On 15 October 2026 the Australian Signals Directorate published ASD Essentials, a principles-based framework it describes as the evolution of the Essential Eight. If you have spent years climbing the Essential Eight maturity levels, the short answer is: your work still counts, your current obligations still stand, and new work should now be planned against ASD Essentials.
What ASD Essentials is
ASD Essentials is a series of chapters, one per technology environment. It launched with three: enterprise IT (the direct successor to the Essential Eight), cloud, and operational technology for industrial and building systems.
Each chapter uses the same three layers. Principles describe the security outcome you should achieve. Actions describe what you need to do to get there. Domains describe the business functions and assets the actions apply to. The enterprise IT chapter groups its domains into priority phases that tell you what to tackle first.
What is different from the Essential Eight
- No maturity levels. Priority phases sequence the work; ASD is clear they are not maturity or assurance ratings, so there is no simple “Maturity Level Two equals X” translation.
- Domains instead of one whole-of-network standard. Systems with similar risks are grouped and protected accordingly, so effort goes where the business impact is.
- New ground. The enterprise IT chapter includes principles with no direct Essential Eight equivalent, including content filtering, cyber security awareness training, cyber supply chain security, and visibility and response.
- Outcomes over checklists. The Essential Eight measured whether specific controls were in place; ASD Essentials measures whether outcome-based actions are achieved.
What has not changed
ASD is keeping both frameworks published on cyber.gov.au during the transition. Contracts, panels, insurers and policies that name an Essential Eight maturity level still mean the Essential Eight until whoever set the requirement says otherwise.
And your investment carries forward. ASD’s transition guidance says every Essential Eight mitigation strategy maps to at least one principle in the enterprise IT chapter, and existing controls will often satisfy or contribute to one or more actions. Multi-factor authentication, patching, backups and admin privileges are still the foundations.
Keep meeting the Essential Eight obligations you have today, and plan every new piece of security work against ASD Essentials.
Five things to do this quarter
- List where the Essential Eight is written into your obligations: contracts, tenders, insurance forms, board policies. Those stay as they are for now.
- Establish a transition baseline. Map your current controls and evidence to the principles and actions in the enterprise IT chapter. ASD recommends this as the first step.
- Scope your domains. Decide which systems and business functions matter most; that is where the first priority phase should land.
- Close the new gaps. Awareness training, content filtering, supplier security and logging with someone actually watching are often the weakest areas for small and mid-sized businesses.
- Brief your board in one page: what changed, what it costs to adapt, and the order you will do it in.
If you never started the Essential Eight
You can go straight to ASD Essentials; ASD says organisations that have not implemented the Essential Eight do not need the transition guidance. Start with the enterprise IT chapter and its first priority phase.
We assess against both frameworks and give you a single gap map. Book a free refinement or read about our ASD Essentials and Essential Eight service.
Sources
- 1.Transitioning from the Essential Eight, Australian Signals Directorate
- 2.What is the Essentials?, Australian Signals Directorate
- 3.ASD Essentials: evolving our approach to cyber security resilience, Australian Signals Directorate
- 4.Essentials for enterprise IT, Australian Signals Directorate
