Cyber Security
Start from where you are today. We rate your current controls on evidence, show what the first phase of ASD Essentials will ask of you and help close the gaps.
01Who it's for
Maturity levels from the current model don't convert automatically into ASD Essentials ratings, so a recorded baseline is what lets the work you've already done count.
02What's included
Baseline
We assess each of the eight strategies in ASD's current maturity model and record your level with evidence: an honest result for every strategy, not a single headline score.
We record the four things ASD recommends capturing before the move: your current maturity, existing controls, risk assessment results and key business functions.
Map & rate
We map your assets and business functions, including AI, to the four Phase 1 domains. For each in-scope action, we record whether it is not, partially or fully effective, and the evidence behind the rating.
We map the controls you already run to the ASD Essentials principles they support, so you can see which investments carry forward and where new work is needed.
Plan & uplift
A practical plan that closes the gaps in the order that reduces the most risk first. Each item names the change, who should own it and how to prove it is done.
Our security team can make the changes, not just report them: application control, macro settings, admin privilege clean-up, MFA roll-out, patching and backup testing across your Microsoft environment.
Report & brief
A plain-English session for your board, leadership and IT team on what ASD Essentials asks of them, how domain reporting works and what the Executive artificial intelligence accountability principle means.
Cyber Security
Governance and culture is one of the Phase 1 domains in ASD Essentials, so accountability sits with leadership as well as IT. We help executives see which decisions belong to them, including AI accountability, before technical work begins.
03In detail
Most organisations already track the eight strategies in ASD’s current maturity model. We assess where you stand against it today and use that as your transition baseline, so the work you have already done keeps counting. The model rates each strategy separately, from Maturity Level Zero (not yet meeting Level One) to Maturity Level Three, and assessors follow ASD’s assessment process guide to evidence each level. This work sits alongside our wider cyber security services.
ASD Essentials is built from four parts:
An asset can sit in more than one domain. In that case, you apply the actions from the earliest priority phase first and add later actions as you progress.
The series has separate chapters for enterprise IT, cloud and operational technology (OT). The core concepts apply to every chapter, but the specific principles, actions and priority phases differ, so scope each environment against its own chapter. ASD consulted on the framework from 15 June to 12 July 2026 and made changes in response, including clearer terminology, more scoping guidance and guidance on AI, before launching it on 15 October 2026.
Each action is rated for the assets in scope:
In most cases, ASD says, controls you already run under the current model directly satisfy, or substantially contribute to, an action in ASD Essentials. The framework table on this page shows where common controls land. What changes is how progress is measured:
| Topic | Current maturity model | ASD Essentials |
|---|---|---|
| Approach | Eight prescribed strategies | Principles and actions |
| Progress measure | Maturity Levels Zero to Three | Priority phases |
| Rating | Maturity level per strategy | Not, partially or fully effective per action |
| Scope | Mainly Windows-based networks | Enterprise IT, cloud and OT chapters |
If your staff use Microsoft 365 Copilot, ChatGPT or other AI tools, this principle gives leadership a clear reason to put policy, data controls and oversight in place. Our AI security and governance service helps you do that.
ASD Essentials is compatible with ASD’s Information Security Manual (ISM), and ASD’s assessment evidence guide lists controls from other frameworks that may serve as evidence, including ISO/IEC 27001 and NIST. If you run an ISO 27001 information security management system, we line up the two programs so the same evidence serves both.
Once the baseline is in place, ongoing work such as patch tracking often moves into vulnerability management or managed security, which helps progress hold between reviews.
ASD publishes the full guidance set at cyber.gov.au/essentials, with background in its announcement. Start with:
04The process
We brief your team, agree which environments are in scope (enterprise IT, cloud or both) and collect the evidence you already have.
We assess your controls against ASD's current maturity model and record your maturity, controls, risk results and key business functions as your transition baseline.
We map your assets to the Phase 1 domains and rate the effectiveness of each in-scope action.
You receive a gap view against the Phase 1 domains, a prioritised plan and a short summary for executives, and we walk your team through them.
