# ASD Essentials Assessment and Transition

## What is ASD Essentials?

ASD Essentials is the Australian Signals Directorate's cyber security framework launched on 15 October 2026 as "an evolution of Australia's widely adopted Essential Eight framework" ([ASD](https://www.asd.gov.au/news/2026-10-15-asd-essentials-evolving-our-approach-cyber-security-resilience)). It is a series of chapters for different technology environments that share one model: principles describe the security outcome, drawn from the [ISM](/services/ism); actions describe what to do; and eight domains describe where it applies.

The three chapters published at launch are:

- **[Essentials for enterprise IT](/blog/2026-10-15-asd-essentials-for-enterprise-it)**, the Essential Eight's successor, for organisations with their own servers, a hybrid environment or infrastructure-as-a-service.
- **[Essentials for cloud](/blog/2026-10-15-asd-essentials-for-cloud)**, for organisations whose technology is delivered entirely as software-as-a-service and platform-as-a-service.
- **[Essentials for operational technology](/blog/2026-10-15-asd-essentials-for-operational-technology)**, for operators of industrial control and other operational technology in critical services.

The eight domains are two capability domains (Governance and culture; Visibility and response) and six technical ones (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems and User devices). Instead of maturity levels, ASD groups the technical domains into three priority phases, and says "Priority phases are a sequencing mechanism, not a rating" ([ASD](https://www.cyber.gov.au/publication/which-chapter-should-i-start-with)). For enterprise IT, phase 1 is boundary services and identity services. The full comparison with the Essential Eight is in our [launch-day guide](/blog/2026-10-15-asd-essentials-vs-essential-eight).

## Does ASD Essentials apply to my business?

ASD says "The Essentials series is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations", and that smaller businesses "can still use this guidance where relevant" ([ASD FAQ](https://www.cyber.gov.au/publication/frequently-asked-questions)).

It does not replace anything you are required to do today. ASD says "Until associated regulatory changes are communicated by regulators, organisations should continue to meet their current regulatory obligations", and will maintain both frameworks during a transition it has not yet dated ([ASD](https://www.asd.gov.au/news/2026-10-15-asd-essentials-evolving-our-approach-cyber-security-resilience)). If a policy, contract or insurer asks for an [Essential Eight](/services/essential-eight) maturity level, that request still stands.

Your existing work counts. ASD says "Every Essential Eight mitigation strategy maps to at least one principle in the Essentials series", but also that maturity ratings "do not automatically convert into effectiveness outcomes under the Essentials series" ([ASD FAQ](https://www.cyber.gov.au/publication/frequently-asked-questions)). The controls carry across; the rating has to be earned again, domain by domain.

## Is there an ASD Essentials certification?

No. ASD's [Assessment process guide](https://www.cyber.gov.au/publication/assessment-process-guide) is written for organisations assessing their own environment, and its [Implementation planning guide](https://www.cyber.gov.au/publication/implementation-planning-guide) says organisations "may choose to engage an independent assessor, but this is not required". Each action is rated in each domain as not assessed, not effective, partially effective or fully effective; a principle takes the rating of its weakest action; and each domain gets a percentage. ASD is blunt about evidence: "Deployment is not effectiveness."

## What does an ASD Essentials assessment involve?

Our ASD Essentials assessment is a transition review done with you and your IT provider. We help you identify the controls that meet each action in the domains that apply to you, and the evidence that can prove them. It is not a technical test of your systems, and it does not issue a formal effectiveness rating.

1. **Start from where you are.** We record your transition baseline: your Essential Eight position, the controls you already run, your key systems and the obligations you still have to meet. ASD recommends "establishing a transition baseline" first.
2. **Choose the chapter and scope the domains.** We agree which chapter fits your environment and which systems belong in each domain, starting with ASD's first priority phase and the two capability domains.
3. **Sort every action.** For each action in scope, we work out whether it is addressed, partially addressed or not addressed, and what your existing licences and tools already provide.
4. **Identify the evidence.** For each control, the evidence that shows it works across the domain, not only that it is installed, and where that evidence is missing.
5. **Plan the gaps.** We walk you and your IT provider through what is covered, what is not and what to fix first, phase by phase.

If you later need an independent assessment, or a regulator asks for Essentials reporting, you go into it with your scope, controls and evidence already in one place.

## What you get

- Your transition baseline: where your Essential Eight work lands in ASD Essentials.
- A scope statement for each domain in your chosen chapter.
- Every action in scope sorted into addressed, partially addressed or not addressed, with the controls that meet it.
- An evidence register: what proves each control, and where proof is missing or weak.
- A prioritised plan by priority phase, with a plain-English summary for owners and the detail your IT provider needs.
- Optional help to close the gaps: we can do the work, or source and deliver the products, quoted separately.