# The Essential Eight for small business owners [Read the public page](https://www.adarkcloud.com.au/blog/the-essential-eight-what-perth-business-owners-need-to-know) Understand the Essential Eight, current obligations and the ASD Essentials transition. Scope a review with clear evidence and practical next steps. By Josh C, A Dark Cloud Creative Published 2026-02-10 The Essential Eight groups eight cyber security mitigation strategies. ASD released Essentials on 15 October 2026 and is maintaining both during transition. Keep meeting your current obligations, reuse relevant controls and evidence, and check which framework and assessment method your requirement names. ## Understand the eight strategies The strategies cover application control, application patching, Microsoft Office macro settings, application hardening, restricted administration, operating system patching, multi factor authentication and regular backups. They address different weaknesses and work together. A backup helps recovery while access restrictions and updates address other risks. A single setting should not be described as complete implementation. ## Start with the requirement Ask why the business needs a review. A customer contract may specify systems, maturity and evidence. A general improvement project may begin with a broader inventory and gap register. Provide the actual requirement to the person scoping the work. The word compliant on a proposal is not enough to establish what will be assessed. ## Distinguish a review from an assessment A checklist can identify questions and gaps. A formal assessment needs an agreed method and evidence of implementation and effectiveness. Independent assessment may be required by a particular contract or policy. The Essential Eight is a framework and maturity model rather than a general certification that every small business must obtain. Check the obligation that applies to your situation. ## Plan improvements with owners Record each gap, the proposed action, its dependencies and the person responsible. Some changes involve licences or devices; others involve access and maintenance habits. Set priorities against the business requirements and environment. Exceptions need deliberate treatment and review. A change that cannot be maintained is unlikely to remain effective after the initial project. ## Keep the broader environment in view The framework has a defined purpose and does not cover every risk in every system. Other controls and specialist advice may be needed. Review the current official model when setting the scope rather than relying only on an old summary. A useful engagement finishes with evidence, remaining gaps and responsibilities. It should explain what the business has achieved without claiming immunity from incidents. ## What evidence should you ask to see? Choose evidence that matches the control and the agreed systems. An update setting is different from evidence that devices received updates. A backup schedule is different from a successful restore. The assessment method needs to explain how those distinctions are tested. Keep the system inventory and exclusions with the result. A statement about a single laptop should not imply coverage of every account, server or cloud service. The official maturity model is the reference for the detail of each strategy. ## How do you make the work manageable? Begin with the required scope and an inventory, then establish the current position. Use a gap register to show the control, evidence, proposed change and owner. Some actions depend on changes to applications or devices, so agree on an order that the business can implement. Check important workflows after a control change. Record exceptions and the date for reviewing them. Maintaining the result matters because accounts, software and business requirements change after the initial review. ## ASD Essentials and the October 2026 transition The Australian Signals Directorate (ASD) released Essentials on 15 October 2026. The new series has chapters for enterprise IT, cloud and operational technology. ASD is maintaining Essential Eight and Essentials during the transition, and organisations should continue meeting their current obligations until the relevant authority changes them. This article explains the Essential Eight and its maturity model for work that still uses them. Our new ASD Essentials article explains the release, and the practical guide helps a small business collect useful records. Existing maturity results do not automatically convert into Essentials effectiveness ratings. Keep useful controls and current evidence, then check the scope and any remaining gaps. ## Further reading - [ASD Essential Eight maturity model](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model) - [ASD Essentials launch announcement](https://www.cyber.gov.au/news/asd-essentials-evolving-our-approach-to-cyber-security-resilience) - [ASD transition guidance](https://www.cyber.gov.au/publication/transitioning-from-the-essential-eight) - [ASD Essentials frequently asked questions](https://www.cyber.gov.au/publication/frequently-asked-questions) ## Useful next steps - [Essential Eight support](https://www.adarkcloud.com.au/services/essential-eight) - [Cyber security help](https://www.adarkcloud.com.au/services/cyber-security) - [ASD Essentials explained](https://www.adarkcloud.com.au/blog/asd-essentials-small-business) - [Practical ASD Essentials guide](https://www.adarkcloud.com.au/guides/asd-essentials-small-business-guide) Reviewed 2026-10-15 - [Ask for IT help](https://www.adarkcloud.com.au/contact) - [Check your IT basics](https://www.adarkcloud.com.au/tools/it-health-check)