We deliver the plan or guide your IT team or provider, then re-check each control once it is in place so you can show progress.
05Frameworks
Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.
| Control | ASD Essentials | ASD maturity model (current) | ISO/IEC 27001 | NIST CSF |
|---|---|---|---|---|
| Transition baseline | Governance and culture | Not applicable | A.5.36 | Identify (ID.IM-01) |
| Internet-facing services and patching | Boundary services | Patch applicationsPatch operating systems | A.8.8, A.8.20 | Identify (ID.RA-01) |
| Identity and privileged access review | Identity services | Multi-factor authenticationRestrict administrative privileges | A.5.15, A.8.2, A.8.5 | Protect (PR.AA-03); Protect (PR.AA-05) |
| Application control and hardening | Not applicable | Application controlRestrict Microsoft Office macrosUser application hardening | A.8.9, A.8.19 | Protect (PR.PS-01) |
| Backup and restore testing | Not applicable | Regular backups | A.8.13 | Protect (PR.DS-11) |
| Logging and incident response readiness | Visibility and response | Not applicable | A.5.24, A.8.15, A.8.16 | Detect (DE.CM-01); Respond |
| Executive accountability and reporting | Governance and culture | Not applicable | A.5.1, A.5.4 | Govern (GV.RR-01) |
06Pricing
Pricing
Quoted for your environment
What changes the price
Price depends on the number of environments, users, devices, sites and Microsoft 365 tenants in scope, whether AI tools are already in use, how much maturity evidence you already hold and whether we also deliver the uplift work.
07FAQ
Can't see your question? Ask a specialist and get a straight answer.
Ask a specialistThe ASD Essentials series is a principles-based cyber security framework from the Australian Signals Directorate. It sets the security outcomes an organisation should achieve, the actions that achieve them and the domains those actions apply to, with priority phases that set the order of work. It has chapters for enterprise IT, cloud and operational technology.
ASD has released the ASD Essentials series, which will replace the Essential Eight. The transition timeline hasn't been set, and the Essential Eight remains in use in the meantime. ASD has said it will advise on transition expectations in due course, and both frameworks stay on cyber.gov.au during the transition. Any specific start or end date you see quoted has not been published by ASD.
Yes. Until ASD sets a transition timeline, the Essential Eight remains in use, and it is still what many customers, insurers and tenders ask about. An Essential Eight assessment records your maturity for each of the eight strategies, with evidence. We use the same assessment as your ASD Essentials transition baseline, so the work counts twice.
No. ASD does not recommend slowing or stopping current uplift, and advises organisations to continue their programs while assessing alignment with the new framework. Every Essential Eight strategy maps to at least one ASD Essentials principle, so patching, MFA, admin privilege and backup work you finish now still reduces risk and carries forward.
Not automatically. ASD has said maturity levels from the current model do not automatically convert into ASD Essentials effectiveness ratings, because the two measure different things. The current model checks whether specific controls are implemented, while ASD Essentials rates whether actions are effective for the assets in each domain. Your evidence and controls still count, which is why a transition baseline matters.
The Phase 1 domains are boundary services, identity services, governance and culture, and visibility and response. ASD treats these as the first priority because work there delivers the greatest and quickest reduction in risk. Many of the assets the current model prioritises, such as internet-facing services and privileged access pathways, sit in these earlier phase domains.
ASD wrote the series primarily for Commonwealth entities, critical infrastructure and large organisations. Small and medium businesses can still use the guidance where relevant, and ASD says the security outcomes are equally important for smaller organisations. If you supply government or large customers, expect questions about it. ASD also publishes separate small business guidance on cyber.gov.au.
ASD Essentials treats AI as another asset, so AI systems must be included when you scope the domains. It also includes an Executive artificial intelligence accountability principle, which sets out what executives are accountable for when their organisation uses AI. ASD has published separate guidance on AI considerations within the Essentials to support this.
Talk to our team
No obligation. You talk to the people who do the work. Enquiries usually get a reply within 3 business days.
