Essential Eight for small business, and the move to ASD Essentials.

What the Essential Eight is

The Essential Eight is a set of eight mitigation strategies that ASD, through its Australian Cyber Security Centre (ACSC), recommends organisations implement as a baseline. Our glossary entry gives the one-paragraph version; the table below explains each strategy in practical terms.

Maturity levels: how far to go

ASD measures implementation against a maturity model with four levels, from Maturity Level Zero to Maturity Level Three. Level Zero signals weaknesses in the overall security posture. Levels One to Three are designed to stop increasingly capable attackers, from opportunistic attacks using widely available tools at Level One to more adaptive, targeted attacks at Level Three.

ASD's maturity model FAQ suggests Maturity Level One may be suitable for small to medium enterprises, Level Two for large enterprises and Level Three for critical infrastructure providers and organisations in high-threat environments. ASD also recommends reaching the same level across all eight strategies before moving up.

The 2026 move to ASD Essentials

ASD Essentials is ASD's newer framework, which it describes as an evolution of the Essential Eight; it was published on cyber.gov.au in October 2026. It is a series of chapters for different environments, currently enterprise IT, cloud and operational technology (OT), the systems that run plant and equipment. Each chapter uses the same three layers: principles (the outcomes to achieve), actions (the work required) and domains (where the work applies).

What ASD says about the transition so far:

• During the transition, ASD maintains both the Essential Eight and ASD Essentials on cyber.gov.au, with supporting guidance.
• Essential Eight maturity levels do not convert automatically: each ASD Essentials action is rated not effective, partially effective or fully effective, though current evidence can be reused.
• ASD Essentials covers areas the Essential Eight did not, such as security awareness training and cyber supply chain security.
• Until regulators communicate changes, organisations should keep meeting their current regulatory obligations, and ASD does not recommend pausing uplift work already under way.

ASD says the series is written mainly for government, critical infrastructure and large organisations, though smaller businesses can use it where relevant. Its cloud chapter is aimed at organisations whose IT runs entirely on cloud services (SaaS and PaaS), which describes many small offices. If a customer contract names an Essential Eight maturity level, keep meeting it and ask when they expect to move.

First steps for a small business

Start with the controls that stop the most common attacks, because they appear in both frameworks. ASD's small business guidance begins with three: turn on multi-factor authentication, update your software and back up your information. A practical order:

1. List what you haveDevices, cloud services, who has admin rights and where important data lives.
2. Turn on multi-factor authenticationStart with email, banking, accounting software, remote access and admin accounts. Use an authenticator app or security key where available.
3. Switch on automatic updatesCover operating systems, browsers and business apps, and plan to replace devices or software that no longer receive updates.
4. Back up and test a restoreBack up regularly, keep at least one copy separate from your main systems, and restore a file to prove it works.
5. Cut back admin rightsDay-to-day accounts should not be administrators. Keep a short list of admin accounts and remove access when people leave.
6. Plan the rest with your IT providerMacro settings, application control and hardening usually need your managed service provider. Ask what they already cover and what evidence they can give you.

ASD's small business guidance then points businesses towards Maturity Level One of the Essential Eight, which makes a sensible target for a first assessment.

How to plan an assessment

Start from why you need it: a customer contract, a tender, an insurer's questionnaire or your own baseline. That decides the framework, the target level and how independent the assessor must be.

• Confirm the requirementAsk which framework, chapter or maturity level is expected, and whether a self-assessment is enough.
• Set the scopeName the systems covered: office computers, cloud services, websites and any factory or site equipment.
• Collect real evidenceASD's assessment guidance gives more weight to testing a control or viewing live system settings than to screenshots or written policies.
• Rate and prioritise gapsRecord each gap with its risk, an owner and a date.
• Reassess regularlyRepeat the assessment on a schedule, for example yearly, and after major changes.

No framework guarantees security

No framework guarantees security. ASD says no set of mitigation strategies is guaranteed to protect against all cyber threats, and that even Maturity Level Three will not stop an attacker willing to invest enough time, money and effort. Treat either framework as a baseline, and plan for what happens when something gets through: who to call, how to restore systems and how to tell customers.

The same discipline applies to new AI tools. An AI assistant connected to email or files uses the same accounts, permissions and data as everything else, so multi-factor authentication, limited access and logging still apply; governed AI work explains how to put controls around AI that acts across systems.

Optivise AI's Certification & Compliance service helps businesses assess and uplift against the Essential Eight, alongside management systems such as ISO/IEC 27001.

Optivise AI prepares businesses for assessments; preparation does not guarantee an assessment result or make any system immune to attack. Scope and fees are agreed in each proposal.