ASD Essentials vs Essential Eight: What Australian Organisations Should Do Next

Australian organisations that have invested in Essential Eight cybersecurity controls now have a broader framework to consider: ASD Essentials. Released by the Australian Signals Directorate (ASD) in October 2026, ASD Essentials expands cybersecurity guidance beyond the traditional Essential Eight mitigation strategies to address enterprise IT, operational technology and cloud environments.

For businesses that have already invested in cybersecurity assessments, endpoint protection, patching and identity security, the question is not whether to abandon that work. It is how to build on it.

Understanding the relationship between ASD Essentials and Essential Eight can help organisations identify security gaps, prepare evidence and plan their next assessment without duplicating existing efforts.

What Is ASD Essentials?

ASD Essentials is a principles-based cybersecurity framework developed by ASD to help organisations prioritise security improvements according to their technology environments, risks and operational requirements.

Essential Eight focuses on eight mitigation strategies designed to reduce the risk of common cyber threats. ASD Essentials takes a broader approach, connecting security outcomes to the systems, services and business functions an organisation needs to protect.

The framework uses three core elements:

• Principles: The cybersecurity outcomes an organisation should achieve.
• Actions: The activities required to achieve those outcomes.
• Domains: The business functions, systems and assets to which those actions apply.

This structure helps organisations move beyond checking whether individual controls exist to assessing whether they deliver the intended security outcomes.

Understanding the Three ASD Essentials Chapters

ASD Essentials currently includes three environment-specific chapters. Organisations should select the chapters relevant to their technology environment rather than assume that every chapter applies equally.

1. ASD Essentials for Enterprise IT

• This chapter builds on Essential Eight guidance while expanding the focus to broader enterprise security outcomes.
• It addresses areas including governance and culture, visibility and response, and the protection of enterprise systems and assets. It also considers how security requirements apply across different technical environments, including development and testing systems where they can affect production.
• For organisations with established Essential Eight programmes, this is the logical starting point for understanding which existing controls can be reused and where additional work is needed.

2. ASD Essentials for Operational Technology

• Operational technology (OT) includes the systems that monitor or control physical processes, such as industrial equipment, manufacturing operations and critical infrastructure.
• OT environments have different availability, safety and operational requirements from conventional IT systems. Security measures must account for these differences rather than applying standard IT controls without considering their operational impact.
• Organisations operating industrial facilities, production systems or other OT environments should assess whether this chapter applies to their operations.

3. ASD Essentials for Cloud

• The cloud chapter addresses environments delivered through cloud service models, including software-as-a-service (SaaS) and platform-as-a-service (PaaS).
• Organisations relying on Microsoft 365, cloud-hosted business applications or platform services should consider the shared responsibilities between the organisation and its technology providers. Cloud security requires attention to identity, access, configuration, data protection, monitoring and the responsibilities that remain with the customer.
• Businesses operating across enterprise IT, OT and cloud may need to consider multiple chapters.

What Evidence Should Organisations Prepare?

A structured evidence review helps reduce assessment delays and makes security gaps easier to identify.

Start by gathering existing Essential Eight assessment results, security policies, risk registers and records of implemented controls. Then identify the evidence needed to demonstrate the relevant ASD Essentials outcomes.

Depending on the action being assessed, useful evidence may include:

• Identity and access: Multifactor authentication coverage, privileged account reviews and access policies.
• Patch management: Vulnerability scan results, patch deployment records and exception approvals.
• Endpoint and application security: Configuration baselines, application control policies and endpoint protection reports.
• Governance: Approved security policies, assigned responsibilities, risk treatment plans and management reviews.
• Monitoring and response: Security alerts, incident response procedures, investigation records and monitoring coverage.

Should Organisations Continue Their Existing Essential Eight Obligations?

Yes. Organisations should not assume that the release of ASD Essentials automatically removes existing Essential Eight obligations.

ASD continues to publish Essential Eight guidance alongside ASD Essentials during the transition. Organisations must continue meeting their applicable regulatory, contractual and internal security requirements until relevant authorities communicate any changes.

This is particularly important for government suppliers, regulated organisations and businesses subject to customer security requirements.

The sensible approach is to maintain existing Essential Eight controls and assessment activities where required, while planning a structured transition to the relevant ASD Essentials chapter or chapters.

Avoid pausing established security improvements simply because the framework is evolving. Existing controls remain valuable, and their evidence can support the transition.

How to Begin an ASD Essentials Gap Assessment

Organisations do not need to rebuild their cybersecurity programme from scratch. A staged gap assessment can establish what is already in place and what requires further attention.

1. Confirm the scope: Identify the systems, services, data and technology environments that need to be assessed.
2. Review existing assessments: Gather Essential Eight results, policies, control records and previous remediation plans.
3. Map existing controls: Link relevant controls and evidence to applicable ASD Essentials actions.
4. Identify gaps: Determine where outcomes are only partially achieved, evidence is insufficient or additional controls are needed.
5. Prioritise remediation: Focus on material risks, business-critical systems and the recommended implementation sequence.
6. Establish ongoing reviews: Assign ownership, track remediation and periodically reassess security effectiveness.

This process helps organisations direct resources towards meaningful improvements rather than duplicating existing work.

Why Choose Exigo Tech as Your Managed Intelligence Partner

Moving from Essential Eight to ASD Essentials requires a clear understanding of existing controls, evidence and security priorities. We help Australian organisations assess their cybersecurity posture and plan practical improvements aligned with business requirements.

Our relevant capabilities include:

• Essential Eight Assessments: Review existing mitigation strategies, maturity and control effectiveness.
• Cybersecurity Gap Assessments: Identify control gaps, evidence requirements and prioritised remediation actions.
• Microsoft Security Solutions: Strengthen identity, endpoint protection, monitoring and security management using appropriate Microsoft technologies.
• Managed Security Services: Support ongoing threat detection, response and security posture improvement through managed security capabilities.

As your Managed Intelligence Partner, we connect cybersecurity assessments with practical remediation and ongoing security management, helping organisations build resilience as guidance and threats evolve.