ASD Essentials for Small Business: What Changed, What to Do First

ASD published ASD Essentials on 15 October 2026. It replaces maturity levels with priority phases, rates each security action on whether it actually works, groups your systems into eight domains and tells you to start with identity and internet-facing services. Here is what that means for a 5 to 200 person organisation, a 90-day plan and the evidence you will need.

What is ASD Essentials?

ASD launched ASD Essentials on 15 October 2026 and describes it as "an evolution of Australia’s widely adopted Essential Eight framework". During the transition ASD keeps both frameworks on cyber.gov.au. ASD Essentials is a series of chapters, each for a different kind of technology environment:

• Essentials for enterprise IT: organisations that run their own servers, networks or infrastructure, on premises or hosted.
• Essentials for cloud: organisations whose technology is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS).
• Essentials for operational technology (OT): industrial and critical infrastructure environments.

Every chapter uses the same three layers:

• Principles describe the security outcome you should achieve, such as "identity, credential and access management". They come from ASD’s Information Security Manual.
• Actions describe what you need to do to get there, such as "use phishing-resistant MFA for users authenticating to systems".
• Domains describe where each action applies: groups of business functions and systems that share similar risks.

There are eight domains. Two are capability domains that run across everything: Governance and culture and Visibility and response. Six are technical: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems and User devices (enterprise IT chapter).

What actually changed?

ASD’s transition guide has a table that translates the old concepts into the new ones. In plain terms:

Three changes matter most for a small organisation.

Old ratings don’t carry across. ASD says plainly that previous maturity level ratings "do not automatically translate" into the new ratings, because the two approaches assess different things. Your existing work still counts as evidence, and the transition guide says the investment "remains valuable", but you need a gap analysis.

Governance is now assessed. The Governance and culture domain includes executive accountability for cyber security, resourcing, risk management, supplier assurance, accountability for AI and managing legacy systems. Awareness training, content filtering and supply chain security also appear as principles with no direct equivalent in the old model.

Evidence has to show the control working. ASD’s assessment process guide puts it in four words: "Deployment is not effectiveness." A screenshot of an enabled policy is weak evidence. Sign-in logs showing the policy blocking attempts across every account are much stronger.

Does ASD Essentials apply to a small business?

ASD’s FAQ says the series is "written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations", and that small and medium businesses "can still use this guidance where relevant". ASD continues to publish separate guidance in its Small Business Hub.

So nobody is likely to audit a 15-person accounting practice against ASD Essentials out of the blue. It becomes relevant when:

• You supply government. Commonwealth entities still have to meet the PSPF 2026 requirements, which still specify Maturity Level Two under ASD’s earlier model. iTnews reported that agencies will be assessed against both frameworks next year. Agencies tend to push their own obligations down to suppliers, so expect tender questions to start naming ASD Essentials.
• A client, funder or insurer asks. Large clients use ASD’s frameworks as a yardstick for their supply chain, and ASD Essentials now includes supplier assurance as a principle.
• You want a sensible order of work. Even if no one asks, the priority phases are a free, evidence-based answer to "what should we fix first?"

ASD hasn’t published a deadline. Its FAQ says it will advise on transition expectations "in due course", and its launch notice tells organisations to keep meeting their current regulatory obligations until regulators say otherwise. ASD also does not recommend pausing uplift work already under way.

Which chapter should a small organisation use?

ASD’s guide Which chapter should I start with? gives a simple test:

ASD adds that "most organisations will need both chapters over time". Pick one to begin.

The cloud chapter is a good fit for many small organisations, and it marks every action with who typically does the work: C (you do it), S (the provider supplies the feature, but you must turn it on, configure it and run it) or P (the provider does it and you check their assurance). A common example: your email platform offers phishing-resistant sign-in methods, but they do nothing until you enforce them. ASD’s wording is blunt: "A capability that exists but has been left at an insecure default, or applied inconsistently, is not yet effective."

The same goes for your IT provider. ASD says outsourcing "does not transfer accountability". If your provider manages a control, you still need evidence that it is working.

Where do you stand? A quick self-check

Before you plan anything, take ten minutes to answer the 25 questions below honestly. The tool runs in your browser, sends nothing anywhere, and gives you a printable result for seven areas plus a "do these first" list in ASD’s priority order. It is our tool, not ASD’s, and its percentage is a simple unweighted indicator.

The first 90 days: a plan for a 5 to 200 person organisation

This plan follows ASD's own sequence: establish a baseline, scope the priority phase 1 domains, run a gap analysis, then deliver and measure (transition guide, implementation planning guide). It assumes a part-time owner, such as an office manager or IT lead, with help from your IT provider.

Days 1 to 30: baseline, ownership and scope

1. Name an accountable executive. ASD Essentials makes executive accountability an assessable action. In a small business this is usually the owner or a director. Check: a one-page note, signed by that person, saying who is accountable for cyber security, what level of risk the business accepts and when this will be reviewed.
2. Choose your chapter using the table above, and write down why. Check: one sentence in your notes, such as "Cloud chapter: no servers; all systems are SaaS."
3. List your phase 1 assets. You don't need a full asset register yet. ASD's planning guide says to scope only the phase 1 domains first.
   • Identity services: your identity provider or directory, password manager, single sign-on, and any admin accounts.
   • Boundary services: anything reachable from the internet, such as your firewall or router, VPN, remote access tools, website, customer portal, and third-party apps connected to your email or files. Check: a list you could hand to a stranger, with an owner named for each item.
4. Record what you already have. Pull together any past assessments, policies, your IT provider's reports, backup reports and insurance questionnaire answers. Check: a folder, dated, with each document named after what it shows.

