{"id":1236,"date":"2026-10-16T09:00:00","date_gmt":"2026-10-15T22:00:00","guid":{"rendered":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/"},"modified":"2026-11-03T21:46:34","modified_gmt":"2026-11-03T10:46:34","slug":"asd-essentials-small-business","status":"publish","type":"post","link":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/","title":{"rendered":"ASD Essentials for Small Business: What Changed, What to Do First"},"content":{"rendered":"\n<p class=\"has-pale-cyan-blue-background-color has-background wp-block-paragraph\">ASD published ASD Essentials on 15 October 2026. It replaces maturity levels with priority phases, rates each security action on whether it actually works, groups your systems into eight domains and tells you to start with identity and internet-facing services. Here is what that means for a 5 to 200 person organisation, a 90-day plan and the evidence you will need.<\/p>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Related guides<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/\" target=\"_blank\" rel=\"noreferrer noopener\">SMB1001 vs ASD Essentials vs ISO 27001: Which Do You Need?<\/a><\/li>\n\n\n<li><a href=\"https:\/\/catharsis.net.au\/blog\/iso-27001-certification-process\/\" target=\"_blank\" rel=\"noreferrer noopener\">How Does ISO 27001 Certification Work? Stages, Documents, Audits<\/a><\/li>\n\n\n<li><a href=\"https:\/\/catharsis.net.au\/blog\/what-is-internal-external-penetration-testing\/\" target=\"_blank\" rel=\"noreferrer noopener\">What is Internal &amp; External Penetration Testing?<\/a><\/li>\n\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h3 class=\"wp-block-heading\">TL;DR<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>ASD Essentials is the Australian Signals Directorate&#8217;s new cyber security framework, published on 15 October 2026. For a small organisation it changes the question from &quot;which level are we?&quot; to &quot;is each security action actually working, and can we show it?&quot;<\/li>\n\n\n<li>It is written mainly for Commonwealth entities, critical infrastructure and large organisations, but ASD says smaller organisations can use it. Government suppliers and anyone asked about it in a tender should get familiar with it now.<\/li>\n\n\n<li>There are three chapters. If you run no servers of your own and work entirely in cloud services, the <strong>cloud chapter<\/strong> is your starting point. With on-premises or hybrid systems, start with <strong>enterprise IT<\/strong>.<\/li>\n\n\n<li>Start where ASD says: identity (accounts, sign-in, admin access) and internet-facing services, plus basic governance and the ability to spot and respond to incidents.<\/li>\n\n\n<li>Collect evidence as you go. A setting that is switched on is not proof it works. ASD&#8217;s assessors look for coverage, consistency, currency and evidence quality.<\/li>\n\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<div class=\"wp-block-group has-background\" style=\"background-color:#f4f6f8;padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h3 class=\"wp-block-heading\">In this post<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"#what-is-asd-essentials\">What is ASD Essentials?<\/a><\/li>\n\n\n<li><a href=\"#what-actually-changed\">What actually changed?<\/a><\/li>\n\n\n<li><a href=\"#does-asd-essentials-apply-to-a-small-business\">Does ASD Essentials apply to a small business?<\/a><\/li>\n\n\n<li><a href=\"#which-chapter-should-a-small-organisation-use\">Which chapter should a small organisation use?<\/a><\/li>\n\n\n<li><a href=\"#where-do-you-stand-a-quick-self-check\">Where do you stand? A quick self-check<\/a><\/li>\n\n\n<li><a href=\"#the-first-90-days-a-plan-for-a-5-to-200-person-organisation\">The first 90 days: a plan for a 5 to 200 person organisation<\/a><\/li>\n\n\n<li><a href=\"#the-evidence-checklist\">The evidence checklist<\/a><\/li>\n\n\n<li><a href=\"#common-misconceptions\">Common misconceptions<\/a><\/li>\n\n\n<li><a href=\"#key-takeaways\">Key takeaways<\/a><\/li>\n\n\n<li><a href=\"#sources\">Sources<\/a><\/li>\n\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-is-asd-essentials\">What is ASD Essentials?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ASD <a href=\"https:\/\/www.asd.gov.au\/news\/2026-10-15-asd-essentials-evolving-our-approach-cyber-security-resilience\" target=\"_blank\" rel=\"noreferrer noopener\">launched ASD Essentials on 15 October 2026<\/a> and describes it as &quot;an evolution of Australia&#8217;s widely adopted Essential Eight framework&quot;. During the transition ASD keeps both frameworks on cyber.gov.au. ASD Essentials is a series of chapters, each for a different kind of technology environment:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Essentials for enterprise IT<\/strong>: organisations that run their own servers, networks or infrastructure, on premises or hosted.<\/li>\n\n\n<li><strong>Essentials for cloud<\/strong>: organisations whose technology is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS).<\/li>\n\n\n<li><strong>Essentials for operational technology (OT)<\/strong>: industrial and critical infrastructure environments.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Every chapter uses <a href=\"https:\/\/www.cyber.gov.au\/publication\/what-is-the-essentials\" target=\"_blank\" rel=\"noreferrer noopener\">the same three layers<\/a>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Principles<\/strong> describe the security outcome you should achieve, such as &quot;identity, credential and access management&quot;. They come from ASD&#8217;s Information Security Manual.<\/li>\n\n\n<li><strong>Actions<\/strong> describe what you need to do to get there, such as &quot;use phishing-resistant MFA for users authenticating to systems&quot;.<\/li>\n\n\n<li><strong>Domains<\/strong> describe where each action applies: groups of business functions and systems that share similar risks.<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">There are eight domains. Two are capability domains that run across everything: <strong>Governance and culture<\/strong> and <strong>Visibility and response<\/strong>. Six are technical: <strong>Boundary services<\/strong>, <strong>Identity services<\/strong>, <strong>Critical processes and services<\/strong>, <strong>Privileged environments<\/strong>, <strong>Business systems<\/strong> and <strong>User devices<\/strong> (<a href=\"https:\/\/www.cyber.gov.au\/publication\/essentials-for-enterprise-it\" target=\"_blank\" rel=\"noreferrer noopener\">enterprise IT chapter<\/a>).<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-actually-changed\">What actually changed?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ASD&#8217;s <a href=\"https:\/\/www.cyber.gov.au\/publication\/transitioning-from-the-essential-eight\" target=\"_blank\" rel=\"noreferrer noopener\">transition guide<\/a> has a table that translates the old concepts into the new ones. In plain terms:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th>Before<\/th>\n<th>Now<\/th>\n<th>What it means for you<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Eight mitigation strategies with requirements<\/td>\n<td>Principles supported by actions<\/td>\n<td>One old strategy can feed several principles. Patching, for example, now sits under vulnerability management, asset identification and legacy system management.<\/td>\n<\/tr>\n<tr>\n<td>Maturity levels One to Three<\/td>\n<td>Priority phases 1 to 3<\/td>\n<td>Phases set the order of work. They are not a rating, and you don&#8217;t pick a target level any more.<\/td>\n<\/tr>\n<tr>\n<td>One implementation across the whole environment<\/td>\n<td>Eight domains<\/td>\n<td>The same control can be fully effective in one domain and partial in another.<\/td>\n<\/tr>\n<tr>\n<td>Assessment against specific requirements<\/td>\n<td>Four ratings per action: not assessed, not effective, partially effective, fully effective<\/td>\n<td>&quot;Not assessed&quot; is neutral. It means you haven&#8217;t looked yet, not that you failed.<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Three changes matter most for a small organisation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Old ratings don&#8217;t carry across.<\/strong> ASD says plainly that previous maturity level ratings &quot;do not automatically translate&quot; into the new ratings, because the two approaches assess different things. Your existing work still counts as evidence, and the transition guide says the investment &quot;remains valuable&quot;, but you need a gap analysis.