On 15 October 2026, the Australian Signals Directorate (ASD) published ASD Essentials, the framework that evolves and replaces the Essential Eight.
Much of what was written after ASD flagged the change in June had to guess at the detail. The detail is now public: a chapter for enterprise IT, separate chapters for cloud and operational technology, a transition guide and a new way of assessing and reporting security posture.
This article sets out what’s changing, what stays the same and what to do first.
At a glance
- Your Essential Eight controls still count. Every mitigation strategy maps to at least one principle in the new framework.
- Your maturity level doesn't carry over. ASD is explicit that maturity ratings don't convert into the new ratings.
- The question has moved from "is the control in place?" to "can you prove it's working?"
- There's no formal transition date yet. Keep your current program running.
| Area | Essential Eight | ASD Essentials |
|---|---|---|
| Built around | Eight mitigation strategies, focused on technologies | Eight domains, grouping systems that share risks |
| Progress measured by | Maturity levels 0 to 3 | Effectiveness ratings for each action in each domain |
| Where to start | Choose a target maturity level | Work through three priority phases in ASD's recommended order |
| Requirements | Prescriptive and solution-specific | Principles and actions, outcome-driven and technology-agnostic |
| What gets assessed | Whether specific controls are implemented | Whether each action achieves its intended outcome, with evidence |
What exactly is changing
Eight strategies become eight domains
The Essential Eight organised security around eight mitigation strategies. ASD Essentials organises it around what your systems do. It uses three layers: principles (the outcome you need), actions (what you do to achieve it) and domains (where it applies).
The enterprise IT chapter has six technical domains: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems and User devices. Two capability domains, Governance and culture, and Visibility and response, apply across all of them.
A domain is defined by what an asset does, not what it is. A Windows server running your directory sits in Identity services. A Windows server supporting day-to-day operations, such as your intranet, would typically sit in Business systems. The same control can be rated differently in each.
Maturity levels become priority phases
Instead of choosing a target maturity level, organisations work through three priority phases:
- Phase 1: Boundary services and Identity services
- Phase 2: Critical processes and services, and Privileged environments
- Phase 3: Business systems and User devices
ASD is clear that a phase is a sequence, not a score. In its Implementation planning guide, priority phases “provide an implementation sequence, not a measure of security, compliance or maturity”.
Note the order. Identity and internet-facing systems come first, ahead of staff laptops and desktops. Stephanie Crowe, head of ASD’s Australian Cyber Security Centre, told iTnews that if those devices aren’t secure, attackers can get into the network easily.
"Is it configured?" becomes "is it working?"
Each action is now rated in each domain as not assessed, not effective, partially effective or fully effective. A principle takes the rating of its weakest action, and boards see a percentage score for each domain.
The bigger change is what counts as proof. Assessors consider four things: coverage, consistency, currency and evidence quality. ASD’s Assessment process guide puts it plainly: “Deployment is not effectiveness.” A screenshot of a policy setting shows a control exists. It doesn’t show the control is working across every asset in scope, today.
New ground the Essential Eight never covered
ASD Essentials brings in areas the Essential Eight maturity model never assessed, including:
- executive cyber security accountability
- cyber security resourcing
- supplier cyber security assurance
- AI accountability
- content filtering
- cyber security awareness training
- cyber supply chain security
Detection and incident response are brought together in the Visibility and response domain. Executive accountability is now something an assessor rates, not something assumed.
What's staying the same
Your investment. ASD’s FAQ says that in most cases, controls implemented under the Essential Eight “will directly satisfy, or substantially contribute to” a corresponding action. Crowe told iTnews there is “no wasted investment”.
Your program. ASD “does not recommend slowing or stopping” approved uplift initiatives. Keep going, and check alignment with the new framework as you go.
Your obligations. If a contract, regulator or insurer names an Essential Eight maturity level, that obligation stands until the relevant authority says otherwise. The Essential Eight stays on ASD’s website, and iTnews reports that government agencies will be assessed against both frameworks next year.
The calendar, for now. When ASD first announced the change in June 2026, it said it expected to retire the Essential Eight within two years. Since the 15 October launch, ASD says it will advise on transition expectations “in due course”.
What doesn't carry over: your maturity level
This is the point to get right. ASD’s transition guide says maturity level ratings “do not automatically translate into effectiveness ratings”, because “the two approaches assess different things”. ASD instead treats your maturity level as a starting point:
- Maturity Level 3: a broader range of controls and evidence is likely to be reusable.
