SMELTERDepartments and prices

Guides ยท IT (Secure Baseline)

The ASD Essentials series: what replaces the Essential Eight, and what does not change yet

For years the Essential Eight has been the checklist Australian businesses were pointed to for basic cyber security. In October 2026 the Australian Signals Directorate (ASD) published its successor, the ASD Essentials series. If you run a small practice or office on Microsoft 365 or Google Workspace, here is what changed, what has not, and what is worth doing now. The facts below were checked on Tuesday 20 October 2026.

What ASD published

The series has chapters rather than one list. *Essentials for enterprise IT* is the evolution of the Essential Eight. Separate chapters cover cloud, including software services such as Microsoft 365 and Google Workspace, and operational technology.

ASD's own frequently asked questions ask "Why is ASD replacing the Essential Eight?", so the direction is settled.

What has not happened yet

There are no transition dates. ASD says it "will advise on expectations for transitioning to the new framework in due course". Dates of mid-2027 and mid-2028 that were reported earlier were media estimates, not ASD's.

The series is also written mainly for government, critical infrastructure and large organisations. ASD says smaller businesses can use it where relevant, and it keeps separate guidance for small business.

So nobody needs to rush a migration. What is worth understanding now is the change in how security is judged, because that is where the series is heading.

The real change: evidence, not a one-off setting

Under the Essential Eight, organisations described themselves by maturity level. The ASD Essentials series uses priority phases instead. Phase 1 covers four domains:

  • identity services;
  • boundary services;
  • governance and culture;
  • visibility and response.

Each action is rated not effective, partially effective or fully effective, judged on four things: coverage, consistency, currency and the quality of the evidence. ASD's transition guide says deployment records alone are no longer enough to show that a control keeps working.

In plain terms: "we turned on multi-factor sign-in last year" is not the evidence. "Multi-factor sign-in is on for every account this month, and here is the record" is.

Why a small practice should care anyway

Three reasons, even though the series is aimed at larger organisations.

1. The Privacy Act already covers you. The OAIC lists a provider of health services among the businesses covered by the Privacy Act whatever their turnover. That brings the duty to keep personal information secure. 2. Health is the most breached sector. Health providers lodged 225 of the record 1,205 data breach notifications in 2025, about 19%, more than any other sector (OAIC). 3. Insurers ask. Cyber insurers typically ask about multi-factor sign-in, tested backups, patching and endpoint protection, and many still ask in Essential Eight terms. Keeping an Essential Eight map alongside the new phases answers both.

What to do while there is no transition date

None of this waits on ASD's timetable:

  • multi-factor sign-in for every account, with phishing-resistant methods for administrators;
  • separate administrator accounts, and legacy sign-in methods turned off;
  • devices patched, with the percentage visible;
  • backups, with a restore actually tested, not assumed;
  • leavers removed from email and files the day they go;
  • a monthly record of each of the above, so the evidence exists when someone asks.

How Smelter's IT department handles this

Secure Baseline does that list for offices of 2 to 19 people on Microsoft 365 or Google Workspace, remotely. Each month it assembles an evidence pack mapped to the ASD Essentials priority phase 1 domains, with an Essential Eight map kept for insurers while they still ask for one. A restore is tested every month, and when you record a departure in Minishift, the leaver is locked out with a timed audit trail.

It is remote only: no phone helpdesk and no on-site visits. Smelter does not certify anyone against either framework; it does the work and keeps the record.

This page is general information, not legal or security advice for your circumstances.

If you would rather have the baseline done for you and the evidence filed each month, [see how Smelter's IT department works](https://smelter.campsitestudios.net/#it).

Sources

All checked on Tuesday 20 October 2026 (the research's verification pass corrected the earlier timeline).

Facts checked: Tuesday 20 October 2026 (research report, corrected in its verification pass), unless marked [verify]. This guide is information, not legal advice.