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Governance is now assessed.<\/strong> The Governance and culture domain includes executive accountability for cyber security, resourcing, risk management, supplier assurance, accountability for AI and managing legacy systems. Awareness training, content filtering and supply chain security also appear as principles with no direct equivalent in the old model.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Evidence has to show the control working.<\/strong> ASD&#8217;s <a href=\"https:\/\/www.cyber.gov.au\/publication\/assessment-process-guide\" target=\"_blank\" rel=\"noreferrer noopener\">assessment process guide<\/a> puts it in four words: &quot;Deployment is not effectiveness.&quot; A screenshot of an enabled policy is weak evidence. Sign-in logs showing the policy blocking attempts across every account are much stronger.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"does-asd-essentials-apply-to-a-small-business\">Does ASD Essentials apply to a small business?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ASD&#8217;s <a href=\"https:\/\/www.cyber.gov.au\/publication\/frequently-asked-questions\" target=\"_blank\" rel=\"noreferrer noopener\">FAQ<\/a> says the series is &quot;written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations&quot;, and that small and medium businesses &quot;can still use this guidance where relevant&quot;. ASD continues to publish separate guidance in its <a href=\"https:\/\/www.cyber.gov.au\/small-business-hub\" target=\"_blank\" rel=\"noreferrer noopener\">Small Business Hub<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So nobody is likely to audit a 15-person accounting practice against ASD Essentials out of the blue. It becomes relevant when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>You supply government.<\/strong> Commonwealth entities still have to meet the <a href=\"https:\/\/www.protectivesecurity.gov.au\/system\/files\/2026-07\/pspf-release-2026-list-requirements_0.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">PSPF 2026 requirements<\/a>, which still specify Maturity Level Two under ASD&#8217;s earlier model. iTnews <a href=\"https:\/\/www.itnews.com.au\/news\/asds-essential-eight-replacement-moves-away-from-maturity-ladder-629637\" target=\"_blank\" rel=\"noreferrer noopener\">reported<\/a> that agencies will be assessed against both frameworks next year. Agencies tend to push their own obligations down to suppliers, so expect tender questions to start naming ASD Essentials.<\/li>\n\n\n<li><strong>A client, funder or insurer asks.<\/strong> Large clients use ASD&#8217;s frameworks as a yardstick for their supply chain, and ASD Essentials now includes supplier assurance as a principle.<\/li>\n\n\n<li><strong>You want a sensible order of work.<\/strong> Even if no one asks, the priority phases are a free, evidence-based answer to &quot;what should we fix first?&quot;<\/li>\n\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">ASD hasn&#8217;t published a deadline. Its FAQ says it will advise on transition expectations &quot;in due course&quot;, and its launch notice tells organisations to keep meeting their current regulatory obligations until regulators say otherwise. ASD also does not recommend pausing uplift work already under way.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"which-chapter-should-a-small-organisation-use\">Which chapter should a small organisation use?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ASD&#8217;s guide <a href=\"https:\/\/www.cyber.gov.au\/publication\/which-chapter-should-i-start-with\" target=\"_blank\" rel=\"noreferrer noopener\">Which chapter should I start with?<\/a> gives a simple test:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th>Your setup<\/th>\n<th>Start with<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Everything is cloud: email, files and line-of-business apps are all subscriptions, and there are no servers to patch<\/td>\n<td>Essentials for cloud<\/td>\n<\/tr>\n<tr>\n<td>A server in the office or a data centre, a hosted virtual machine, an on-premises network you manage, or a mix of cloud and on-premises<\/td>\n<td>Essentials for enterprise IT<\/td>\n<\/tr>\n<tr>\n<td>You build and run your own applications on a cloud platform (a customer portal, for example)<\/td>\n<td>Essentials for cloud, using the PaaS markings<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">ASD adds that &quot;most organisations will need both chapters over time&quot;. Pick one to begin.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The cloud chapter is a good fit for many small organisations, and it marks every action with who typically does the work: <strong>C<\/strong> (you do it), <strong>S<\/strong> (the provider supplies the feature, but you must turn it on, configure it and run it) or <strong>P<\/strong> (the provider does it and you check their assurance). A common example: your email platform offers phishing-resistant sign-in methods, but they do nothing until you enforce them. ASD&#8217;s wording is blunt: &quot;A capability that exists but has been left at an insecure default, or applied inconsistently, is not yet effective.&quot;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same goes for your IT provider. ASD says outsourcing &quot;does not transfer accountability&quot;. If your provider manages a control, you still need evidence that it is working.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"where-do-you-stand-a-quick-self-check\">Where do you stand? A quick self-check<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before you plan anything, take ten minutes to answer the 25 questions below honestly. The tool runs in your browser, sends nothing anywhere, and gives you a printable result for seven areas plus a &quot;do these first&quot; list in ASD&#8217;s priority order. It is our tool, not ASD&#8217;s, and its percentage is a simple unweighted indicator.<\/p>\n\n\n\n<div id=\"cat-asd-check\">\n<style>\n#cat-asd-check{background:#f4f6f8;border-radius:12px;padding:20px;margin:8px 0 24px;color:#22272c;font-size:16px;line-height:1.5}\n#cat-asd-check *{box-sizing:border-box}\n#cat-asd-check h2{font-size:22px;margin:0 0 8px}\n#cat-asd-check h3{font-size:19px;margin:22px 0 2px}\n#cat-asd-check .cat-asd-warn{background:#fff7e0;border:1px solid #e0b84d;border-radius:8px;padding:10px 12px;font-weight:600;margin:12px 0}\n#cat-asd-check .cat-asd-kind{display:block;font-size:13px;color:#55606b;font-weight:400;margin:0 0 6px}\n#cat-asd-check fieldset{border:1px solid #dde3ea;border-radius:10px;background:#fff;padding:12px 14px;margin:10px 0;min-width:0}\n#cat-asd-check legend{font-weight:600;padding:0;float:left;width:100%;margin:0 0 8px}\n#cat-asd-check .cat-asd-num{color:#55606b}\n#cat-asd-check .cat-asd-opts{clear:both;display:flex;flex-wrap:wrap;gap:8px}\n#cat-asd-check .cat-asd-opts label{display:inline-flex;align-items:center;gap:6px;border:1px solid #b8c2cc;border-radius:999px;padding:6px 14px;background:#fff;cursor:pointer;font-size:15px}\n#cat-asd-check .cat-asd-opts input{width:18px;height:18px;margin:0}\n#cat-asd-check .cat-asd-opts label:has(input:checked){background:#e8f0fa;border-color:#0a5fb4;font-weight:600}\n#cat-asd-check .cat-asd-ref{font-size:12px;color:#55606b;margin:8px 0 0}\n#cat-asd-check input:focus-visible,#cat-asd-check button:focus-visible,#cat-asd-check a:focus-visible{outline:3px solid #0a66c2;outline-offset:2px}\n#cat-asd-check .cat-asd-opts label:focus-within{outline:3px solid #0a66c2;outline-offset:1px}\n#cat-asd-check .cat-asd-results{background:#fff;border:2px solid #32373c;border-radius:12px;padding:16px;margin:24px 0 0}\n#cat-asd-check .cat-asd-overall{font-size:19px;font-weight:700;margin:4px 0 8px}\n#cat-asd-check .cat-asd-progress{font-size:14px;color:#55606b;margin:0}\n#cat-asd-check table{width:100%;border-collapse:collapse;margin-top:10px;font-size:15px}\n#cat-asd-check th,#cat-asd-check td{padding:7px 8px;border-bottom:1px solid #e3e8ee;text-align:left;vertical-align:top;overflow-wrap:anywhere}\n#cat-asd-check thead th{font-size:13px;color:#55606b}\n#cat-asd-check .cat-asd-pct{font-weight:700;display:inline-block;min-width:3em}\n#cat-asd-check .cat-asd-bar{display:block;height:8px;background:#e3e8ee;border-radius:4px;margin-top:4px;max-width:160px}\n#cat-asd-check .cat-asd-fill{display:block;height:8px;background:#0a5fb4;border-radius:4px}\n#cat-asd-check ol{padding-left:22px;margin:8px 0}\n#cat-asd-check ol li{margin:0 