tooling and assessment evidence remain valuable and can contribute to ASD Essentials actions. They should be reviewed against the new scope and evidence requirements rather than treated as automatically equivalent.

Do small businesses need to use ASD Essentials?

ASD notes that small and medium businesses can apply the security outcomes where relevant, even when they do not operate at enterprise scale. The implementation should be proportionate to the organisation’s environment, risk and available resources. Separate regulatory or contractual requirements may also affect what a business must do.

Is ASD Essentials mandatory for every Australian business?

Not automatically. ASD Essentials is cyber security guidance, while particular organisations may also have legal, regulatory, government, customer or contractual obligations. Businesses should identify their applicable obligations rather than describe the framework itself as a universal law.

Should a Microsoft 365 business use the cloud or enterprise IT chapter?

A business relying mainly on SaaS and PaaS may begin with the cloud chapter. An organisation with on-premises systems, hybrid identity, infrastructure-as-a-service or other systems it operates may also need the enterprise IT chapter. Many organisations will need both over time.

Does an Essential Eight maturity level convert to an ASD Essentials rating?

No. Previous maturity is a useful baseline, but it does not automatically become an ASD Essentials effectiveness rating. Actions are assessed by applicable domain using not assessed, not effective, partially effective or fully effective.

Where should an organisation start?

Start by recording the current baseline, identifying the relevant environments and scoping governance and culture, visibility and response, boundary services and identity services. Map current controls and evidence before approving new technology purchases.