- Maturity Level 2: many controls contribute to the early priority phases.
- Maturity Level 1: a useful foundation, with more actions likely to need uplift.
Whatever your level, a gap analysis is still required. ASD lists “claiming equivalence instead of assessing” among the common transition pitfalls.
Is ASD Essentials meant for your organisation?
ASD writes the series primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations. It also says smaller organisations can use the guidance where relevant, and that its security outcomes “are equally important for smaller organisations”.
Even if no one requires you to adopt it, the outcomes it describes are the ones attackers test. Knowing where your evidence stands is worth doing either way.
What to do now
- Keep your current program running. Nothing in the new framework makes completed Essential Eight work redundant.
- Establish a transition baseline. This is ASD’s first recommended step: record your posture using your Essential Eight maturity, existing controls, risk assessment results and key business functions.
- Scope your priority phase 1 domains. Start with the systems that sit at your boundary or decide who to trust, such as internet-facing services, edge devices, directories and authentication services, alongside Governance and culture, and Visibility and response. ASD is clear that scoping isn’t an organisation-wide discovery exercise.
- Test your evidence, not just your controls. For each control, ask whether it covers every asset in scope, whether it’s applied the same way everywhere, whether the evidence is current, and whether that evidence was generated by a system or asserted by a person. ASD treats an exception that has expired without re-approval as a finding.
- Brief your board with ASD’s own question. ASD’s guidance for senior executives suggests they ask: “What did our Essential Eight investment buy us under the ASD Essentials framework, and what is genuinely new work?”
- Involve your providers. Supplier cyber security assurance is now a principle, and ASD expects organisations to involve relevant third-party providers, including managed service providers, in their assessments.
Where to start
If you want to know what your Essential Eight controls prove today, our Live Security Posture Assessment gathers technical evidence from your endpoints, re-assesses it every 24 hours and delivers findings in 28 days. That gives you a current, evidence-based starting point for your transition baseline.
FAQs
What is ASD Essentials?
ASD Essentials is a principles-based cyber security framework published by the Australian Signals Directorate on 15 October 2026. It has separate chapters for enterprise IT, cloud and operational technology. Each chapter is built on three layers: principles (the security outcome), actions (what to do to achieve it) and domains (where it applies).
Does ASD Essentials replace the Essential Eight?
Yes. ASD describes ASD Essentials as an evolution of the Essential Eight, and the enterprise IT chapter is its direct successor. The Essential Eight remains on ASD's website during the transition, and any obligation that names an Essential Eight maturity level still applies until the relevant authority says otherwise.
When do organisations have to transition to ASD Essentials?
ASD hasn't set a firm date. When it first announced the change in June 2026, ASD said it expected to retire the Essential Eight within two years. Since the 15 October launch, it says it is working with regulators and will advise on transition expectations "in due course". In the meantime, ASD recommends continuing current Essential Eight uplift programs while assessing alignment with the new framework.
Does my Essential Eight maturity level carry over?
No. ASD states that maturity level ratings do not automatically convert into ratings under ASD Essentials, because the two frameworks measure different things. Your maturity level is a useful starting point, but a gap analysis is still required.
Do my existing Essential Eight controls still count?
Yes. Every Essential Eight mitigation strategy maps to at least one ASD Essentials principle. ASD says that in most cases, existing controls will directly satisfy or substantially contribute to a corresponding action. Some controls will need extending to cover more assets or a broader outcome.
What are the ASD Essentials priority phases?
The priority phases are ASD's recommended order for addressing domains in the enterprise IT chapter:
- Phase 1 covers Boundary services and Identity services.
- Phase 2 covers Critical processes and services, and Privileged environments.
- Phase 3 covers Business systems and User devices.
The phases are a sequence, not a measure of maturity or security.
How is ASD Essentials assessed?
Each action is rated in each domain as not assessed, not effective, partially effective or fully effective. Assessors consider coverage, consistency, currency and evidence quality, and evidence that a control has been deployed is not enough on its own. A principle takes the rating of its weakest action, and boards see a percentage score for each domain.
Is ASD Essentials only for government and large organisations?
ASD writes the series primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations. It also says smaller organisations can use the guidance where relevant, and that its security outcomes are equally important for them.