0 10px}\n#cat-asd-check .cat-asd-meta{display:block;font-size:14px;color:#55606b}\n#cat-asd-check .cat-asd-actions{display:flex;flex-wrap:wrap;gap:8px;margin:14px 0 0}\n#cat-asd-check button{font-size:15px;padding:8px 16px;border:1px solid #32373c;border-radius:999px;background:#32373c;color:#fff;cursor:pointer}\n#cat-asd-check button.cat-asd-secondary{background:#fff;color:#32373c}\n#cat-asd-check .cat-asd-link{width:100%;margin-top:8px;font-size:14px;padding:8px;border:1px solid #b8c2cc;border-radius:8px;font-family:ui-monospace,Menlo,Consolas,monospace}\n#cat-asd-check .cat-asd-status{font-size:14px;min-height:1.4em;margin:6px 0 0}\n#cat-asd-check .cat-asd-note{font-size:14px;color:#55606b}\n#cat-asd-check .cat-asd-print-only{display:none}\n@media (max-width:480px){#cat-asd-check{padding:14px}#cat-asd-check th,#cat-asd-check td{padding:6px 4px;font-size:14px}}\n@media print{\nhtml.cat-asd-printing body *{visibility:hidden}\nhtml.cat-asd-printing #cat-asd-check,html.cat-asd-printing #cat-asd-check *{visibility:visible}\nhtml.cat-asd-printing #cat-asd-check{position:absolute;left:0;top:0;width:100%;background:#fff;padding:0;margin:0}\n#cat-asd-check .cat-asd-noprint{display:none}\n#cat-asd-check .cat-asd-print-only{display:block}\n#cat-asd-check .cat-asd-results{border:0;padding:0}\n#cat-asd-check .cat-asd-fill{background:#000;print-color-adjust:exact;-webkit-print-color-adjust:exact}\n#cat-asd-check a{color:#000}\n}\n<\/style>\n<h2>ASD Essentials readiness check<\/h2>\n<p>Answer 25 questions about your organisation. Each one is based on an action in ASD Essentials for enterprise IT, written in plain English for a small organisation. Answer Yes if it is fully in place and you could show evidence, Partly if it is in place but with gaps, and No if it is not in place or you are unsure.<\/p>\n<p class=\"cat-asd-warn\" role=\"note\">Indicative only. General information, not legal advice or a formal assessment. Your answers stay in your browser: nothing is sent or saved.<\/p>\n<div id=\"cat-asd-questions\" class=\"cat-asd-noprint\"><\/div>\n<div class=\"cat-asd-results\" id=\"cat-asd-results\">\n<h3>Your indicative results<\/h3>\n<p class=\"cat-asd-progress\" id=\"cat-asd-progress\"><\/p>\n<p class=\"cat-asd-overall\" id=\"cat-asd-overall\" aria-live=\"polite\"><\/p>\n<table id=\"cat-asd-areas\"><thead><tr><th scope=\"col\">Area<\/th><th scope=\"col\">Score<\/th><th scope=\"col\">Lowest answer<\/th><\/tr><\/thead><tbody><\/tbody><\/table>\n<p class=\"cat-asd-note\">Score: Yes counts 2, Partly 1 and No 0, as a percentage of the answered questions. &#8220;Lowest answer&#8221; follows ASD&#8217;s approach, where a principle is only as effective as its weakest action.<\/p>\n<h3>Do these first<\/h3>\n<p class=\"cat-asd-note\">Ordered the way ASD recommends: boundary and identity services, governance and visibility first, then privileged environments and critical systems, then everyday business systems and devices. Within each step, No comes before Partly.<\/p>\n<ol id=\"cat-asd-priorities\"><\/ol>\n<p id=\"cat-asd-prio-empty\" class=\"cat-asd-note\"><\/p>\n<p id=\"cat-asd-more\" class=\"cat-asd-note\"><\/p>\n<div class=\"cat-asd-print-only\"><h3>Your answers<\/h3><ol id=\"cat-asd-answers\"><\/ol><\/div>\n<div class=\"cat-asd-actions cat-asd-noprint\">\n<button type=\"button\" id=\"cat-asd-print\">Print or save summary<\/button>\n<button type=\"button\" id=\"cat-asd-share\" class=\"cat-asd-secondary\">Copy a link with my answers<\/button>\n<button type=\"button\" id=\"cat-asd-reset\" class=\"cat-asd-secondary\">Clear answers<\/button>\n<\/div>\n<div id=\"cat-asd-linkbox\" class=\"cat-asd-noprint\" hidden><label for=\"cat-asd-link\" class=\"cat-asd-note\">Share link (your answers are in the part after the #)<\/label>\n<input id=\"cat-asd-link\" class=\"cat-asd-link\" type=\"text\" readonly><\/div>\n<p id=\"cat-asd-status\" class=\"cat-asd-status cat-asd-noprint\" role=\"status\"><\/p>\n<\/div>\n<p class=\"cat-asd-note\">Source: ASD, <a href=\"https:\/\/www.cyber.gov.au\/essentials\" target=\"_blank\" rel=\"noopener noreferrer\">ASD Essentials<\/a> (cyber.gov.au), including ASD Essentials for enterprise IT, published October 2026. ASD writes the Essentials mainly for larger organisations and says the outcomes are equally important for smaller ones. This check is not an ASD tool and does not replace ASD&#8217;s assessment process.<\/p>\n<script>\n(function () {\n  'use strict';\n  \/\/ Catharsis ASD Essentials readiness check. Runs entirely in the browser: no network requests, no storage, no eval.\n  \/\/ DOM is built with createElement and textContent only. Answers never leave the page; a share link is\n  \/\/ only built when the reader asks for one, and a link's #r= value is validated like typed input.\n  \/\/ No ampersand characters anywhere in this file: WordPress rewrites them in post content.\n\n  \/\/ Areas follow the eight domains of \"ASD Essentials for enterprise IT\" (ASD, October 2026), with the two\n  \/\/ phase 3 domains combined for small organisations. Phase 0 marks the two capability domains, which ASD\n  \/\/ says apply across all phases; they are prioritised alongside phase 1.\n  var AREAS = [\n    { id: 'gov', name: 'Governance and culture', kind: 'Capability domain', phase: 0 },\n    { id: 'bnd', name: 'Boundary services', kind: 'Priority phase 1', phase: 1 },\n    { id: 'idn', name: 'Identity services', kind: 'Priority phase 1', phase: 1 },\n    { id: 'prv', name: 'Privileged environments', kind: 'Priority phase 2', phase: 2 },\n    { id: 'crt', name: 'Critical processes and services', kind: 'Priority phase 2', phase: 2 },\n    { id: 'usr', name: 'Business systems and user devices', kind: 'Priority phase 3', phase: 3 },\n    { id: 'vis', name: 'Visibility and response', kind: 'Capability domain', phase: 0 }\n  ];\n\n  var QUESTIONS = [\n    { id: 'gov1', area: 'gov', ref: 'GOV-01', q: 'Is a named senior person (an owner, director or executive) accountable for cyber security, and do they review cyber risk at a set interval?',\n      fix: 'Name an executive owner for cyber security, agree how much cyber risk the business will accept, and book a recurring review.' },\n    { id: 'gov2', area: 'gov', ref: 'GOV-08', q: 'Is someone accountable for how staff use AI tools, with a written rule on what information can go into them?',\n      fix: 'Make one executive accountable for AI use and write a short rule on approved AI tools and what data may be used with them.' },\n    { id: 'gov3', area: 'gov', ref: 'GOV-11', q: 'Do you check the security of key suppliers (your IT provider, cloud apps and software vendors) before signing up, and keep checking?',\n      fix: 'List your key suppliers, ask each for evidence of their security, record what they are responsible for, and recheck when things change.' },\n    { id: 'gov4', area: 'gov', ref: 'GOV-14', q: 'Do you know which systems are old or no longer supported by their vendor, and do they have extra protection and a plan to replace them?',\n      fix: 'Identify unsupported systems, add compensating controls and monitoring, and set a date to remove or replace each one.' },\n    { id: 'gov5', area: 'gov', ref: 'PRO-14', q: 'Do all staff get security awareness training before they are given access, refreshed regularly to cover current scams?',\n      fix: 'Train every person before they get access, tailor it to their role, and refresh it regularly with current threats.' },\n\n    { id: 'bnd1', area: 'bnd', ref: 'IDE-01', q: 'Do you have a current list of everything that faces the internet: firewall, VPN or remote access, website, email and any exposed servers?',\n      fix: 'Build and maintain an inventory of every internet-facing service and edge device, including ones a supplier runs for you.' },\n    { id: 'bnd2', area: 'bnd', ref: 'PRO-06', q: 'Are security updates for internet-facing devices and services applied within defined, risk-based timeframes, or automatically?',\n      fix: 'Patch internet-facing devices and services first, within timeframes set by risk, and turn on automatic updates where the impact is low.' },\n    { id: 'bnd3', area: 'bnd', ref: 'PRO-04', q: 'Are internet-facing systems locked down: unused services and ports closed, default settings changed, and remote desktop not open directly to the internet?',\n      fix: 'Apply a hardened configuration to edge devices, close unused services and put remote access behind a secured gateway with MFA.' },\n    { id: 'bnd4', area: 'bnd', ref: 'PRO-09', q: 'Is incoming email and web content filtered to block