# ASD Essentials and what small businesses should do [Read the public page](https://www.adarkcloud.com.au/blog/asd-essentials-small-business) ASD has released Essentials. Here's what changes for small businesses using Microsoft 365, Google Workspace and cloud services. By Josh C, A Dark Cloud Creative Published 2026-10-15 ASD released Essentials on 15 October 2026 with chapters for enterprise IT, cloud and operational technology. Small businesses can use the relevant advice to improve security. Existing obligations still apply, and ASD has not announced a universal migration deadline. Start by checking access, recovery and who is responsible for the services you already use. ## Your working inbox is a starting point Your team can send email and open its shared files. That tells you the service is available today. It leaves a few useful questions unanswered. Can a former employee still sign in? Could someone who takes over your administrator account delete the backups? Who would notice a suspicious new connection to your files? The Australian Signals Directorate (ASD) released its Essentials series on 15 October 2026. It builds on the Essential Eight and adds separate guidance for cloud services and operational technology. The useful response is to check your own setup before buying a new security package. ## What has changed since the Essential Eight The Essential Eight grouped work around eight mitigation strategies. Essentials organises security outcomes around principles, actions and domains. A domain groups functions and assets with similar risks, such as identity services or the systems used for administration. Governance and culture, and visibility and response, continue throughout the work. For enterprise IT and cloud, the recommended technical sequence starts with boundary and identity services. Critical services and privileged environments follow, then business systems and user devices. These phases describe an implementation order. Completing a phase does not award a maturity level. The broader view matters when a business has good device protection but poorly controlled administrator access, or a backup product that nobody has restored from. Each control needs a purpose and evidence that it keeps delivering it. ## Does every small business have to migrate now ASD's main audience for the release is Commonwealth entities, critical infrastructure operators and large organisations. Its FAQ says smaller businesses can use the relevant guidance, while its Small Business Hub remains a useful starting point. The launch announcement says organisations should continue meeting current regulatory obligations until regulators communicate changes. ASD will maintain Essential Eight and Essentials during the transition. There is no universal migration deadline in this release. A contract or sector requirement may still direct what your business must do. If someone is selling an urgent compulsory migration to every sole trader, ask them to identify the obligation that applies to you. ## Microsoft 365 and Google Workspace still need an owner A subscription does not decide which staff should see the payroll folder or which external app should be allowed to read customer email. Those are decisions for your business. The cloud chapter separates work the customer performs, capabilities the provider supplies for the customer to configure, and outcomes the provider delivers that still need suitable assurance. The exact split depends on the service and your agreement. For a small team, we would review administrator access and account recovery alongside external sharing, connected applications and available audit logs. Check what your actual subscription supports before proposing a setting. Buying a larger licence without an operating plan can leave the same gaps in a more expensive account. ## Keep the useful work you have already done Your existing patching, application restrictions, backups and MFA remain useful. ASD's transition guide explains how Essential Eight work can contribute to Essentials, provided the controls and evidence remain relevant. An old maturity result does not automatically become an Essentials effectiveness rating. Review where the control applies and how it operates now. A recovery test from before a major system change may need repeating. An exception with an expired approval needs attention. Map committed security work before changing the plan. Continue work that addresses a material risk or an existing obligation. Avoid starting work solely to chase an old target without checking whether that target still serves the business. ## Ask for evidence you can use A statement that backups are enabled is less useful than a dated restore result for an important file and its permissions. An access policy is more useful when you can show that it covers the intended accounts and that exceptions are reviewed. Essentials assesses outcomes using four statuses. An action can be not assessed, not effective, partially effective or fully effective. Partial effectiveness requires a demonstrated security benefit. Starting the project is not enough. Ask your IT provider to explain the scope, the evidence and the gaps. If the provider also marks its own work, understand what was independently checked and what remains an assertion. A neat percentage should never conceal something that has not been assessed. ## Include AI agents and everyday automation A Microsoft 365 agent, a Power Automate flow or a website integration may have access that outlives the person who created it. Record its owner, the information it can read and the actions it can perform. Our practical starting point is to test with limited permissions