The Essential Eight has moved to ASD Essentials
On 15 October 2026 the Australian Signals Directorate released the ASD Essentials series, the evolution of the Essential Eight. ASD says previous Essential Eight maturity level ratings “do not automatically translate into effectiveness ratings”, so an organisation that relied on a maturity level now needs a fresh view of where it stands. Beyond Technology gives you that view independently: we sell no technology, remediation or managed services, so the findings are the product.
What ASD Essentials changes
- The eight mitigation strategies become principles and actions, assessed across eight domains of assets that share similar risks.
- Maturity levels give way to priority phases, which set the order of work. ASD is clear they are not a security rating.
- Each action is rated not assessed, not effective, partially effective or fully effective, in every domain where it applies.
- Governance is now assessed: executive and board accountability, resourcing, supplier assurance, AI accountability and legacy systems.
- Evidence has to show a control keeps working. In ASD’s words, “Deployment is not effectiveness”.
What our assessment gives you
- A transition baseline: what your existing Essential Eight controls and evidence already cover.
- A gap analysis by domain, in ASD’s own terms.
- A phased plan and funding view that follows ASD’s priority phases.
- A board-ready summary, including the governance items ASD now assesses.
If a regulator, contract or insurer still asks for an Essential Eight maturity level, we assess against the maturity model as well, so you can meet today’s obligations while you plan the move. Essential Eight assessment is also part of our Information Security and Privacy Health Check and Annual Cyber Security Health Check.
After you identified the root cause of our difficulties we have never looked back”
CFO | Financial Services Industry
I was astounded to see how reprioritising our IT could deliver such a material improvement in business outcomes”
MD | Large field services organisation
It’s the first time that I clearly understand how we engage our IT to change the status quo”
CEO | Large Professional Services Firm
Our business outcomes
Beyond Technology advise businesses on how to optimise the use of IT to achieve business outcomes.
Beyond Technology Consulting has several ways to help CFO’s and CIO’s to improve their organisation’s balance sheet. Our consultants are highly skilled in identifying how to optimise your IT costs to ensure that you are taking advantage of the technology available to your organisation.
Many organisations carry a significant IT failure risk without understanding either the potential or consequences of failure. Quantifying the latent risk, and taking steps to mitigate it not only makes good business sense, it often provides significant improvement in the efficiency and availability of “business as usual” IT service.
With the growing demands on IT departments it can be all too easy to focus on rapidly expanding capability and addressing the day-to-day challenges of running the technology. Properly aligning IT to direct business requirements, while improving the communication channels between IT and the business delivers massive efficiency and capability improvements.
Trusted By The Best
Frequently Asked Questions
Can’t find what you’re looking for? Drop us a line and we’d be happy to answers any questions you have.
In most professions where information is asymmetric (i.e. the professional could take advantage of knowing more about the subject that they are advising you on) such as Lawyers and Doctors, the governing body can deregister the professional as stop them from practicing. This does not happen with Technology professionals so conflict of interest is a critical problem. Similarly when a technologist is heavily invested in one specific technology it often becomes their go-to solution (to a man with a hammer, everything looks like a nail). By Maintaining our independence, Beyond Technology Consulting ensures that you are provided with unbiased and actionable advice that you can trust is free from conflict of interest and be assured that we are not monetising the advice that we provide you.
ASD Essentials is the Australian Signals Directorate’s evolution of the Essential Eight, released on 15 October 2026. It organises cyber security into principles and actions across eight domains, worked through in priority phases, and rates each action from not effective to fully effective. There are chapters for enterprise IT, cloud and operational technology.
It counts as a starting point, not as a rating. ASD says previous maturity level ratings do not automatically translate into effectiveness ratings, because the new framework assesses whether each action works in each domain. Most existing controls and evidence carry forward, and a gap analysis shows what still needs doing.
ASD’s documents set no transition deadline. Organisations whose regulatory or contractual obligations refer to the Essential Eight should keep meeting them as the relevant authority directs. For most private organisations, ASD Essentials is guidance rather than a mandate.
ASD makes independent assessment optional, and notes that independent assessors bring “a fresh perspective and judgement, helping to identify gaps and weaknesses that may have become accepted through familiarity”. An assessor that also sells the remediation has a stake in what it finds. Beyond Technology sells no technology, remediation or managed services.
“Actionable Advice” is accessible, accurate and is advice that is provided in a language and manner that does not require technical qualifications to understand. We ensure that our recommendations are fit-for-purpose with an understanding of the context of your organisation to be both affordable and achievable.
We focus on understanding the core requirements of the business so that our advice is based on your requirements not the avaliable technology. This ensures that you don’t end up with a solution looking for a problem and ensures that technology outcomes will grow with your business and flex with changes in the technology.
We focus on understanding the core requirements of the business so that our advice is based on your requirements not the avaliable technology. This combined with a bias towards flexible technology solutions helps to provide technology outcomes that will grow with your business and flex with changes in the technology.
There are two key reasons that organisations don’t undertake regular independent technology reviews. Firstly many boards and executive don’t know that organisations like Beyond Technology Consulting exist and they are left thinking that the only options are IT Audits that are provided by the big accounting firms that don’t provide any answers or actionable advice. The second reason is that they don’t feel that they understand enough about IT to be able to get value from a review. Beyond Technology Consulting understands this and have designed our organisation to provide “Actionable Advice” that is accessible, accurate and provided in a language and manner that does not require technical qualifications to understand.
Related Case Studies
Evidence of the outcomes we have achieved
Let's talk about your IT needs
Please fill out the form below to get in touch with one of our consultants
Not ready to talk yet? See how our independent cyber security audit works.