malicious attachments, links and known bad sites?',\n      fix: 'Filter inbound email and web traffic for malicious content, and block connections to known malicious destinations.' },\n\n    { id: 'idn1', area: 'idn', ref: 'PRO-13', q: 'Does everyone use phishing-resistant multi-factor authentication (such as passkeys or security keys) for email, cloud apps and remote access? Answer \"Partly\" if you use app codes or SMS.',\n      fix: 'Turn on MFA for every user and move to phishing-resistant methods such as passkeys or security keys, starting with admins and remote access.' },\n    { id: 'idn2', area: 'idn', ref: 'PRO-13', q: 'Are older sign-in methods that can skip MFA (legacy authentication protocols) turned off?',\n      fix: 'Disable legacy authentication. Where you cannot yet, restrict and monitor it and set a date to switch it off.' },\n    { id: 'idn3', area: 'idn', ref: 'PRO-13', q: 'Are leavers\u2019 accounts, and unused or default accounts, disabled or removed promptly and checked regularly?',\n      fix: 'Disable accounts on the day someone leaves and regularly review for unused or default accounts.' },\n    { id: 'idn4', area: 'idn', ref: 'PRO-13', q: 'Is every password unique, with shared and service passwords kept in an approved password manager or vault protected by MFA?',\n      fix: 'Use an approved password manager or vault protected by MFA, and make every password unique, especially for admin accounts.' },\n\n    { id: 'prv1', area: 'prv', ref: 'PRO-12', q: 'Do only the people who need admin rights have them, using a separate admin account rather than their everyday account?',\n      fix: 'Remove admin rights from everyday accounts and give a separate admin account only to the people who need one.' },\n    { id: 'prv2', area: 'prv', ref: 'PRO-05', q: 'Is admin work done from a dedicated, hardened device or environment that is not used for email and web browsing?',\n      fix: 'Do admin work only from a dedicated, hardened device or environment that is kept apart from email and browsing.' },\n    { id: 'prv3', area: 'prv', ref: 'PRO-12', q: 'Are access rights reviewed regularly, and are admin changes recorded (who made them, when and to what)?',\n      fix: 'Review who has access to what at a set interval, and log every admin change with the user, time and target.' },\n\n    { id: 'crt1', area: 'crt', ref: 'PRO-10', q: 'Are important data, applications and settings backed up on a defined schedule to storage that is encrypted and offline, immutable or otherwise isolated?',\n      fix: 'Back up important data, applications and settings on a schedule to encrypted storage that ransomware cannot reach or change.' },\n    { id: 'crt2', area: 'crt', ref: 'PRO-10', q: 'Have you tested restoring from backup, and does a restore meet how quickly you need to be running again?',\n      fix: 'Test restores regularly and confirm they meet your recovery time and recovery point objectives.' },\n    { id: 'crt3', area: 'crt', ref: 'PRO-18', q: 'Are your most important systems separated on the network from everyday devices and guest Wi-Fi, with only approved connections allowed?',\n      fix: 'Segment the network by trust level and allow only approved connections to critical systems.' },\n\n    { id: 'usr1', area: 'usr', ref: 'PRO-06', q: 'Are operating systems and applications on computers and phones updated within defined timeframes, or automatically?',\n      fix: 'Set defined patching timeframes for devices and applications, turn on automatic updates, and replace unsupported software.' },\n    { id: 'usr2', area: 'usr', ref: 'PRO-07', q: 'Can only approved software run on staff computers (application control), with any exceptions documented and reviewed?',\n      fix: 'Allow only approved software to run, and keep exceptions few, documented, time-limited and reviewed.' },\n    { id: 'usr3', area: 'usr', ref: 'PRO-04', q: 'Do computers follow a hardened standard setup, for example macros in documents from the internet blocked and unneeded features turned off?',\n      fix: 'Define a hardened standard build from vendor guidance, deploy it to every device and check for drift.' },\n\n    { id: 'vis1', area: 'vis', ref: 'DET-01', q: 'Are security logs from key systems collected in one central place where they cannot be altered or deleted?',\n      fix: 'Forward security-relevant logs from key systems and cloud services to central storage that is protected from tampering.' },\n    { id: 'vis2', area: 'vis', ref: 'DET-03', q: 'Does someone watch for security alerts (unusual sign-ins, unexpected changes, suspicious software) and triage them promptly?',\n      fix: 'Make someone responsible for monitoring alerts and triaging them in a timely way, in-house or through a provider.' },\n    { id: 'vis3', area: 'vis', ref: 'RES-03', q: 'Do you have a written, tested incident response plan that covers who to call and your reporting obligations?',\n      fix: 'Write an incident response plan, include who to call and what you must report, and test it with a tabletop exercise.' }\n  ];\n\n  var MAX_PRIORITIES = 8;\n  var POINTS = { y: 2, p: 1, n: 0 };\n  var ANSWER_TEXT = { y: 'Yes', p: 'Partly', n: 'No' };\n  var RATING = { y: 'Fully effective', p: 'Partially effective', n: 'Not effective' };\n  var HASH_RE = new RegExp('^r=[ypn-]{' + QUESTIONS.length + '}$');\n\n  function areaById(id) { for (var i = 0; i < AREAS.length; i++) { if (AREAS[i].id === id) return AREAS[i]; } return null; }\n  function has(obj, key) { return Object.prototype.hasOwnProperty.call(obj, key); }\n\n  \/** Keep only known question ids with a y\/p\/n value. Anything else is ignored. *\/\n  function clean(answers) {\n    var out = {};\n    if (!answers) return out;\n    if (typeof answers !== 'object') return out;\n    for (var i = 0; i < QUESTIONS.length; i++) {\n      var id = QUESTIONS[i].id;\n      if (has(answers, id)) {\n        var v = answers[id];\n        if (v === 'y' || v === 'p' || v === 'n') out[id] = v;\n      }\n    }\n    return out;\n  }\n\n  function encode(answers) {\n    var a = clean(answers), s = '';\n    for (var i = 0; i < QUESTIONS.length; i++) s += has(a, QUESTIONS[i].id) ? a[QUESTIONS[i].id] : '-';\n    return 'r=' + s;\n  }\n\n  \/** Parse a location.hash value (\"#r=ypn-...\"). Returns an answers object or null when invalid. *\/\n  function decode(hash) {\n    var h = String(hash === undefined || hash === null ? '' : hash);\n    if (h.length > 200) return null;\n    if (h.charAt(0) === '#') h = h.slice(1);\n    if (!HASH_RE.test(h)) return null;\n    var body = h.slice(2), out = {};\n    for (var i = 0; i < QUESTIONS.length; i++) { var c = body.charAt(i); if (c !== '-') out[QUESTIONS[i].id] = c; }\n    return out;\n  }\n\n  function band(pct) {\n    if (pct === null) return 'Not answered yet';\n    if (pct >= 80) return 'Strong foundations';\n    if (pct >= 50) return 'Partly in place';\n    return 'Needs attention';\n  }\n\n  function score(answers) {\n    var a = clean(answers);\n    var areas = [], totalPts = 0, totalAns = 0, priorities = [];\n    for (var i = 0; i < AREAS.length; i++) {\n      var ar = AREAS[i], pts = 0, ans = 0, count = 0, lowest = null;\n      for (var j = 0; j < QUESTIONS.length; j++) {\n        var q = QUESTIONS[j];\n        if (q.area !== ar.id) continue;\n        count++;\n        if (!has(a, q.id)) continue;\n        var v = a[q.id];\n        pts += POINTS[v]; ans++;\n        if (lowest === null) lowest = v; else if (POINTS[v] < POINTS[lowest]) lowest = v;\n      }\n      var pct = ans ? Math.round(pts \/ (ans * 2) * 100) : null;\n      areas.push({ id: ar.id, name: ar.name, kind: ar.kind, phase: ar.phase, questions: count, answered: ans, pct: pct, band: band(pct),\n        rating: lowest === null ? 'Not assessed' : RATING[lowest] });\n      totalPts += pts; totalAns += ans;\n    }\n    for (var k = 0; k < QUESTIONS.length; k++) {\n      var qq = QUESTIONS[k];\n      if (!has(a, qq.id)) continue;\n      if (a[qq.id] === 'y') continue;\n      var arr = areaById(qq.area);\n      priorities.push({ id: qq.id, order: k, ref: qq.ref, question: qq.q, fix: qq.fix, area: arr.name, when: arr.kind,\n        rank: arr.phase === 0 ? 1 : arr.phase, answer: ANSWER_TEXT[a[qq.id]], gap: a[qq.id] === 'n' ? 0 : 1 });\n    }\n    priorities.sort(function (x, y) { if (x.rank !== y.rank) return x.rank - y.rank; if (x.gap !