and sample data. Require approval before consequential actions such as changing payment details or sending customer communications. Review whether an agent can reach files that staff have shared too broadly. ASD's AI guidance treats models, data, integrations and non person identities as part of the environment. Prompt injection remains a risk to manage. Restricting the damage an agent can cause is more credible than promising that a prompt will make it safe. ## What we would do first for a small team Start with a short record of the accounts and services that keep the business operating. Include the domain registrar, email administrator, website host and backup service. Confirm the business can recover them without relying on a former supplier. Then check the exposed access paths and the identities with the power to change everything. Plan phishing resistant authentication where supported, with a tested recovery route. Find unsupported devices and services, agree the remediation work, and give the important backup a controlled restore test. Finish with named responsibilities. Someone needs to review alerts, remove access when people leave and chase unfinished repairs. A small team can keep this record simple. It still needs an owner and a review date. These are our practical priorities, rather than a claim that this short list completes Essentials. ## What if you run physical equipment A business running building controls, industrial machinery or other systems that affect a physical process should check whether the OT chapter applies. Its priority order differs from enterprise IT, and safety and operational constraints affect change decisions. Do not send an ordinary office patching or scanning job straight into a live control system. Establish the equipment owner and an approved method before testing or changing it. ## Does Essentials replace the Essential Eight overnight ASD describes Essentials as an evolution and is maintaining both frameworks during the transition. Existing Essential Eight obligations continue until the relevant authority changes them. ## Does this guide provide a formal assessment This article and our practical guide do not provide a formal assessment or certify your business. Ask what any proposed assessment covers, which method it uses and what evidence supports its findings. ## Should a cloud business use only the cloud chapter Choose chapters around what you operate and control. A business using SaaS may also control laptops, network equipment, custom applications or infrastructure. More than one chapter can be relevant. ## Where to start in Perth or remotely A Dark Cloud Creative helps small businesses in Perth and works remotely across Australia. We can scope a review around the systems you use, the access you control and the work that matters first. Use the practical guide alongside this article to collect the records before a review. If you need help, tell us how many people you support, which services you use and what would stop the business trading. We can agree a sensible scope from there. ## Further reading - [ASD launch announcement](https://www.cyber.gov.au/news/asd-essentials-evolving-our-approach-to-cyber-security-resilience) - [What is the Essentials](https://www.cyber.gov.au/publication/what-is-the-essentials) - [Essentials for enterprise IT](https://www.cyber.gov.au/publication/essentials-for-enterprise-it) - [ASD frequently asked questions](https://www.cyber.gov.au/publication/frequently-asked-questions) - [ASD Small Business Hub](https://www.cyber.gov.au/small-business-hub) - [Essentials for cloud](https://www.cyber.gov.au/publication/essentials-for-cloud) - [Asset scoping guide for cloud](https://www.cyber.gov.au/publication/asset-scoping-guide-for-cloud) - [Transitioning from the Essential Eight](https://www.cyber.gov.au/publication/transitioning-from-the-essential-eight) - [Assessment process guide](https://www.cyber.gov.au/publication/assessment-process-guide) - [Assessment evidence guide for enterprise IT](https://www.cyber.gov.au/publication/assessment-evidence-guide-for-enterprise-it) - [AI considerations within the Essentials](https://www.cyber.gov.au/publication/ai-considerations-within-the-essentials) - [Microsoft guidance on orphaned Power Automate flows](https://learn.microsoft.com/en-us/troubleshoot/power-platform/power-automate/flow-management/manage-orphan-flow-when-owner-leaves-org) - [Implementation planning guide](https://www.cyber.gov.au/publication/implementation-planning-guide) - [Asset scoping guide for enterprise IT](https://www.cyber.gov.au/publication/asset-scoping-guide-for-enterprise-it) - [Implementing multi factor authentication](https://www.cyber.gov.au/publication/implementing-multi-factor-authentication) - [Essentials for OT](https://www.cyber.gov.au/publication/essentials-for-ot) - [Which chapter should I start with](https://www.cyber.gov.au/publication/which-chapter-should-i-start-with) ## Useful next steps - [Read the practical ASD Essentials guide](https://www.adarkcloud.com.au/guides/asd-essentials-small-business-guide) - [The Essential Eight explained](https://www.adarkcloud.com.au/blog/the-essential-eight-what-perth-business-owners-need-to-know) - [Small business security support](https://www.adarkcloud.com.au/services/cyber-security) - [Microsoft 365 security](https://www.adarkcloud.com.au/services/microsoft-365-security) - [Start an IT health check](https://www.adarkcloud.com.au/tools/it-health-check) - [Discuss your setup](https://www.adarkcloud.com.au/contact) Reviewed 2026-10-15 - [Ask for IT help](https://www.adarkcloud.com.au/contact) - [Check your IT basics](https://www.adarkcloud.com.au/tools/it-health-check)