In October 2026 the Australian Signals Directorate evolved the Essential Eight into the ASD Essentials. No transition deadline has been published. A fixed-fee, independent assessment against Priority Phase 1, built so the evidence you already hold is the starting point.
ASD's own transition guidance opens by saying it "has evolved the Essential Eight into the ASD Essentials for enterprise IT", and its FAQ heads a question "Why is ASD replacing the Essential Eight?". No transition deadline has been published, and ASD has said it will advise on timing in due course. That leaves a specific and awkward question for anyone who has already invested: what happens to the work you have done?
Your board approved an Essential Eight programme. The reasonable next question is whether it still counts, and nobody has given them an answer.
Your insurer, your contracts or your regulator still name the Essential Eight by name, so you cannot simply stop meeting it while the ground shifts.
Maturity levels do not convert. ASD is explicit that an Essential Eight maturity level does not translate into an Essentials effectiveness rating, so the gap has to be genuinely assessed.
Personally owned devices, a shared device fleet or a Mac environment made several Essential Eight controls impractical, so you parked them and the programme quietly stalled.
You have heard the Essentials has eight domains and three priority phases, and that is roughly where the information stops.
Across our own assessments this year, not one organisation that had begun an Essential Eight programme had finished it. The reasons were consistent, and structural rather than a matter of effort: unmanaged or personally owned devices broke the control model, the guidance assumes a Windows fleet, and the binary maturity answers made honest organisations look worse to their insurer than they deserved.
ASD groups the Essentials into eight domains across three priority phases. This assessment covers Priority Phase 1, which is ASD's own recommended starting point. Each domain is rated against ASD's Indicators of Good Practice as not effective, partially effective or fully effective. We do not invent a scoring scale, and we do not quietly convert your old maturity levels into new ratings.
Who owns cyber risk, how it reaches the board, and whether the people doing the work have the authority to do it.
What you can actually see across your environment, and what happens in the hours after something is spotted.
The controls at the edge of your environment, including the ones that stop working the moment a device leaves the building.
Authentication, privileged access and account lifecycle, assessed against how your environment is really configured rather than how the licence suggests it could be.
Reviewed and carried forward where it stands up. Where it does not map across, we say so and explain why, rather than restating old scores under new headings.
ASD publishes a dedicated AI chapter within the Essentials. It applies whether you consume, build or deploy AI, and it treats AI services, prompts and outputs as assets in scope.
Priority Phases 2 and 3 are covered as a roadmap rather than assessed, so you finish with a sequenced plan instead of a cliff. If you would rather assess all eight domains across all three phases in one engagement, that is our full-depth framework assessment, and we will quote it on request.
Every engagement produces the same four deliverables. The report is written for your board and leadership team, not for a security operations centre.
Plain English, Australian English. An effectiveness rating for each Priority Phase 1 domain, a gap register, and an explicit statement of which Essential Eight evidence carried forward and which did not. Evidence-linked throughout.
A single A4 page you can table without editing it first. Where you sit on each domain, what changed when the framework changed, and the top three actions with indicative cost. Written to answer the question a board actually asks.
A sequenced plan across the remaining domains, with indicative effort and cost over three time horizons. Built around your environment and your resourcing, not a generic checklist that assumes you have a security team.
A 60-minute call with your leadership team to walk the findings, agree priorities and owners, and take questions. Agenda sent 24 hours ahead. Then 30 days of email questions answered within two business days, at no extra charge.
Structured, time-boxed, and run around your schedule rather than ours. Gaps you disclose up front are findings, not failures.
Kick-off with your leadership team, then an evidence checklist you load into a folder you control. We review what exists, including any Essential Eight self-assessment, audit or penetration test you already hold. Structured interviews with your IT lead, your executive sponsor, and your managed service provider if you use one.
Each Priority Phase 1 domain rated against ASD's Indicators of Good Practice. Your existing Essential Eight evidence tested for whether it genuinely carries across. Gap register built, and the Phase 2 and 3 roadmap sequenced.
Report assembly, board one-pager, full quality pass. Plain English throughout, and every finding cites the evidence that produced it. Nothing is rated on an assertion.
Sixty-minute debrief with your leadership team. Deliverables pack handed over. The 30-day question window opens. No hard sell on what comes next.
Every assessment is delivered by Daniel Johns, Founder and Principal Consultant of Coastal Cyber. No account manager, no junior consultant doing the real work, no handoffs.
If, at the end of your debrief, you do not feel the assessment gave you a clear picture of where you stand and what to do next, we will refund your fee in full. No questions, no paperwork.
Insurance Professional indemnity and public liability cover in place. Certificates of currency available on request before the engagement commences.
We will talk about your environment, what you have already done against the Essential Eight, and whether a transition assessment is the right next step. If it is not, we will say so, and point you at what is.
Coastal Cyber · Sunshine Coast, QLD · dj@coastalcyber.com.au