== y.gap) return x.gap - y.gap; return x.order - y.order; });\n    var overall = totalAns ? Math.round(totalPts \/ (totalAns * 2) * 100) : null;\n    return {\n      areas: areas,\n      overall: { pct: overall, band: band(overall), answered: totalAns, total: QUESTIONS.length },\n      priorities: priorities.slice(0, MAX_PRIORITIES),\n      morePriorities: priorities.length > MAX_PRIORITIES ? priorities.length - MAX_PRIORITIES : 0\n    };\n  }\n\n  \/\/ Node export only when there is no document, so an element with id=\"module\" on the page (DOM clobbering) cannot stop the tool from starting.\n  if (typeof module !== 'undefined') { if (module.exports) { if (typeof document === 'undefined') { module.exports = { AREAS: AREAS, QUESTIONS: QUESTIONS, score: score, encode: encode, decode: decode, clean: clean }; return; } } }\n\n  \/\/ ---------- page wiring (DOM only via createElement \/ textContent) ----------\n  function el(tag, text, cls) { var e = document.createElement(tag); if (text !== undefined) { if (text !== null) e.textContent = text; } if (cls) e.className = cls; return e; }\n  function clear(node) { while (node.firstChild) node.removeChild(node.firstChild); }\n\n  function init() {\n    var root = document.getElementById('cat-asd-check');\n    if (!root) return;\n    var q = function (s) { return root.querySelector(s); };\n    var qBox = q('#cat-asd-questions'), overallEl = q('#cat-asd-overall'), areaBody = q('#cat-asd-areas tbody');\n    var prioList = q('#cat-asd-priorities'), prioMore = q('#cat-asd-more'), prioEmpty = q('#cat-asd-prio-empty');\n    var answersList = q('#cat-asd-answers'), status = q('#cat-asd-status'), progress = q('#cat-asd-progress');\n    var answers = {};\n\n    \/\/ Build the questions, grouped by area.\n    for (var i = 0; i < AREAS.length; i++) {\n      var ar = AREAS[i];\n      var sec = el('section', null, 'cat-asd-area');\n      var h = el('h3', ar.name); sec.appendChild(h);\n      sec.appendChild(el('p', ar.kind, 'cat-asd-kind'));\n      for (var j = 0; j < QUESTIONS.length; j++) {\n        var qu = QUESTIONS[j];\n        if (qu.area !== ar.id) continue;\n        var fs = el('fieldset', null, 'cat-asd-q');\n        var lg = el('legend'); lg.appendChild(el('span', (j + 1) + '. ', 'cat-asd-num')); lg.appendChild(document.createTextNode(qu.q));\n        fs.appendChild(lg);\n        var opts = el('div', null, 'cat-asd-opts');\n        var vals = ['y', 'p', 'n'];\n        for (var k = 0; k < vals.length; k++) {\n          var lab = el('label');\n          var inp = document.createElement('input');\n          inp.type = 'radio'; inp.name = 'cat-asd-' + qu.id; inp.value = vals[k]; inp.setAttribute('data-q', qu.id);\n          lab.appendChild(inp); lab.appendChild(document.createTextNode(' ' + ANSWER_TEXT[vals[k]]));\n          opts.appendChild(lab);\n        }\n        fs.appendChild(opts);\n        fs.appendChild(el('p', 'ASD Essentials reference: ' + qu.ref, 'cat-asd-ref'));\n        sec.appendChild(fs);\n      }\n      qBox.appendChild(sec);\n    }\n\n    function setRadios() {\n      var radios = qBox.querySelectorAll('input[type=\"radio\"]');\n      for (var r = 0; r < radios.length; r++) {\n        var id = radios[r].getAttribute('data-q');\n        radios[r].checked = has(answers, id) ? answers[id] === radios[r].value : false;\n      }\n    }\n\n    function render() {\n      var s = score(answers);\n      progress.textContent = s.overall.answered + ' of ' + s.overall.total + ' questions answered';\n      if (s.overall.pct === null) overallEl.textContent = 'Answer the questions to see your indicative score.';\n      else overallEl.textContent = 'Overall: ' + s.overall.pct + '% (' + s.overall.band + '), based on ' + s.overall.answered + ' of ' + s.overall.total + ' answers.';\n      clear(areaBody);\n      for (var a = 0; a < s.areas.length; a++) {\n        var x = s.areas[a], tr = el('tr');\n        var th = el('th'); th.scope = 'row'; th.appendChild(el('span', x.name)); th.appendChild(el('span', x.kind, 'cat-asd-kind')); tr.appendChild(th);\n        var td = el('td');\n        if (x.pct === null) td.textContent = 'Not answered';\n        else {\n          td.appendChild(el('span', x.pct + '%', 'cat-asd-pct'));\n          var bar = el('span', null, 'cat-asd-bar'); var fill = el('span', null, 'cat-asd-fill'); fill.style.width = x.pct + '%'; bar.appendChild(fill); td.appendChild(bar);\n        }\n        tr.appendChild(td);\n        tr.appendChild(el('td', x.rating));\n        areaBody.appendChild(tr);\n      }\n      clear(prioList);\n      for (var p = 0; p < s.priorities.length; p++) {\n        var it = s.priorities[p], li = el('li');\n        li.appendChild(el('strong', it.fix));\n        li.appendChild(el('span', ' ' + it.area + ' (' + it.when + ', ' + it.ref + '). You answered: ' + it.answer + '.', 'cat-asd-meta'));\n        prioList.appendChild(li);\n      }\n      prioEmpty.hidden = s.priorities.length > 0;\n      prioEmpty.textContent = s.overall.answered === 0 ? 'Your priorities appear here as you answer.' : 'No gaps in the answers so far.';\n      prioMore.textContent = s.morePriorities ? 'Plus ' + s.morePriorities + ' more item' + (s.morePriorities === 1 ? '' : 's') + ' answered \"No\" or \"Partly\".' : '';\n      clear(answersList);\n      for (var w = 0; w < QUESTIONS.length; w++) {\n        var qq = QUESTIONS[w];\n        answersList.appendChild(el('li', qq.q + ' ' + (has(answers, qq.id) ? ANSWER_TEXT[answers[qq.id]] : 'Not answered')));\n      }\n    }\n\n    qBox.addEventListener('change', function (e) {\n      var t = e.target;\n      if (!t) return;\n      if (t.type !== 'radio') return;\n      var id = t.getAttribute('data-q'), v = t.value;\n      var tmp = {}; tmp[id] = v;\n      var ok = clean(tmp);\n      if (has(ok, id)) answers[id] = ok[id];\n      render();\n    });\n\n    q('#cat-asd-print').addEventListener('click', function () {\n      \/\/ Print only this tool: the class scopes the print stylesheet to this button, so printing the post\n      \/\/ with the browser's own Print command is not affected. It is removed again after printing.\n      var docEl = document.documentElement;\n      var after = function () { docEl.classList.remove('cat-asd-printing'); window.removeEventListener('afterprint', after); };\n      docEl.classList.add('cat-asd-printing');\n      window.addEventListener('afterprint', after);\n      window.print();\n    });\n    q('#cat-asd-reset').addEventListener('click', function () { answers = {}; setRadios(); render(); status.textContent = 'All answers cleared.'; });\n    q('#cat-asd-share').addEventListener('click', function () {\n      var link = String(location.href).split('#')[0] + '#' + encode(answers);\n      var out = q('#cat-asd-link'); out.value = link; q('#cat-asd-linkbox').hidden = false; out.focus(); out.select();\n      if (navigator.clipboard) {\n        navigator.clipboard.writeText(link).then(function () { status.textContent = 'Link copied. It holds your answers in the address after the # only.'; },\n          function () { status.textContent = 'Copy the link from the box.'; });\n      } else status.textContent = 'Copy the link from the box.';\n    });\n\n    \/\/ Pre-fill from a shared link (#r=...), validated like any other input.\n    var pre = null;\n    try { pre = decode(location.hash); } catch (e) { pre = null; }\n    if (pre) { answers = clean(pre); setRadios(); }\n    render();\n  }\n  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', init); else init();\n})();\n\n<\/script>\n<\/div>\n\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"the-first-90-days-a-plan-for-a-5-to-200-person-organisation\">The first 90 days: a plan for a 5 to 200 person organisation<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This plan follows ASD's own sequence: establish a baseline, scope the priority phase 1 domains, run a gap analysis, then deliver and measure (<a href=\"https:\/\/www.cyber.gov.au\/publication\/transitioning-from-the-essential-eight\" target=\"_blank\" rel=\"noreferrer noopener\">transition guide<\/a>, <a href=\"https:\/\/www.cyber.gov.au\/publication\/implementation-planning-guide\" target=\"_blank\" rel=\"noreferrer noopener\">implementation planning guide<\/a>). It assumes a part-time owner, such as an office manager or IT lead, with help from your IT provider.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Days 1 to 30: baseline, ownership and scope<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Name an accountable executive.<\/strong> ASD Essentials makes executive accountability an assessable action. In a small business this is usually the owner or a director.\n<strong>Check:<\/strong> a one-page note, signed by that person, saying who is accountable for cyber security, what level of risk the business accepts and when this will be reviewed.