Days 31 to 60: identity and the internet edge

1. Enforce phishing-resistant MFA for everyone, starting with admins. Codes sent by SMS and push approvals can be phished. Passkeys or security keys are the phishing-resistant options most small organisations can deploy. Check: a report from your identity provider listing every account and its sign-in method, with no account left without MFA.
2. Turn off legacy sign-in protocols that bypass MFA, or restrict and monitor them with a dated plan to remove them, as the action requires. Check: a sign-in report showing no successful legacy-protocol sign-ins in the past 30 days.
3. Clean up accounts. Remove default, unused and former-staff accounts. Separate admin accounts from everyday accounts, and give staff only the access their role needs. Check: an exported user list reviewed and signed off, with the date.
4. Review connected apps. The cloud chapter asks you to assess and approve applications, integrations and consent grants before they get access. Remove anything nobody can explain. Check: a short register of approved integrations with an owner for each.
5. Patch and test what faces the internet. Firewalls, VPNs and remote access tools are common ways in. Confirm they are supported, patched and not exposing admin pages. An external vulnerability scan or external penetration test gives independent evidence that ASD's evidence model rates highly. Check: scan or test results dated within the review period, with findings closed or risk-accepted.

Days 61 to 90: visibility, response and your first report

1. Centralise and keep logs for sign-ins, admin actions and changes to security settings, protected from deletion. Check: you can answer "who changed this admin setting last month?" in under ten minutes.
2. Write and test a short incident response procedure covering an account takeover and a provider-side incident. Check: notes from a 45-minute tabletop exercise, with actions assigned.
3. Prove your backups. Back up important data, keep copies isolated from everyday accounts, and test a restore against the recovery time you have agreed. Check: a restore test record with the date, what was restored and how long it took.
4. Run your gap analysis and report. For each phase 1 action, classify it as already effectively addressed, partially addressed or not addressed (ASD's gap-analysis terms). Then give the accountable executive a one-page summary listing what is done, what isn't, and what has been deliberately left as not assessed. Check: the executive has read it and signed off the next 90 days.

Awareness training and AI governance can start in parallel. The cloud chapter even asks for executive approval before you switch on AI features inside your SaaS tools.

The evidence checklist

ASD's guidance asks assessors to weigh four things for every action: coverage (all relevant assets), consistency (applied the same way everywhere), currency (recent enough to reflect today) and evidence quality. Use this table to upgrade weak evidence before anyone asks for it.

Two notes from the assessment guide. First, ASD rates a principle by its lowest action rating, so one weak action pulls the whole principle down. Second, each domain gets a percentage: fully effective scores 1, partially effective 0.5 and not effective 0, divided by the number of principles that apply. Five fully effective, four partial and one not effective gives 70%. That is a simple number to track from one review to the next.

Common misconceptions

"ASD Essentials is mandatory for my business now." Not for a typical private business. It is guidance, and ASD has not set a transition date. Contracts, tenders and regulators decide what you must do, and ASD says to keep meeting existing obligations until they change.

"We were at Maturity Level Two, so we are done." ASD says previous ratings do not automatically convert, and even Maturity Level Three organisations need a gap analysis. Your past work is evidence, not a rating.

"Phase 1 is the new Level One." No. Priority phases are an order of work, not a measure of security. ASD's planning guide says completing a phase does not tell you that you are secure.

"Our IT provider does all this." Accountability stays with you. You need evidence for each action your provider runs, and settings your provider offers but hasn't enabled count as not done.

"We should restart from scratch." ASD says existing investment carries forward and does not recommend pausing current uplift programs. Map what you have, then fill the gaps.

Key takeaways

• ASD Essentials replaces maturity levels with per-action effectiveness ratings across eight domains, ordered into three priority phases.
• Small organisations aren't its main audience, but government suppliers and anyone answering security questionnaires should start mapping to it now.
• Use the cloud chapter if you run no servers, and enterprise IT if you do. Most organisations will eventually need both.
• Spend the first 90 days on accountability, identity, internet-facing services, logging, incident response and proven backups.
• Collect evidence that shows controls working over time, not just switched on, and report "not assessed" honestly.
• Start with the self-check above. For help with the gap analysis, see our ASD Essentials readiness service; for how it fits with other frameworks, see SMB1001 vs ASD Essentials vs ISO 27001.

Sources

• ASD, ASD Essentials: evolving our approach to cyber security resilience (15 October 2026)
• ASD's ACSC, What is the Essentials?
• ASD's ACSC, Essentials for enterprise IT
• ASD's ACSC, Essentials for cloud
• ASD's ACSC, Which chapter should I start with?
• ASD's ACSC, Transition guide
• ASD's ACSC, Implementation planning guide
• ASD's ACSC, Assessment process guide
• ASD's ACSC, ASD Essentials frequently asked questions
• Department of Home Affairs, PSPF Release 2026: list of requirements
• iTnews, report on the ASD Essentials launch and transition (15 October 2026, secondary source)