If you run a Perth business of 20 to 200 staff and already have Essential Eight work in place, start ASD Essentials with two domains: boundary services and identity services. Keep your current controls running, keep the evidence, and leave the rest of the framework until those two are done. The exception is a contract, tender, DISP membership or insurer that still names an Essential Eight maturity level. In that case, keep meeting it.
That is the short version of the advice we are giving clients this month. Below is the longer version: why ASD Essentials is a lot of framework for a small business, what to do in the first 90 days, and what you can park. If you want help applying it to your own environment, our Essential Eight and ASD Essentials team can map where you stand today.
Not really. The ASD wrote Essentials mainly for Commonwealth entities, critical infrastructure and large organisations, and says smaller organisations can use it where it is relevant. That is a fair description of what landed on 15 October 2026: three chapters (enterprise IT, cloud and operational technology) and, in the enterprise IT chapter alone, 28 principles and 58 actions across eight domains.
For a Perth business with 40 or 120 staff and an IT provider rather than a security team, that is a lot of framework. Most of it is sensible. Very little of it needs doing this quarter.
So read “where relevant” as permission to prioritise. The ASD has done some of that for you by grouping the technical domains into three priority phases. Our job, and the point of this post, is turning those phases into a plan that fits a smaller business.
It is worth a lot as evidence. It is worth nothing as a rating.
Every Essential Eight strategy maps to at least one ASD Essentials principle, so your application control rulesets, patch reports, MFA configuration and backup tests all carry forward. We cover that strategy by strategy in our Essential Eight to ASD Essentials control mapping.
What does not carry forward is the maturity level. ASD Essentials rates each action as not assessed, not effective, partially effective or fully effective, in each domain where it applies. A principle takes the rating of its weakest action, and results are reported domain by domain. There is no single “ML2” figure to quote any more.
The practical consequence: stop spending money chasing the next maturity level purely for its own sake. Spend it on making controls effective where attackers get in first.
The enterprise IT chapter has six technical domains: boundary services, identity services, critical processes and services, privileged environments, business systems and user devices. Two capability domains, governance and culture and visibility and response, run across all of them.
The ASD puts boundary services and identity services in the first priority phase because they are the most common routes in for attackers. We agree with that order, and it suits small businesses well, because both domains are usually small and well understood.
These are the things that face the internet: your firewall, VPN or remote access gateway, email gateway, public websites and any internet-facing applications. For most small businesses it is a short list. Know exactly what is on it, who manages each item, whether it is supported, and how fast it gets patched.
For a Microsoft 365 business, this mostly means Entra ID, how people sign in, and who holds admin rights. Phishing-resistant MFA, tight control of privileged accounts and removing stale accounts all sit here. If you did MFA properly for the Essential Eight, you are partway there. Our guide to phishing-resistant MFA explains the difference between “has MFA” and “has MFA that holds up”.
Waiting does not mean switching anything off. Keep patching laptops, keep application control running, keep backups tested. What you can park is the new work the later phases ask for.
User devices and business systems are the obvious candidates. Much of the Essential Eight (application control, Office macro settings, application hardening and patching) is aimed at laptops and desktops, so a business with that work in place usually has a smaller gap there than at the boundary. Business systems (your finance, practice management or ERP platform) matter, but the new evidence ASD Essentials expects there can follow once phase 1 is solid.
The cloud and OT chapters can also wait unless they describe how you actually run. If you are almost entirely software-as-a-service, read our post on ASD Essentials for cloud before deciding. If you run plant or control systems, the OT chapter is a separate conversation.
The ASD has given no fixed retirement date for the Essential Eight. It stays on cyber.gov.au during the transition, and the ASD says to keep meeting existing regulatory obligations until regulators announce changes.
So keep working towards a maturity level if any of these name it:
Ask your broker what the proposal form will ask at your next renewal. That wording, not what the ASD published this month, is what your cover depends on. If you are in Defence supply, our piece on the Essential Eight retirement and DISP goes further.
If none of those apply, you can stop chasing the next level and put the effort into phase 1.
| Window | What to do | What you should have at the end |
|---|---|---|
| Days 1 to 30 | List every boundary service and every identity system. Check which contracts, tenders and insurance policies name an Essential Eight level. | A one-page inventory and a yes or no on whether you still need a maturity level |
| Days 31 to 60 | Rate each phase 1 action as not effective, partially effective or fully effective. Fix the quick gaps: unsupported edge devices, admin accounts without strong MFA, stale accounts. | An honest phase 1 rating and a short list of harder fixes |
| Days 61 to 90 | Plan and budget the harder fixes. Agree who owns governance and incident response. Decide which later-phase domain comes next. | A costed plan for the next two quarters that leadership has signed off |
None of this needs a new tool. Most of it is looking carefully at what you already have and writing down what you find.
If your provider still reports a single maturity score and nothing else, ask them how they will rate effectiveness by domain. Then ask:
If they cannot answer the first two in a week, that is a gap worth fixing before anything else.
Check your obligations. Pull your top client contracts, any tender templates and your cyber insurance wording. Note every place an Essential Eight maturity level is named.
Write down your boundary and identity systems. One page is enough. Include who manages each one and whether it is still supported.
Get an outside view of phase 1. Our Essential Eight and ASD Essentials service starts with a free security assessment that covers exactly this, and keeps your existing evidence working for you.
The ASD wrote ASD Essentials mainly for Commonwealth entities, critical infrastructure and large organisations, and says smaller organisations can use it where relevant. For a small business, that means using its priority phases to decide what to do first, starting with boundary services and identity services.
Start with the first priority phase: boundary services (internet-facing systems) and identity services (sign-in and admin accounts). Inventory both, rate how effective your controls are, and fix the obvious gaps before moving on to other domains.
Yes, wherever a contract, tender, DISP or insurer still names it. The ASD has set no fixed retirement date and says to keep meeting existing obligations until regulators announce changes. Under ASD Essentials itself, your Essential Eight work counts as evidence, not as a rating.
Each action is rated not assessed, not effective, partially effective or fully effective in each domain where it applies. A principle takes the rating of its weakest action, and results are reported by domain instead of as one maturity level.
