ASD Essentials transition: what should your organisation do next?

This article draws on a five-part LinkedIn series by Muhammad Islam, Principal Security Architect and IRAP Assessor at The Missing Link. Muhammad holds CISSP and CISA certifications and was named the 2026 ARN Innovation Awards winner for Personal Innovation: Technical Excellence (Partner) for his work developing cyber security consulting methodologies.

Your next step under ASD Essentials depends on why you adopted the Essential Eight in the first place.

Defence Industry Security Program (DISP) members, organisations subject to the Victorian Protective Data Security Framework (VPDSF), NSW Government agencies and businesses voluntarily working towards Maturity Level 2 (ML2) or Maturity Level 3 (ML3) are starting from different positions, so their transition paths should look different too.

Across his five-part analysis, Muhammad reached an important conclusion: there isn't a single ASD Essentials transition path. Some organisations need to keep meeting existing Essential Eight obligations while preparing for ASD Essentials. Others have an opportunity to rethink where their cybersecurity investment goes next.

If you're still getting familiar with the framework, start with our guide to ASD Essentials and the Essential Eight: what's changed. If you already understand the changes, read on to find out what they mean for your organisation.

ASD Essentials transition at a glance

Across all five situations, the common thread is to keep your existing investment, map it against ASD Essentials, and prioritise the gaps that carry real risk. The sections below explain how that plays out for each.

Do you need to start again if you already comply with Essential Eight?

No. ASD has said that existing Essential Eight controls, implementation evidence and assessment results can be carried forward and mapped into ASD Essentials for enterprise IT, so organisations at ML2 or ML3 are likely to have a significant head start. Muhammad’s advice for this group is “don’t restart, map”. 

The catch is that your current maturity level won't tell you where you stand under ASD Essentials. Maturity ratings don't automatically convert into the new effectiveness ratings, because ASD Essentials assesses each action within the domains where it applies. A control can work well in one part of your environment and poorly in another, so you might have excellent multi-factor authentication (MFA) across your standard workforce while privileged environments, cloud administration, service identities and legacy systems tell a different story.

The shift also changes what good evidence looks like. Configuration records, policies and screenshots still have a place, although they mostly show that someone set a control up at a point in time. Muhammad reads this as organisations needing stronger operational evidence, such as coverage data, monitoring, testing, control validation, exercises, and exception management, to show a control is still achieving its intended outcome over time. He welcomes that direction, since in his view a control only reduces risk while it's actually working.

Do DISP organisations still need Essential Eight ML2?

Yes. As of November 2026, Defence still requires DISP members to achieve and maintain the full Essential Eight at ML2 across applicable corporate ICT systems used to correspond with Defence. ASD Essentials was released on 15 October 2026 and hasn’t changed that obligation.

If you’re a DISP member, keep your ML2 program and Maturity Action Plan moving. Pausing work on a current Defence requirement while you wait for a future policy decision risks putting your compliance program off track.

We’d also recommend DISP organisations start preparing for ASD Essentials now, and it helps to separate two questions that are easy to blur together. The first is what Defence requires you to demonstrate today, which is still Essential Eight ML2. The second is how your environment measures up against ASD’s current guidance for protecting an enterprise, and that conversation has moved to ASD Essentials. An organisation can legitimately meet its DISP requirement and still find meaningful gaps when it maps to ASD Essentials, because the two use different assessment models.

Muhammad’s summary for DISP members is “comply today, prepare for tomorrow”. That means preserving the evidence you’ve built for your ML2 assessment, including configuration records, logs, patch records, MFA coverage, privileged access evidence, exceptions and risk acceptances, since much of it can support a future ASD Essentials assessment. It also means mapping your ML2 controls to see which ASD Essentials domains they apply to, whether they’re effective across those domains and what the new framework asks for that Essential Eight didn’t. For many organisations, that exercise is likely to surface gaps around governance, visibility and response, broader identity services and supply chain security, and doing it now puts you in a stronger position to respond when Defence updates its requirements.

What does ASD Essentials mean for organisations subject to VPDSF?

For organisations within scope of the VPDSF, the Victorian Protective Data Security Standards (VPDSS) remain the mandatory obligation, and ASD Essentials doesn’t change that. Meeting ASD Essentials won’t demonstrate VPDSF compliance either. What ASD Essentials offers is a contemporary cyber security lens you can use to test and strengthen the controls that sit underneath your VPDSF obligations.

This is where Muhammad’s analysis goes further. His view is that ASD Essentials may sit more naturally alongside the Victorian model than the Essential Eight ever did. The Essential Eight was deliberately narrow and prescriptive, while the VPDSF has always been risk-based and outcome-focused, covering governance, information, personnel, ICT and physical security. ASD Essentials moves the national framework closer to that way of thinking, with Governance and Culture and Visibility and Response as capability domains that support the whole implementation, and separate chapters for enterprise IT, cloud and operational technology. The Office of the Victorian Information Commissioner (OVIC) hasn’t published guidance on how ASD Essentials relates to the VPDSF, so treat this as an expert interpretation.

• • Identity: whether your controls are effective across users, privileged accounts, cloud administrators, service identities, and non-human identities.

  • Visibility: whether you can detect meaningful malicious activity, or whether you're mostly collecting logs.

  • Cloud: whether your controls keep working once information moves outside the traditional enterprise boundary.

