ASD Essentials (Enterprise IT, OT and Cloud) compliance software
Assess the Essential Eight's successor the way ASD designed it: scoped by chapter and environment, rated action by action in each domain, and reported to the board by domain.
- ChaptersEnterprise IT, operational technology and cloud (further chapters planned)
- ModelPrinciples, actions and domains, with priority phases per chapter
- RatingsNot effective, Partially effective, Fully effective, per action per domain
- Catalogue in GRCLens58 enterprise IT, 61 OT and 78 cloud actions; 596 action-in-domain questions in total
What ASD Essentials requires
Who it applies to
- Australian organisations that used the Essential Eight as their baseline, including Commonwealth entities and their suppliers
- Critical infrastructure responsible entities running OT, using the OT chapter alongside SOCI CIRMP obligations
- Organisations running mostly SaaS or PaaS, where the cloud chapter makes the shared responsibility split explicit
- Managed service providers and suppliers asked to evidence ASD-aligned security to customers
ASD Essentials is the Australian Signals Directorate's evolution of the Essential Eight, published on 15 October 2026. Instead of eight mitigation strategies and a single maturity level, it sets out principles, the actions that achieve them and the domains they apply to, in separate chapters for enterprise IT, operational technology (OT) and cloud.
Every chapter groups assets into domains with similar risk: two capability domains, Governance and culture and Visibility and response, and technical domains such as boundary services, identity services, critical processes and services, privileged environments, business systems and user devices (the OT chapter has no user devices domain). Priority phases set the order ASD recommends: for enterprise IT and cloud, boundary and identity services come first; for OT, boundary services and critical processes and services.
Actions are rated Not effective, Partially effective or Fully effective for each domain, and for enterprise IT ASD publishes indicators of good practice for each rating. Posture is reported by domain, so a board sees where outcomes are achieved and where they are not. Existing Essential Eight controls carry forward where they achieve the outcome, but maturity levels do not convert.
How GRCLens supports ASD Essentials
ASD Essentials runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Scoping wizard
Multiple-choice questions on what you operate, your obligations, risk and environment (cloud service models, safety systems, remote access into OT) load only the questions that apply, with a live count.
Indicators of good practice
Tick the enterprise IT indicators that are true and ASD's rule suggests the rating; ratings the indicators do not support are flagged as conflicts.
Dashboards for each reader
Board, risk owners, CISO, assessor, OT operations and cloud owner views, plus an Essential Eight transition view that carries your existing levels forward.
Baseerah evidence checks
Baseerah reviews uploaded evidence, checks whether it supports the rating, caps the recommendation at what the evidence proves, and writes summaries for each audience.
Continuous assurance
An owner, effectiveness testing, review dates and tasks for every chapter-domain, with key risk indicators for critical gaps, indicator conflicts and accepted risks.
ASD Essentials frequently asked questions
What is ASD Essentials?
ASD Essentials is the Australian Signals Directorate's successor to the Essential Eight, published on 15 October 2026. It describes principles, actions and domains in chapters for enterprise IT, operational technology and cloud, and reports security posture by domain rather than as one maturity level.
Does ASD Essentials replace the Essential Eight?
ASD describes the Essentials as an evolution of the Essential Eight. Existing Essential Eight controls contribute where they achieve the required outcome, but Essential Eight maturity levels do not convert into Essentials ratings, so each action is still assessed.
Which chapter should we start with?
ASD suggests starting from what you operate, what you are required to do, where the biggest gap is and where the greatest risk is. On-premises, hybrid or IaaS environments usually start with enterprise IT; organisations running mostly PaaS or SaaS usually start with cloud; OT operators weigh the consequence of compromise to physical processes.
How is an ASD Essentials assessment rated?
Each action is rated Not effective, Partially effective or Fully effective for each domain it applies to, and a principle takes the lowest rating of its actions. For enterprise IT, ASD's assessment evidence guide lists indicators of good practice for each rating.
Can GRCLens reuse our Essential Eight assessment?
Yes. GRCLens imports your Essential Eight levels and shows which Essentials principles and actions each strategy contributes to, so you can see where existing investment carries forward and where new work is needed.
One platform, many obligations
See all supported frameworks → Every framework that applies in Australia →
Talk to us about ASD Essentials
Security Solution Consultants provides ASD Essentials explained alongside the platform, so you can combine tooling with hands-on expertise.