How an ASD Essentials assessment works, and what to ask before you hire an assessor

An ASD Essentials assessment rates every applicable action, in every domain, as not assessed, not effective, partially effective or fully effective. There is no single maturity level at the end. You get a rating for each principle in each domain, a percentage per domain, and a report that has to show the detail behind both. Before you pay anyone to run one, ask how they will scope it, what evidence they will accept and what they will do with the work you already did for the Essential Eight.

The ASD published ASD Essentials on 15 October 2026 with an assessment process guide, an assessment evidence guide for enterprise IT and a transition guide. If you want help with the controls themselves, our Essential Eight and ASD Essentials team works with Perth businesses on both.

What changed: ratings replace maturity levels

Under the Essential Eight you picked a target maturity level and an assessor checked the requirements for it. ASD Essentials drops that. The transition guide says organisations "no longer select a target maturity level". Priority phases now set the order you work through the domains, and the ASD is clear that a phase is not a maturity or assurance rating. "We've reached priority phase 2" says what has been worked on, not how secure the business is.

Posture is now expressed through effectiveness ratings, which ask whether each action achieves its intended outcome for the assets in scope. The ASD contrasts this with a checklist, which only asks whether a control exists.

The four ratings in an ASD Essentials assessment

Principles describe the outcome, actions describe what has to be done, and domains describe where. The enterprise IT chapter has eight domains: governance and culture, visibility and response, boundary services, identity services, critical processes and services, privileged environments, business systems and user devices.

Each action is rated separately in each domain it applies to:

Two rules matter. A plan or a half-finished rollout does not earn partially effective: the ASD says partial activity is not partial effectiveness. And the same action can score differently in different domains. Patching can be fully effective on your laptops and partially effective on the identity servers, and the assessor rates them separately.

The ratings then roll up. A principle takes the rating of its weakest action in that domain, so four fully effective actions and two partially effective ones make the principle partially effective. Each domain then gets a percentage: fully effective scores 1, partially effective 0.5 and not effective 0, divided by the number of applicable principles. The ASD's own example of five fully, four partially and one not effective comes to 70%.

That percentage is the closest thing to a single score, and the ASD warns against using it alone. The report must also include a detailed view naming the principles and actions behind each rating.

What an ASD Essentials assessment looks at

The assessment process guide has four stages: planning and preparation, plan approval, assessment, then aggregation and reporting. Someone in your organisation approves the plan before work starts, including any live testing, which the guide says carries operational risk.

For each action, the assessor looks at coverage (is it applied to every relevant asset in the domain), consistency (is it applied the same way across them), currency (is the evidence recent enough to show how things run today) and evidence quality (is the evidence reliable and relevant enough to show the outcome is achieved).

The guide grades evidence as excellent, good, fair or poor. Excellent evidence shows the action working in the live environment, such as a test that tries to run unapproved software and gets blocked. Poor evidence only shows or asserts that the action exists. Where evidence is too thin to decide, the action is rated not assessed.

In the guide's own example, if most domain controllers are patched on time but the federation servers and certificate authorities are routinely late, patching in the identity services domain is not fully effective. One lagging group of assets holds the rating down.

What evidence to have ready, and what your IT provider must supply

Assessors are told to start with evidence you already hold: configuration baselines, previous assessment reports, control test results, audit findings and risk registers. The guide warns that deployment is not effectiveness, evidence must be current, and a mapped control may cover only part of an action.

For most Perth businesses, the people holding that evidence work for the IT provider. The guide names managed service providers as stakeholders in an assessment and tells assessors to check early whether they can get the access and evidence they need, because it "often takes time to arrange". Ask your provider for:

• patch compliance and vulnerability scan reports, dated, for each group of systems
• MFA method reports and every exclusion or fallback (the evidence guide lists SMS, voice or push-only MFA as a sign the phishing-resistant MFA action is not effective)
• the list of privileged accounts and who approved each one
• backup job reports, what happened to failed jobs, and restore test records
• the asset inventory and the exceptions register with expiry dates
• change records and event logging configuration

Across the Essential Eight work we do for clients, the gap we see most is proof. The control is on, but nobody can produce a dated report showing it covers every device. Under Essentials, that costs you the rating.

The ASD's implementation planning guide suggests a per-domain evidence register mapping each action to its control, coverage, evidence and self-assessed rating. With one in place, you pay an assessor to judge effectiveness instead of hunting for documents.

Does your Essential Eight assessment still count?

As evidence, yes. As a rating, no. The ASD says Essential Eight maturity levels "do not automatically convert" into effectiveness ratings, because the two measure different things. Your last assessment report, configuration records and test results are the starting point for a gap analysis, reused where still current.

Don't assume Maturity Level Two means fully effective. The transition guide lists the usual extra work: extending controls to assets or domains not covered before, the governance and culture principles, broader visibility and response, and evidence of sustained effectiveness instead of deployment alone. Some principles, such as supplier cyber security assurance and cyber security awareness training, were not part of the Essential Eight at all.

If a contract, tender or insurer names an Essential Eight maturity level, keep meeting it. The ASD says to continue meeting current obligations until regulators announce changes, and it is keeping both frameworks on cyber.gov.au during the transition. Our control-by-control mapping shows where each Essential Eight strategy lands, and the transition tracker records what the ASD has published and when.

Seven questions to ask an assessor or consultant

The ASD does not require an independent assessor. Its implementation planning guide says organisations may engage one "where proportionate and affordable". If you pay for one, these questions show whether they have read the new guides.

1. Which domains and assets are in scope, and what is excluded? The guide says exclusions should be documented with the reason. Get the scope in writing.
2. Will every applicable action be rated per domain on the four-tier scale? A proposal that promises a maturity level is using the old method.
3. Will the report include both the summary view and the detailed view? A percentage or a radar chart without the actions behind it is not what the ASD describes.
4. How will you sample, and will the sample be documented? Sampling is allowed. An undocumented sample makes the rating hard to defend.
5. What evidence will you accept, and will you test anything live? Ask where their evidence sits on the excellent to poor scale, and what testing needs your sign-off.
6. How will you use our Essential Eight evidence? A good answer starts from what you hold, checks it is current and treats configuration screenshots as proof of deployment only.
7. Who will deal with our IT provider, and are you independent of them? Someone has to arrange access early. If your provider is assessing its own work, that is a self-assessment, which can be fine if it is labelled as one.

What you should do now

Record your baseline. The ASD's first transition step is a written baseline of your Essential Eight maturity, existing controls, risk assessment results and key business functions. Date it.

Ask your IT provider for the evidence list above. Find out what they can produce and how long it takes. The ASD warns that evidence held by third parties can delay an assessment.

Self-assess priority phase 1 first. Phase 1 covers governance and culture, visibility and response, boundary services and identity services. Rate those actions yourself against the evidence guide, then decide whether an independent ASD Essentials assessment is worth paying for. If you want a second opinion first, talk to us.