Published by ASD on 15 October 2026
ASD Essentials: what comes after the Essential Eight.
The Australian Signals Directorate has published its replacement for the Essential Eight. There are no maturity levels and no single score. Here is how it works, and what it means for the Essential Eight work you have already done.
15 Oct 2026
Published by ASD
3
Chapters released
8
Enterprise IT domains
No date
For Essential Eight retirement
Current at 17 October 2026. Checked against ASD's own publications on cyber.gov.au.
What was released
Three chapters, all published at once.
ASD Essentials is a series rather than a single document. Each chapter covers a type of environment, and you use the one that matches yours. The draft went to public consultation from 15 June to 12 July 2026, and the final versions of all three chapters went live on cyber.gov.au on 15 October.
Alongside the chapters, ASD released a transition guide for Essential Eight users, an implementation planning guide, an assessment process guide and a briefing for senior executives. It has said more chapters will follow but has not named them.
Essentials for enterprise IT
The direct successor to the Essential Eight. It covers the identities, servers, laptops, email and business systems a normal organisation runs, whether on premises or in Microsoft 365.
Essentials for cloud
For organisations whose environment is delivered entirely through software and platform services, with no infrastructure of their own to harden.
Essentials for operational technology
For the industrial control systems that run critical infrastructure. The Essential Eight was never written for these environments.
How it is built
Outcomes first, then the steps to reach them.
The Essential Eight told you which eight controls to deploy. ASD Essentials tells you the outcome you need and leaves more room in how you get there. Each chapter has three layers. Principles are the security outcomes, taken from the cyber security principles in the Information Security Manual. Actions are what has to be done to meet each principle. Domains are the parts of the business the actions apply to.
Essentials for enterprise IT has eight domains. Two are capability domains that run across everything. The other six are technical, and they are where the actual systems sit.
Capability domains
Governance and culture
Executive and board accountability, risk appetite, resourcing, supplier assurance and legacy systems.
Visibility and response
Central logging, detection, and an incident response capability that has been tested.
Technical domains
Boundary services
Internet-facing systems: firewalls, VPNs, remote access gateways and other edge devices.
Identity services
The directory and sign-in systems, such as Entra ID or Active Directory, that every other control depends on.
Critical processes and services
The functions the business cannot run without, and the systems behind them.
Privileged environments
Admin accounts, admin workstations and the tools used to manage everything else.
Business systems
Line-of-business applications, file storage, email and collaboration platforms.
User devices
Staff laptops, desktops and mobiles, which is where most Essential Eight effort used to go.
Priority phases
An order of work, not a maturity level.
ASD groups the six technical domains into three phases and recommends working through them in order. It is explicit that a phase is a sequencing mechanism and not a rating. Reaching phase 2 says how much you have covered, not how secure you are. You can change the order if your risks call for it, as long as you document why.
Phase 1
The front door
Boundary services, Identity services
ASD puts edge devices and identity first because that is where attackers get in. A compromised VPN appliance or global admin account undoes most of what sits behind it.
Phase 2
The crown jewels
Critical processes and services, Privileged environments
Once the perimeter and identity layer hold, the work moves to the systems the business depends on and the accounts that can change them.
Phase 3
Everything else
Business systems, User devices
Endpoints and day-to-day applications come last in the recommended order. That is close to the reverse of how most Essential Eight programs were run.
Governance and culture, and Visibility and response, apply in every phase and grow as more technical domains come into scope.
How it is assessed
Is it working, everywhere it should be?
Every action is rated in every domain it applies to. A principle's rating in a domain is set by its weakest action, which ASD calls the weakest link rule. One material gap holds the whole principle back.
Assessors look at coverage, consistency, how current the control is, and the quality of the evidence. Having a tool switched on is not enough. ASD's assessment guide puts it in four words: “Deployment is not effectiveness.”
Results go to the board as a percentage per domain instead of one maturity level, which makes it harder to hide a weak area behind a good average.
Not assessed
Neutral. Kept separate from a failure so gaps in scope are visible.
Not effective
The action is missing, or it is in place and does not achieve its outcome.
Partially effective
Working in places, with gaps in coverage, consistency or evidence.
Fully effective
Working everywhere it applies, kept current, with evidence to show it.
The transition
The Essential Eight is still current. For now.
ASD will keep both frameworks on cyber.gov.au through the transition, and the November 2023 Essential Eight maturity model is still the current version. ASD's guidance is that, until regulators announce changes, organisations should keep meeting the obligations they have now. If a contract, insurer or government policy asks for Maturity Level 2, that is still the requirement.
