ASD Essentials readiness assessment for Australian small business
ASD Essentials is replacing the Essential Eight over time. Its cloud chapter covers organisations whose technology is delivered entirely as cloud services, which describes many small businesses on Microsoft 365. We check where you stand against it, show who is responsible for each action, and give you a plan in ASD's own priority order.
From $1,490 · 3–5 day delivery · Fixed quote, no hourly billing
What ASD has said
The facts, before you buy anything
- ASD launched ASD Essentials on 15 October 2026, calling it “an evolution of Australia's widely adopted Essential Eight framework” (ASD news release).
- It is “written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations” (ASD FAQ). Smaller businesses “can still use this guidance where relevant” (Essentials for cloud).
- During the transition, ASD will keep both the Essential Eight and the Essentials on cyber.gov.au. No switch-over date has been set: ASD says it will advise on transition expectations in due course.
- Essential Eight maturity level ratings “do not automatically convert” into Essentials ratings (Transitioning from the Essential Eight).
- An independent assessor is not required. Organisations “may choose to engage an independent assessor, but this is not required” (Implementation planning guide).
This assessment is a readiness check and gap analysis. It is not a certification and not a formal ASD rating.
ASD sources checked on 1 November 2026. General information, not legal or compliance advice.
What we assess
The cloud chapter, applied to your Microsoft 365
Essentials for cloud groups its actions into eight domains. We review each one as it applies to your tenant, including backups, admin access, identity and the devices your staff use. If you still run a server or an office network, we tell you which parts of Essentials for enterprise IT apply to it, so nothing falls between the two chapters.
Identity services
Sign-in, multi-factor authentication, Conditional Access and legacy authentication in Entra ID.
Privileged environments
Admin roles, admin centres and how and where administrators sign in.
Boundary services
Connected apps, integrations, consent grants and anything your tenant exposes to the internet.
Business systems
Exchange, SharePoint, Teams, Power Automate flows and the other SaaS apps you rely on.
Critical processes and services
The functions your business cannot run without, such as invoicing and client files.
User devices
The laptops and phones staff use to reach Microsoft 365, including device management where you have it.
Governance and culture
Executive accountability, supplier assurance and a record of who is responsible for what.
Visibility and response
Audit logging, alerting and an incident response plan that covers a tenant compromise.
Who does each action
The cloud chapter marks every action with where the work usually sits. We use the same three terms, explained in our ASD Essentials guide, so you can see what is yours, what Microsoft provides but you must switch on, and what you only need to check.
Customer
You deliver and operate the control yourself.
Supplied
Microsoft supplies the capability, but you must enable, configure and operate it.
Provider-inherited
Microsoft delivers the outcome; your task is to check the assurance evidence.
How it works
Four steps. Read-only access.
Discovery call
We learn how your business runs, which cloud apps you use and who supports them. No preparation required on your end.
Environment review
With read-only Global Reader access, we review your Microsoft 365 tenant against the cloud chapter's actions and record who is responsible for each one. No admin access is needed and nothing is changed.
Findings report
Indicative findings for each action, the evidence register and the priority plan in plain English, with a one-page summary for the owner.
Debrief & Q&A
45-minute walkthrough of the findings with your team. No jargon. Just honest answers about what matters and what can wait.
What you get
Gap findings you can act on
Indicative findings for each action
Every in-scope action rated with ASD's four terms (not assessed, not effective, partially effective, fully effective), clearly labelled as gap findings.
Evidence register
For each control, what would show it keeps working, and where that evidence lives in your tenant.
Essential Eight crosswalk
If you have Essential Eight results, we map them to the Essentials actions so earlier work is reused where it is still current.
Priority plan
Gaps ordered by ASD's priority phases, so the first fixes are the ones ASD recommends first.
One-page owner summary
Where you stand and what to decide, written for the owner, including the executive accountability the framework expects.
45-min debrief
Walkthrough with your team: what matters first, what can wait, and what to ask your IT provider.
Rating terms follow ASD's assessment process guide.
Pricing
Fixed quote, no hourly billing.
Every service has a starting price for a typical small business. After a short scoping call we give you a fixed quote based on your users, devices and systems. That quote doesn't change unless the scope does.
Start here
Readiness Assessment
From $1,490
3–5 days · Fixed quote
- One Microsoft 365 tenant, up to 20 users
- Indicative findings for each in-scope action
- Responsibility map (Customer, Supplied, Provider-inherited)
- Evidence register
- Priority plan and one-page owner summary
- 45-min debrief
Essential Eight to Essentials Re-map
From $590
1 day · Fixed quote
- For an Essential Eight audit from the last 12 months
- Crosswalk from your Essential Eight results
- Evidence you can reuse, and what needs refreshing
- Outcomes the Essential Eight did not cover
- Priority plan in ASD order
Fixing the gaps is quoted after the assessment. For Microsoft 365 hardening, see the Audit + M365 Hardening and Audit + Full Remediation tiers.
Common questions
Do I have to switch from the Essential Eight now?
No. ASD has not set a switch-over date and says it will advise on transition expectations in due course. Until regulators communicate changes, ASD says organisations should keep meeting their current obligations, and it does not recommend stopping Essential Eight uplift work that is already approved. A readiness assessment shows what the change will mean for you before anyone asks.
Does my Essential Eight maturity level carry over?
Not automatically. ASD says Essential Eight maturity level ratings do not convert into Essentials ratings, because the two measure different things. Your earlier work still counts: every Essential Eight strategy maps to at least one Essentials principle, and existing evidence can be reused where it is still current and relevant. If you had an Essential Eight audit in the last 12 months, our Re-map (from $590) turns those results into an Essentials gap list.
Do I need an independent assessor?
No. ASD's implementation planning guide says organisations may choose to engage an independent assessor where proportionate and affordable, but this is not required. An outside review helps find gaps that have become normal through familiarity, which is what we add. Our findings are indicative gap findings, not a formal ASD rating.
Is this a certification?
No. It is a readiness check and gap analysis. You get indicative findings using ASD's rating terms, clearly labelled as gap findings, not a certification or a formal ASD rating. The report is suitable to provide to insurers, tender assessors or clients who ask how you are preparing, and acceptance is their decision.
How is this different from your $900 Security Audit?
The Security Audit measures you against the Essential Eight maturity levels, which many insurer questionnaires, tenders and contracts still ask about. This assessment looks at the new framework: whether each ASD Essentials action achieves its outcome in your Microsoft 365 environment, who is responsible for it, and what evidence shows it keeps working. If someone asks you about the Essential Eight today, start with the audit. If you want to plan for what comes next, start here.
What access do you need?
Read-only access to your Microsoft 365 tenant through the Global Reader role. We don't need admin rights, passwords to staff accounts or access to client data, and nothing in your tenant is changed. We send you a checklist of exactly what is needed before we start.
Still asked about the Essential Eight?
Security Audit & Risk Review
Essential Eight gap analysis with maturity level scores and a risk register. From $900.
Background
ASD Essentials explained for small business
What changed from the Essential Eight, what did not, and why the cloud chapter fits a Microsoft 365 business.
Find out where you stand under ASD Essentials
Book a free 30-minute call. We'll talk through how your business runs on Microsoft 365 and give you a fixed quote for the assessment.
Book a free callFrom $1,490 · Brisbane QLD · Serving all of Australia