<\/li>\n\n\n<li><strong>Choose your chapter<\/strong> using the table above, and write down why.\n<strong>Check:<\/strong> one sentence in your notes, such as &quot;Cloud chapter: no servers; all systems are SaaS.&quot;<\/li>\n\n\n<li><strong>List your phase 1 assets.<\/strong> You don't need a full asset register yet. ASD's planning guide says to scope only the phase 1 domains first.\n<ul>\n<li><em>Identity services:<\/em> your identity provider or directory, password manager, single sign-on, and any admin accounts.<\/li>\n<li><em>Boundary services:<\/em> anything reachable from the internet, such as your firewall or router, VPN, remote access tools, website, customer portal, and third-party apps connected to your email or files.\n<strong>Check:<\/strong> a list you could hand to a stranger, with an owner named for each item.<\/li>\n<\/ul>\n<\/li>\n\n\n<li><strong>Record what you already have.<\/strong> Pull together any past assessments, policies, your IT provider's reports, backup reports and insurance questionnaire answers.\n<strong>Check:<\/strong> a folder, dated, with each document named after what it shows.<\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Days 31 to 60: identity and the internet edge<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Enforce phishing-resistant MFA<\/strong> for everyone, starting with admins. Codes sent by SMS and push approvals can be phished. Passkeys or security keys are the phishing-resistant options most small organisations can deploy.\n<strong>Check:<\/strong> a report from your identity provider listing every account and its sign-in method, with no account left without MFA.<\/li>\n\n\n<li><strong>Turn off legacy sign-in protocols<\/strong> that bypass MFA, or restrict and monitor them with a dated plan to remove them, as the action requires.\n<strong>Check:<\/strong> a sign-in report showing no successful legacy-protocol sign-ins in the past 30 days.<\/li>\n\n\n<li><strong>Clean up accounts.<\/strong> Remove default, unused and former-staff accounts. Separate admin accounts from everyday accounts, and give staff only the access their role needs.\n<strong>Check:<\/strong> an exported user list reviewed and signed off, with the date.<\/li>\n\n\n<li><strong>Review connected apps.<\/strong> The cloud chapter asks you to assess and approve applications, integrations and consent grants before they get access. Remove anything nobody can explain.\n<strong>Check:<\/strong> a short register of approved integrations with an owner for each.<\/li>\n\n\n<li><strong>Patch and test what faces the internet.<\/strong> Firewalls, VPNs and remote access tools are common ways in. Confirm they are supported, patched and not exposing admin pages. An external vulnerability scan or <a href=\"https:\/\/catharsis.net.au\/blog\/what-is-internal-external-penetration-testing\/\" target=\"_blank\" rel=\"noreferrer noopener\">external penetration test<\/a> gives independent evidence that ASD's evidence model rates highly.\n<strong>Check:<\/strong> scan or test results dated within the review period, with findings closed or risk-accepted.<\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Days 61 to 90: visibility, response and your first report<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Centralise and keep logs<\/strong> for sign-ins, admin actions and changes to security settings, protected from deletion.\n<strong>Check:<\/strong> you can answer &quot;who changed this admin setting last month?&quot; in under ten minutes.<\/li>\n\n\n<li><strong>Write and test a short incident response procedure<\/strong> covering an account takeover and a provider-side incident.\n<strong>Check:<\/strong> notes from a 45-minute tabletop exercise, with actions assigned.<\/li>\n\n\n<li><strong>Prove your backups.<\/strong> Back up important data, keep copies isolated from everyday accounts, and test a restore against the recovery time you have agreed.\n<strong>Check:<\/strong> a restore test record with the date, what was restored and how long it took.<\/li>\n\n\n<li><strong>Run your gap analysis and report.<\/strong> For each phase 1 action, classify it as already effectively addressed, partially addressed or not addressed (ASD's gap-analysis terms). Then give the accountable executive a one-page summary listing what is done, what isn't, and what has been deliberately left as not assessed.\n<strong>Check:<\/strong> the executive has read it and signed off the next 90 days.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Awareness training and AI governance can start in parallel. The cloud chapter even asks for executive approval before you switch on AI features inside your SaaS tools.<\/p>\n\n\n\n<div class=\"wp-block-group has-pale-cyan-blue-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:32px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Getting ready for ASD Essentials?<\/strong> We help you assess where you are, close the gaps that matter most, and keep the evidence an assessor will ask for.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/asd-essentials\/?utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=asd-essentials-small-business-asd-essentials\" target=\"_blank\" rel=\"noreferrer noopener\">See ASD Essentials readiness<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"the-evidence-checklist\">The evidence checklist<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ASD's guidance asks assessors to weigh four things for every action: <strong>coverage<\/strong> (all relevant assets), <strong>consistency<\/strong> (applied the same way everywhere), <strong>currency<\/strong> (recent enough to reflect today) and <strong>evidence quality<\/strong>. Use this table to upgrade weak evidence before anyone asks for it.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th>Action area<\/th>\n<th>Weak evidence<\/th>\n<th>Stronger evidence<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Phishing-resistant MFA<\/td>\n<td>Screenshot of a policy<\/td>\n<td>Per-user report of sign-in methods, plus logs showing blocked attempts<\/td>\n<\/tr>\n<tr>\n<td>Legacy authentication<\/td>\n<td>&quot;We turned it off&quot;<\/td>\n<td>Sign-in report over 30+ days showing zero legacy sign-ins<\/td>\n<\/tr>\n<tr>\n<td>Admin accounts<\/td>\n<td>List of admins<\/td>\n<td>Dated access review, separate admin accounts, logs of admin actions<\/td>\n<\/tr>\n<tr>\n<td>Internet-facing services<\/td>\n<td>Firewall model and firmware version<\/td>\n<td>External scan or penetration test results with closed findings<\/td>\n<\/tr>\n<tr>\n<td>Connected apps<\/td>\n<td>Nothing<\/td>\n<td>Register of approved integrations, with each review dated<\/td>\n<\/tr>\n<tr>\n<td>Backups<\/td>\n<td>Backup job &quot;success&quot; emails<\/td>\n<td>Restore test record against agreed recovery objectives<\/td>\n<\/tr>\n<tr>\n<td>Incident response<\/td>\n<td>A template plan<\/td>\n<td>Plan plus tabletop exercise notes and the actions that followed<\/td>\n<\/tr>\n<tr>\n<td>Governance<\/td>\n<td>A policy document<\/td>\n<td>Signed accountability statement and minutes showing it was reviewed<\/td>\n<\/tr>\n<tr>\n<td>Awareness training<\/td>\n<td>Course licence<\/td>\n<td>Completion records and dated content updates<\/td>\n<\/tr>\n<tr>\n<td>Provider-managed controls<\/td>\n<td>&quot;Our IT provider handles it&quot;<\/td>\n<td>Provider's report or assurance mapped to each action they own<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Two notes from the assessment guide. First, ASD rates a principle by its <strong>lowest<\/strong> action rating, so one weak action pulls the whole principle down. Second, each domain gets a percentage: fully effective scores 1, partially effective 0.5 and not effective 0, divided by the number of principles that apply. Five fully effective, four partial and one not effective gives 70%. That is a simple number to track from one review to the next.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"common-misconceptions\">Common misconceptions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>&quot;ASD Essentials is mandatory for my business now.&quot;<\/strong> Not for a typical private business. It is guidance, and ASD has not set a transition date. Contracts, tenders and regulators decide what you must do, and ASD says to keep meeting existing obligations until they change.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>&quot;We were at Maturity Level Two, so we are done.