Essential Eight,
or ASD Essentials?
Both come from the Australian Signals Directorate, and they are not alternatives so much as different depths. The Essential Eight is eight mitigation strategies graded in maturity levels. ASD Essentials is the wider set of principles behind good practice, with chapters for Enterprise IT, operational technology and cloud. Most businesses start with the Eight; the ones who supply government or run plant end up needing both.
Both are included in every ProtectSMB GRC plan — ASD Essentials from the Enterprise plan up, or a $1,000 a year add-on below it
Swipe the table sideways to see the ASD Essentials column
| Side by side | Essential Eightmaturity model | ASD Essentialsthree chapters |
|---|---|---|
| What it is | ASD's maturity model for eight mitigation strategies, graded ML1 to ML3. | ASD's broader set of cyber security principles and the actions that deliver them. |
| How it is structured | Eight strategies. Each one has requirements at each maturity level. | Three chapters — Enterprise IT, operational technology and cloud — of principles grouped under govern, identify, protect, detect, respond and recover. |
| How much of it there is | 123 ISM controls across the eight strategies. | 197 actions across the three chapters, 58 of them in Enterprise IT. |
| How it is scored | A level is achieved all or nothing: every applicable requirement at that level has to be met. | Each action is not effective, partially effective or effective, judged against ASD's own Indicators of Good Practice. |
| What it covers best | The technical controls that stop the most common attacks on an office IT environment. | Governance, people and process as well as technology — including plant and cloud services the Eight never speaks to. |
| Operational technology | Not covered | A chapter of its own: vital OT, what cannot be patched, break-glass access, degraded-state access and whether you could run isolated. |
| Cloud services | Not covered | A chapter of its own, answered by who is responsible for what and what assurance evidence you hold from the provider. |
| Who usually asks for it | Insurers, customers, tender questionnaires, and most Australian small business guidance. | Government buyers, defence supply chains, critical infrastructure obligations and boards that want more than a technical baseline. |
| Where to start | Here, if nobody has asked you for anything specific. It is the shortest honest answer to 'are we doing the basics'. | Here, if you supply government or run plant — or once the Eight is in hand and you want the whole picture. |
Start with the Essential Eight if…
- Nobody has asked you for a specific framework yet.
- Your environment is an office IT environment: laptops, email, a few cloud apps.
- You need a number to give an insurer, a customer or a tender response.
- You want the shortest route to a defensible baseline.
Go to ASD Essentials if…
- You supply government, defence or critical infrastructure.
- You run operational technology — plant, control systems, a production line.
- Most of what you run is somebody else's cloud, and you need to prove assurance over it.
- Your board wants governance and recovery covered, not just the technical controls.
Already doing the Essential Eight?
Your work carries across. The transition wizard walks every Essential Eight answer you have given to the ASD Essentials action it satisfies, one confirmation at a time, and keeps a link back to where the answer came from. What the Eight does not cover is shown as net-new work rather than quietly assumed, so you can see the size of the step before you take it.