  • Critical services: whether you know which systems and services matter most, and what happens if they're disrupted.

  • Third parties: whether your supplier questionnaires give you meaningful assurance over how Victorian government information is protected.

Many Victorian organisations already manage several frameworks at once, including the VPDSF, Essential Eight, ISO 27001 and NIST. Muhammad’s answer is “one control environment, multiple obligations mapped to it”, which lets ASD Essentials become another lens on the same set of controls without a separate evidence repository or compliance program to maintain. 

Does NSW Government still require the Essential Eight?

Yes. The NSW Cyber Security Policy embeds the Essential Eight in Mandatory Requirements 3.3 to 3.10, with agencies required to implement it to at least ML1 across applicable ICT environments. ASD has said organisations should keep meeting obligations that require the Essential Eight until the relevant authority communicates a change, so NSW agencies should continue until Cyber Security NSW updates the policy or issues transition guidance.

NSW agencies do have an advantage, because the Essential Eight was only ever one part of the policy. The wider policy already includes mandatory requirements for cyber governance and accountability, risk management, logging and continuous monitoring, incident response, business continuity, access control, secure configuration, and data, email, endpoint and network security. Many of those requirements already cover areas ASD Essentials now brings into the national framework, so NSW agencies aren’t starting from scratch.

Muhammad’s most specific advice for NSW is to avoid mapping only Mandatory Requirements 3.3 to 3.10. Mapping the whole policy against ASD Essentials gives a far more accurate picture, and he suspects many agencies will find they’re further along than they expected. Alignment isn’t equivalence, though, because ASD Essentials introduces actions without direct Essential Eight equivalents and assesses controls within domains, so a strong NSW policy posture doesn’t guarantee a fully effective rating. Once the mapping is done, focus spending on the genuine gaps and avoid rebuilding controls you already have.

Should you still pursue Essential Eight ML2 or ML3 if it isn't mandatory?

Not automatically. If no regulation, contract or policy requires a particular maturity level, ASD’s transition guidance recommends reassessing your remaining Essential Eight roadmap before continuing. ASD specifically advises organisations not to initiate work solely to achieve a superseded Essential Eight target unless it remains required by an obligation or continues to address material cyber security risk. 

The Essential Eight is still valuable. Patching, MFA, application control, privileged access, hardening and backups continue to address real threats, and that investment carries forward into ASD Essentials. The open question for organisations without an obligation is whether a maturity number should still define their cyber strategy.

Muhammad uses the example of an organisation at ML1 with a two-year program to reach ML3, where projects are approved, technology has been selected, and budgets are allocated. The easy option is to finish the roadmap and deal with ASD Essentials later, and he'd challenge that. Before spending the next dollar, he suggests mapping the remaining roadmap against ASD Essentials and asking whether each project still reduces a material cyber risk, whether it supports an ASD Essentials outcome, and whether a bigger gap now deserves priority. The most revealing test, in his view, is whether you'd still prioritise the activity if the maturity level didn't exist.

The answers will differ between organisations. One might find identity is the most pressing gap, while another uncovers bigger weaknesses in visibility and response, cloud, privileged infrastructure, supplier security, governance or legacy technology. That variation is why a single maturity destination is giving way to prioritisation based on your own environment, threats and critical services. As he put it at the end of his series, "The maturity score was never the goal. Reducing cyber risk was."

How do you transition from Essential Eight to ASD Essentials?

Whatever your situation, the transition follows a similar five-step sequence.

1. Baseline your current position

 Document your Essential Eight maturity, assessment results, controls, evidence, exceptions, risk acceptances and committed remediation work. That gives you a clear starting point before anything changes. 

2. Map your existing controls and evidence

Map your controls and evidence against the relevant ASD Essentials principles, actions and domains, including capabilities beyond the Essential Eight such as governance, detection, incident response, cloud security and supplier assurance. Mapping everything you already have stops you paying twice for the same outcome.

3. Assess effectiveness and find the gaps

Work out what's fully addressed, partially addressed, or missing, and test whether deployed controls achieve their intended outcome in every domain where they apply. Gaps often appear in broader areas such as governance, visibility and response, credential exposure and supply chain security.

4. Prioritise using ASD's phases

For enterprise IT, ASD’s implementation planning guidance puts Boundary Services and Identity Services first, supported throughout by Governance and Culture and Visibility and Response. Your own risk context should shape the order from there, so effort isn’t spread thin trying to fix everything at once. 

5. Build the transition into your existing program

Fold the new requirements into the security program, governance and evidence processes you already run, which keeps effort focused on risk reduction and avoids a parallel compliance project. Building ongoing evidence collection into day-to-day operations also means you won’t be scrambling for screenshots at the next assessment.

Where do you stand under ASD Essentials?

Plenty of security leaders know exactly where they stood under the Essential Eight and are less sure where they stand today. Our Essential Eight to ASD Essentials Transition Service is designed to answer that question.

We take your current maturity position, controls, evidence, exceptions and broader cyber capabilities, including those you maintain for DISP, the VPDSF or the NSW Cyber Security Policy, and map them against ASD Essentials. You'll see what carries forward, where your controls are already effective, where controls or evidence need strengthening, what's genuinely new and what to prioritise next. That lets you reuse the work you've already done and put your next investment where it will reduce the most risk, without adding another framework program to manage.

Talk to our Cyber Security team about where your organisation stands under ASD Essentials.