&quot;<\/strong> ASD says previous ratings do not automatically convert, and even Maturity Level Three organisations need a gap analysis. Your past work is evidence, not a rating.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>&quot;Phase 1 is the new Level One.&quot;<\/strong> No. Priority phases are an order of work, not a measure of security. ASD's planning guide says completing a phase does not tell you that you are secure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>&quot;Our IT provider does all this.&quot;<\/strong> Accountability stays with you. You need evidence for each action your provider runs, and settings your provider offers but hasn't enabled count as not done.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>&quot;We should restart from scratch.&quot;<\/strong> ASD says existing investment carries forward and does not recommend pausing current uplift programs. Map what you have, then fill the gaps.<\/p>\n\n\n\n<div class=\"wp-block-group has-pale-cyan-blue-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:32px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<p class=\"wp-block-paragraph\"><strong>Not sure where you stand?<\/strong> Ask for a free security health check. We look at your setup and tell you, in plain English, what to fix first. Complimentary, at our discretion.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/contact-us\/?type=contact&amp;service=security-health-check&amp;utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=asd-essentials-small-business-health-check\" target=\"_blank\" rel=\"noreferrer noopener\">Book a free health check<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"key-takeaways\">Key takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>ASD Essentials replaces maturity levels with per-action effectiveness ratings across eight domains, ordered into three priority phases.<\/li>\n\n\n<li>Small organisations aren't its main audience, but government suppliers and anyone answering security questionnaires should start mapping to it now.<\/li>\n\n\n<li>Use the cloud chapter if you run no servers, and enterprise IT if you do. Most organisations will eventually need both.<\/li>\n\n\n<li>Spend the first 90 days on accountability, identity, internet-facing services, logging, incident response and proven backups.<\/li>\n\n\n<li>Collect evidence that shows controls working over time, not just switched on, and report &quot;not assessed&quot; honestly.<\/li>\n\n\n<li>Start with the self-check above. For help with the gap analysis, see our <a href=\"https:\/\/catharsis.net.au\/asd-essentials\/\" target=\"_blank\" rel=\"noreferrer noopener\">ASD Essentials readiness service<\/a>; for how it fits with other frameworks, see <a href=\"https:\/\/catharsis.net.au\/blog\/smb1001-vs-asd-essentials-vs-iso-27001\/\" target=\"_blank\" rel=\"noreferrer noopener\">SMB1001 vs ASD Essentials vs ISO 27001<\/a>.<\/li>\n\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"sources\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>ASD, <a href=\"https:\/\/www.asd.gov.au\/news\/2026-10-15-asd-essentials-evolving-our-approach-cyber-security-resilience\" target=\"_blank\" rel=\"noreferrer noopener\">ASD Essentials: evolving our approach to cyber security resilience<\/a> (15 October 2026)<\/li>\n\n\n<li>ASD's ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/what-is-the-essentials\" target=\"_blank\" rel=\"noreferrer noopener\">What is the Essentials?<\/a><\/li>\n\n\n<li>ASD's ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/essentials-for-enterprise-it\" target=\"_blank\" rel=\"noreferrer noopener\">Essentials for enterprise IT<\/a><\/li>\n\n\n<li>ASD's ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/essentials-for-cloud\" target=\"_blank\" rel=\"noreferrer noopener\">Essentials for cloud<\/a><\/li>\n\n\n<li>ASD's ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/which-chapter-should-i-start-with\" target=\"_blank\" rel=\"noreferrer noopener\">Which chapter should I start with?<\/a><\/li>\n\n\n<li>ASD's ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/transitioning-from-the-essential-eight\" target=\"_blank\" rel=\"noreferrer noopener\">Transition guide<\/a><\/li>\n\n\n<li>ASD's ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/implementation-planning-guide\" target=\"_blank\" rel=\"noreferrer noopener\">Implementation planning guide<\/a><\/li>\n\n\n<li>ASD's ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/assessment-process-guide\" target=\"_blank\" rel=\"noreferrer noopener\">Assessment process guide<\/a><\/li>\n\n\n<li>ASD's ACSC, <a href=\"https:\/\/www.cyber.gov.au\/publication\/frequently-asked-questions\" target=\"_blank\" rel=\"noreferrer noopener\">ASD Essentials frequently asked questions<\/a><\/li>\n\n\n<li>Department of Home Affairs, <a href=\"https:\/\/www.protectivesecurity.gov.au\/system\/files\/2026-07\/pspf-release-2026-list-requirements_0.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">PSPF Release 2026: list of requirements<\/a><\/li>\n\n\n<li>iTnews, <a href=\"https:\/\/www.itnews.com.au\/news\/asds-essential-eight-replacement-moves-away-from-maturity-ladder-629637\" target=\"_blank\" rel=\"noreferrer noopener\">report on the ASD Essentials launch and transition<\/a> (15 October 2026, secondary source)<\/li>\n\n<\/ul>\n\n\n\n<div class=\"wp-block-group has-light-green-cyan-background-color has-background\" style=\"padding-top:28px;padding-right:32px;padding-bottom:28px;padding-left:32px;margin-top:40px;margin-bottom:32px\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-container-core-group-is-layout-40de7cf3 wp-block-group-is-layout-constrained\">\n\n<h2 class=\"wp-block-heading\">Want a second pair of eyes?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Catharsis Cyber Security is a Sydney cyber security company, certified to ISO\/IEC 27001:2022. We help organisations protect, test and run their technology, and explain it in plain English.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/contact-us\/?type=contact&amp;service=consult&amp;utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=asd-essentials-small-business-contact\" target=\"_blank\" rel=\"noreferrer noopener\">Talk to us<\/a><\/div>\n\n\n<div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/catharsis.net.au\/contact-us\/?type=contact&amp;service=security-health-check&amp;utm_source=blog&amp;utm_medium=article&amp;utm_campaign=value-guides&amp;utm_content=asd-essentials-small-business-end-health-check\" target=\"_blank\" rel=\"noreferrer noopener\">Free security health check<\/a><\/div>\n\n<\/div>\n\n<\/div><\/div>\n\n\n\n<style>pre.wp-block-code{max-width:100%;overflow-x:auto}pre.wp-block-code code{white-space:pre}.wp-block-list a,.wp-block-table a{overflow-wrap:anywhere;word-break:break-word}<\/style>\n","protected":false},"excerpt":{"rendered":"<p>ASD published ASD Essentials on 15 October 2026. It replaces maturity levels with priority phases, rates each security action on whether it actually works, groups your systems into eight domains and tells you to start with identity and internet-facing services. Here is what that means for a 5 to 200 person organisation, a 90-day plan and the evidence you will need.<\/p>\n","protected":false},"author":4,"featured_media":1235,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[156,163,167,164,166,165,161],"class_list":["post-1236","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security-explained","tag-asd","tag-asd-essentials","tag-compliance","tag-cyber-security-framework","tag-government-suppliers","tag-phishing-resistant-mfa","tag-small-business-cyber-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>ASD Essentials for Small Business: What Changed, What to Do First - Catharsis | Blog<\/title>\n<meta name=\"description\" content=\"What did ASD Essentials change for small organisations, and what should you do first? A 90-day plan, an evidence checklist and the common myths.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ASD Essentials for Small Business: What Changed, What to Do First - Catharsis | Blog\" \/>\n<meta property=\"og:description\" content=\"What did ASD Essentials change for small organisations, and what should you do first? A 90-day plan, an evidence checklist and the common myths.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/\" \/>\n<meta property=\"og:site_name\" content=\"Catharsis | Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-15T22:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-03T10:46:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/asd-essentials-small-business.