ASD Essentials Is Here: What the Essential Eight Replacement Means for a Microsoft 365 Small Business

What ASD released

ASD calls the Essentials “an evolution of Australia's widely adopted Essential Eight framework” (ASD, 15 October 2026). Instead of one document, it is a series of chapters. Three were published together:

• Essentials for enterprise IT, the direct successor to the Essential Eight.
• Essentials for operational technology, for critical infrastructure operators.
• Essentials for cloud, for organisations whose technology is delivered entirely as software-as-a-service (SaaS) and platform-as-a-service (PaaS).

ASD says it will keep both the Essential Eight and the Essentials on cyber.gov.au during the transition, and that organisations should keep meeting their current regulatory obligations until regulators say otherwise.

Is it meant for small businesses?

Not primarily. ASD names Commonwealth entities, critical infrastructure and large organisations as the audience. But the cloud chapter also says this, and the FAQ says much the same:

“Small and medium sized businesses that do not operate at enterprise scale can still use this guidance where relevant. The security outcomes described by the principles within the Essential series are equally important for smaller organisations. What differs is how those outcomes are achieved and how much responsibility sits with service providers and vendors.” (ASD, Essentials for cloud)

For everyday guidance, ASD still points small businesses to its small business hub. The Essentials is the direction of travel, not a new checklist you must complete.

Why the cloud chapter fits a Microsoft 365 business

Many small businesses run no servers at all. Email, files and Teams live in Microsoft 365, the accounts are in Xero, and a handful of other web apps fill the gaps. That is a SaaS environment, which is exactly what the cloud chapter covers.

ASD is candid that much of the enterprise guidance describes work your provider now does for you, such as running and hardening servers and operating networks. The cloud chapter instead focuses on the areas that decide your security as a customer: identity, data, configuration, applications, integrations and provider assurance.

It also marks every action with who usually does the work:

The “Supplied” category is where small businesses most often get caught out. Microsoft 365 includes strong security features, but many of them do nothing until someone switches them on and sets them up properly. ASD's cloud shared responsibility guidance for small and medium businesses explains the same split in plain language.

One detail matters if you use automation. ASD says that where an organisation makes significant use of customer-configurable features in a SaaS product, such as low-code app building, scripting or automation, it should treat those parts like a platform service, with the extra responsibility that brings. If your business runs on Power Automate flows or connected apps, those integrations are now squarely in scope.

What changes from the Essential Eight

• Outcomes instead of a fixed list. Principles describe the security outcome, actions describe what to do, and domains describe where it applies.
• No more maturity levels. They are replaced by priority phases, which set the order of work. ASD is clear they are not maturity or assurance ratings.
• Assessed on whether it works. An assessment asks whether each action achieves its intended outcome, looking at coverage, consistency, currency and evidence quality (ASD, Transitioning from the Essential Eight).

Does your Essential Eight work still count?

Yes. ASD says organisations that implemented the Essential Eight “have already made significant investments” and that “that investment remains valuable”. Every Essential Eight strategy maps to at least one Essentials principle.

Two cautions. First, maturity level ratings do not automatically convert into the new effectiveness ratings, so a past “Maturity Level One” is a starting point for a gap analysis, not a pass. Second, ASD advises: “Do not initiate work solely to achieve a superseded Essential Eight target unless it remains required by a regulator or other obligation or continues to address material cyber security risk.” In practice, keep the controls that protect you, and stop chasing a maturity number for its own sake.

When does the Essential Eight go away?

There is no date yet. ASD's FAQ says it is talking to regulators about expected timeframes and “will advise on expectations for transitioning to the new framework in due course.” If a client, tender or insurer asks about the Essential Eight today, that question is still valid.

What a small business should do now

Our free Microsoft 365 security check takes about two minutes and shows where your setup stands. The Essential Eight self-check is still a useful baseline while both frameworks are live, and our earlier article on the retirement announcement covers the background.

This article summarises ASD guidance published on 15 October 2026 and checked on 19 October 2026. It is general information, not security or compliance advice. Check cyber.gov.au for the current versions.