Carry useful work forward
Essential Eight to ASD Essentials mapping
Keep the evidence that still holds up. Find where the scope changes. Use this guide to prepare an enterprise IT transition conversation, without assuming an automatic pass.
Independent guidance by SuperStack IT · Sources checked 28 October 2026
Your transition notebook
Existing control
↓
Current evidence
↓
Next check
Eight starting points. No automatic score.
Explore the mapping
What carries forward from the eight strategies?
The themes below paraphrase ASD’s official transition mapping. They are not the full action requirements. Expand a strategy for a practical evidence example and a question to take to your IT provider.
01 / Application controlTrusted software and controlled settings
Evidence to look for
An approved software list and a test showing an unapproved installer was blocked on a sample workstation.
A useful review question
Does the rule also cover the administrator's support tools, and who reviews exceptions?
02 / Patch applicationsVulnerabilities, asset records and ageing systems
Evidence to look for
A dated inventory of PDF readers, browsers and practice software, with deployment results tied to named devices.
A useful review question
Which client-work devices were offline during the last update, and who follows them up?
03 / Restrict Microsoft Office macrosTrusted software and controlled settings
Evidence to look for
An approved exception for a required workbook, its owner and the result of a safe macro-blocking test.
A useful review question
Can the practice still complete the work without giving every user the same exception?
04 / User application hardeningControlled security settings
Evidence to look for
The browser and PDF reader configuration actually applied to a staff device, rather than only the intended policy.
A useful review question
What happens when a user attempts to change a protected setting?
05 / Restrict administrative privilegesIdentity, minimal access, secure administration and separation
Evidence to look for
A list of administrative accounts, their owners and a completed review of an external support account.
A useful review question
Does a former provider still have access, and can ordinary staff work without administrator rights?
06 / Patch operating systemsVulnerabilities, asset records and ageing systems
Evidence to look for
A device report that distinguishes installed updates from pending restarts, with an owner for unsupported systems.
A useful review question
Are remote laptops and any servers hosting practice applications both included?
07 / Multi-factor authenticationIdentity and access protection
Evidence to look for
A record of the sign-in requirements applied to an in-scope service and a controlled test with a representative account.
A useful review question
Which payroll, email or document services still rely on a separate sign-in process?
08 / Regular backupsProven recovery and restricted access
Evidence to look for
A dated recovery rehearsal showing the restored version, elapsed time and whether the intended team could use it.
A useful review question
Could you resume a client job if the main sign-in service or document system was unavailable?
These examples are planning prompts from SuperStack IT. They are not sufficient evidence on their own and do not determine a maturity or effectiveness rating.
Turn the map into a working record
Download the transition worksheet
A CSV file you can open in Excel or another spreadsheet tool. Add your domain, evidence date, owner, gaps and next action against each starting point.
No email required. No information is uploaded when you download it. It is an eight-strategy starter, not a complete Essentials assessment.
Keep completed copies in approved business storage.
Beyond the mapping
Do not stop at eight rows
The new framework also requires attention beyond these familiar strategies. Plan ownership, supplier responsibilities, monitoring and incident response alongside technical work. ASD’s implementation guide sets out how to organise that program.
- Choose an important business workflow and name its dependencies.
- Record which evidence is current, incomplete or no longer representative.
- Agree who will check the uncovered systems, and when.
- Review changes safely before applying them to client work.
Need the background first? Read the ASD Essentials overview.
For an example from an accounting practice, read Essential Eight to ASD Essentials: what changes?
Questions before you start
Is this an official ASD mapping or an assessment?
No. This is SuperStack IT's short orientation to ASD's transition guidance, with our own planning examples. Follow the linked official mapping for full principle and action detail. This page does not assess your systems or award a rating.
Can an Essential Eight maturity level carry across?
There is no automatic conversion. Review the current controls, evidence and scope against the relevant Essentials actions and domains.
Is the worksheet a complete Essentials checklist?
No. It starts with the eight existing strategies. It does not include every Essentials action or the broader governance, monitoring and response work. Use it to organise a conversation, not to claim completion.
Do I need to submit an email to download it?
No. The CSV worksheet is available without registration. Keep completed worksheets in your approved business storage; they may contain sensitive details about your security.
From reading to a practical plan
Know what to keep. Know what to check.
Tell us which systems matter to your business and what evidence you already have. We can discuss scope, priorities and the help you need before agreeing on any work or fees.
- 01. Describe your environment
- 02. Discuss the evidence gaps
- 03. Agree the next step
Do not send passwords, client records or security reports through the enquiry form.
Sources and scope
- Official Essential Eight transition mapping
- Implementation planning guide
- Essentials assessment process guide
Checked 28 October 2026. These pages summarise guidance and offer planning examples. They are not an ASD publication, endorsement, certification or assessment of your organisation. Use the current official guidance for exact requirements and confirm any contractual or regulatory obligations separately.