Essential Eight and the new ASD Essentials: where should a small business start?

Last checked 12 Nov 2026 against the sources listed below. By oowl. General information for Australian small businesses, not legal advice or advice for any particular organisation. Related service: Essential Eight assessment.

What changed on 15 October 2026

ASD launched the ASD Essentials on 15 October 2026. ASD's announcement calls it an evolution of the Essential Eight. It is a series of chapters for different technology environments, and the first three are enterprise IT, operational technology (OT) and cloud. Instead of eight strategies with maturity levels, it uses principles (the outcomes to achieve), actions (what to do) and domains (the business functions and assets the actions apply to), with a recommended order for tackling the domains.

What did not change: the Essential Eight is still published

ASD says it will keep both the Essential Eight and the Essentials on cyber.gov.au during the transition, along with supporting resources, and that until regulators communicate changes, organisations should keep meeting their current regulatory obligations. The ASD Essentials FAQ adds that ASD will advise on transition timing in due course. The Essential Eight and its maturity model remain available. So it is accurate to say the Essential Eight has been superseded in ASD's direction of travel, but not that it has been withdrawn or has an end date.

Two practical points from ASD's transition guidance: Essential Eight maturity level ratings do not automatically convert into Essentials ratings, because the two assess different things; and organisations that already did Essential Eight work can reuse the controls and evidence as the starting point.

Which one should a small business use?

The Essentials is, in ASD's words, "written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations". The FAQ says small and medium businesses can use it where relevant, and points to ASD's tailored small business guidance. Our reading of that, which is a judgement and not an ASD rule:

• If a contract, insurer, customer or regulator names the Essential Eight, work to the Essential Eight, and in particular Maturity Level 1, until they tell you otherwise.
• If nobody has asked, start with ASD's Small business cyber security handbook, published 7 October 2026. Its key actions are multi-factor authentication, installing updates promptly, regular tested backups and training staff to spot scams. Those line up closely with the Essential Eight basics below.
• If you are a larger or regulated organisation, read the Essentials enterprise IT chapter and ASD's transition guidance.

Maturity Level 1: the basics

The Essential Eight maturity model (November 2023 edition) describes Maturity Level 1 for each of the eight strategies. In plain English:

1. Patch applications. Fix publicly known flaws quickly. Level 1 asks for patches to internet-facing services within 48 hours when the vendor rates the flaw critical or a working exploit exists, and within two weeks otherwise; and for office suites, browsers, email clients, PDF software and security products within two weeks. Unsupported versions are removed.
2. Patch operating systems. The same idea for Windows, macOS, servers and network devices, with the same 48-hour and two-week timeframes for internet-facing systems. Unsupported systems are replaced.
3. Multi-factor authentication. Required for staff sign-in to online services that hold sensitive data, your own and third-party, and for customers of services holding their sensitive data.
4. Restrict administrative privileges. Admin access is requested and approved, admins have a separate admin account, and admin accounts cannot browse the web or read email.
5. Application control. On workstations, only an approved set of programs, scripts and installers can run.
6. Restrict Microsoft Office macros. Disabled for people with no business need, blocked in files from the internet, with scanning on and settings users cannot change.
7. User application hardening. Browsers do not process Java or web adverts from the internet, Internet Explorer 11 is gone, and users cannot change the browser security settings.
8. Regular backups. Data, applications and settings are backed up and kept securely, restoration is tested, and ordinary user accounts cannot change or delete backups.

ASD's advice is to plan the same maturity level across all eight before moving to higher levels. Maturity Level 1 is not a certification and oowl does not issue certifications; it is a benchmark you can assess against.

What to do next

Pick one: confirm in writing which framework any contract or insurer expects, then list your current position on the eight items above with evidence for each. Our Essential Eight assessment does that against ASD's model, and tells you plainly if a different framework is the one you need. Many of the same controls are what insurers ask about; see how to answer a cyber insurance questionnaire. Email is a common weak spot, and our email spoofing check is free.

This is general information, not advice for any particular organisation.

Sources

• ASD Essentials: evolving our approach to cyber security resilience, ASD, 15 Oct 2026
• ASD Essentials, Australian Signals Directorate
• ASD Essentials: frequently asked questions, ASD, 15 Oct 2026
• Transitioning from the Essential Eight, ASD, 15 Oct 2026
• Essential Eight, Australian Signals Directorate
• Essential Eight maturity model, Australian Signals Directorate
• Small business cyber security handbook, ASD, 7 Oct 2026

oowl writes each guide in its own words from these public sources and rechecks them before changing the date above. Guidance changes, so check the sources for the latest detail. Related guides: Cyber insurance questionnaire: how to answer the MFA, backup, EDR and patching questions; Does the Privacy Act apply to my small business?. All guides: oowl guides.