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Catharsis\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Catharsis\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/\"},\"author\":{\"name\":\"Catharsis\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/person\\\/ab309c676ceb9762b5c09091d50f4074\"},\"headline\":\"ASD Essentials for Small Business: What Changed, What to Do First\",\"datePublished\":\"2026-10-15T22:00:00+00:00\",\"dateModified\":\"2026-11-03T10:46:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/\"},\"wordCount\":3051,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/asd-essentials-small-business.jpg\",\"keywords\":[\"ASD\",\"ASD Essentials\",\"compliance\",\"cyber security framework\",\"government suppliers\",\"phishing-resistant MFA\",\"small business cyber security\"],\"articleSection\":[\"Cyber Security Explained\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/\",\"name\":\"ASD Essentials for Small Business: What Changed, What to Do First - Catharsis | Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/asd-essentials-small-business.jpg\",\"datePublished\":\"2026-10-15T22:00:00+00:00\",\"dateModified\":\"2026-11-03T10:46:34+00:00\",\"description\":\"What did ASD Essentials change for small organisations, and what should you do first? A 90-day plan, an evidence checklist and the common myths.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/#primaryimage\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/asd-essentials-small-business.jpg\",\"contentUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/asd-essentials-small-business.jpg\",\"width\":1280,\"height\":720,\"caption\":\"ASD Essentials for Small Business: What Changed, What to Do First\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/asd-essentials-small-business\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ASD Essentials for Small Business: What Changed, What to Do First\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\",\"name\":\"Catharsis | Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#organization\",\"name\":\"Catharsis | Blog\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/catharsis_au.jpg\",\"contentUrl\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/01\\\/catharsis_au.jpg\",\"width\":215,\"height\":60,\"caption\":\"Catharsis | Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/#\\\/schema\\\/person\\\/ab309c676ceb9762b5c09091d50f4074\",\"name\":\"Catharsis\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g\",\"caption\":\"Catharsis\"},\"description\":\"Catharsis Cyber Security is a Sydney cyber security company, certified to ISO\\\/IEC 27001:2022. We help organisations protect, test and run their technology: managed security, penetration testing, security-first managed IT, secure AI and secure development.\",\"sameAs\":[\"https:\\\/\\\/catharsis.net.au\\\/\"],\"url\":\"https:\\\/\\\/catharsis.net.au\\\/blog\\\/author\\\/catharsis-team\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ASD Essentials for Small Business: What Changed, What to Do First - Catharsis | Blog","description":"What did ASD Essentials change for small organisations, and what should you do first? A 90-day plan, an evidence checklist and the common myths.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/","og_locale":"en_US","og_type":"article","og_title":"ASD Essentials for Small Business: What Changed, What to Do First - Catharsis | Blog","og_description":"What did ASD Essentials change for small organisations, and what should you do first? A 90-day plan, an evidence checklist and the common myths.","og_url":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/","og_site_name":"Catharsis | Blog","article_published_time":"2026-10-15T22:00:00+00:00","article_modified_time":"2026-11-03T10:46:34+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/asd-essentials-small-business.jpg","type":"image\/jpeg"}],"author":"Catharsis","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Catharsis","Est. reading time":"15 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/#article","isPartOf":{"@id":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/"},"author":{"name":"Catharsis","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/person\/ab309c676ceb9762b5c09091d50f4074"},"headline":"ASD Essentials for Small Business: What Changed, What to Do First","datePublished":"2026-10-15T22:00:00+00:00","dateModified":"2026-11-03T10:46:34+00:00","mainEntityOfPage":{"@id":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/"},"wordCount":3051,"commentCount":0,"publisher":{"@id":"https:\/\/catharsis.net.au\/blog\/#organization"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/#primaryimage"},"thumbnailUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/asd-essentials-small-business.jpg","keywords":["ASD","ASD Essentials","compliance","cyber security framework","government suppliers","phishing-resistant MFA","small business cyber security"],"articleSection":["Cyber Security Explained"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/","url":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/","name":"ASD Essentials for Small Business: What Changed, What to Do First - Catharsis | Blog","isPartOf":{"@id":"https:\/\/catharsis.net.au\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/#primaryimage"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/#primaryimage"},"thumbnailUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/asd-essentials-small-business.jpg","datePublished":"2026-10-15T22:00:00+00:00","dateModified":"2026-11-03T10:46:34+00:00","description":"What did ASD Essentials change for small organisations, and what should you do first? A 90-day plan, an evidence checklist and the common myths.","breadcrumb":{"@id":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/#primaryimage","url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/asd-essentials-small-business.jpg","contentUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2026\/11\/asd-essentials-small-business.jpg","width":1280,"height":720,"caption":"ASD Essentials for Small Business: What Changed, What to Do First"},{"@type":"BreadcrumbList","@id":"https:\/\/catharsis.net.au\/blog\/asd-essentials-small-business\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/catharsis.net.au\/blog\/"},{"@type":"ListItem","position":2,"name":"ASD Essentials for Small Business: What Changed, What to Do First"}]},{"@type":"WebSite","@id":"https:\/\/catharsis.net.au\/blog\/#website","url":"https:\/\/catharsis.net.au\/blog\/","name":"Catharsis | Blog","description":"","publisher":{"@id":"https:\/\/catharsis.net.au\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/catharsis.net.au\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/catharsis.net.au\/blog\/#organization","name":"Catharsis | Blog","url":"https:\/\/catharsis.net.au\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2019\/01\/catharsis_au.jpg","contentUrl":"https:\/\/catharsis.net.au\/blog\/wp-content\/uploads\/2019\/01\/catharsis_au.jpg","width":215,"height":60,"caption":"Catharsis | Blog"},"image":{"@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/catharsis.net.au\/blog\/#\/schema\/person\/ab309c676ceb9762b5c09091d50f4074","name":"Catharsis","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e27fcf8abb5a2806de5f16ab76102b4c22bda3fbd37a2fa8dc934e8d725f4bad?s=96&d=mm&r=g","caption":"Catharsis"},"description":"Catharsis Cyber Security is a Sydney cyber security company, certified to ISO\/IEC 27001:2022. We help organisations protect, test and run their technology: managed security, penetration testing, security-first managed IT, secure AI and secure development.","sameAs":["https:\/\/catharsis.net.au\/"],"url":"https:\/\/catharsis.net.au\/blog\/author\/catharsis-team\/"}]}},"_links":{"self":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1236","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/comments?post=1236"}],"version-history":[{"count":1,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1236\/revisions"}],"predecessor-version":[{"id":1278,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/posts\/1236\/revisions\/1278"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/media\/1235"}],"wp:attachment":[{"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/media?parent=1236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/categories?post=1236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/catharsis.net.au\/blog\/wp-json\/wp\/v2\/tags?post=1236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}