There is no official deprecation or retirement date. When ASD first announced the change in June 2026, an ACSC official put deprecation at about 12 months and retirement at about 24. Those figures have been repeated widely, but they came from an interview and do not appear in the published guidance. ASD's FAQ says it will advise on timing in due course.
Your existing work is not wasted. ASD's transition guide maps every Essential Eight strategy to at least one Essentials principle and says existing controls and evidence can generally be reused. What does not carry over is the score. A maturity level does not convert into an effectiveness rating, and ASD warns that even Maturity Level 3 does not automatically mean fully effective. ASD also recommends against pausing uplift work that is already underway.
Side by side
Essential Eight vs ASD Essentials.
| Essential Eight | ASD Essentials | |
|---|---|---|
| Published | 2017, maturity model last revised November 2023 | 15 October 2026 |
| Approach | Eight prescribed mitigation strategies | Security outcomes (principles) with required actions |
| What gets rated | Each strategy, ML0 to ML3 | Each principle, per domain, on effectiveness |
| Headline score | One maturity level | None. Reported domain by domain |
| Governance | Not assessed | Board and executive accountability required |
| Detection and response | Logging and response steps inside some strategies | Its own capability domain |
| Order of work | Typically endpoints first | Edge and identity first |
| Certificate | No | No |
| Written for | All organisations, including SMBs | Government, critical infrastructure, large organisations |
Weighing these against SMB1001 as well? Our article on SMB1001 vs Essential Eight vs ASD Essentials covers which one a small or mid-sized business should actually work to.
Who it is for
Written for large organisations. Useful to everyone.
ASD says the series is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations. That is a narrower audience than the Essential Eight, which cyber.gov.au also lists under small and medium business.
Small businesses can still use it where it fits, and ASD notes the outcomes matter just as much at that size. The difference is how you get there, with more of the work falling to your IT provider or software vendors. For a 20-person firm, a full domain-by-domain assessment is more than most customers or insurers will ask for.
For most SMBs the sensible plan is the Essential Eight as the technical baseline while it stays current, SMB1001 certification if customers want a certificate, and the Essentials phase 1 domains as the next thing to fix. Edge devices and sign-in security are where small businesses get hit too.
How we help
Moving from the Essential Eight
without starting again.
Map your Essential Eight work to Essentials
We take your existing maturity assessment and evidence, map each control to the Essentials actions it contributes to, and show where ML2 work counts and where it falls short.
Assess the phase 1 domains
An evidenced effectiveness rating for boundary services and identity services, plus the two capability domains, using ASD's assessment process. This is where ASD says to start.
Keep your current obligations covered
If a contract, insurer or regulator still names the Essential Eight, we keep rating you against it while the transition runs, so nothing lapses in the meantime.
Has ASD Essentials replaced the Essential Eight?
ASD published the Essentials series on 15 October 2026 and describes it as an evolution of the Essential Eight. Both frameworks stay on cyber.gov.au during the transition, and ASD says organisations should keep meeting their current regulatory obligations until regulators announce changes. So the Essential Eight is still current today, but new work should be planned against Essentials.
When will the Essential Eight be retired?
ASD has not published a date. Its FAQ says it will advise on transition expectations in due course and is working with regulators on timeframes. The 12 and 24 month figures quoted since June 2026 came from an ACSC interview at the start of consultation, not from an ASD publication, so treat them as indicative only.
Is ASD Essentials the same as Cyber Essentials?
No. Cyber Essentials is a UK government certification scheme run by the National Cyber Security Centre, with five technical controls and an optional audited Cyber Essentials Plus. ASD Essentials is the Australian Signals Directorate's framework and has no certificate. The names are close enough that people mix them up, and some Australian suppliers are asked for UK Cyber Essentials by British customers.
Does my Essential Eight maturity level carry over?
Not directly. ASD says maturity levels do not automatically translate into effectiveness ratings, because the two approaches assess different things. Your controls and evidence do carry over. A business at Maturity Level 2 should find much of that work counts toward the phase 1 and phase 2 actions, but it still needs to be assessed against the new actions rather than assumed to be fully effective.
Is there an ASD Essentials certification?
No. Like the Essential Eight, it produces an assessment, not a certificate. ASD's assessment process guide is written for organisations assessing themselves, and it notes that active testing may need suitably qualified external help. ASD has said it will develop an assessor training course. If you need a certificate to show customers, SMB1001 or ISO 27001 is still the route.
Does a small business need ASD Essentials?
ASD says the series is written primarily for Commonwealth entities, critical infrastructure and large organisations. Small and medium businesses can use it where relevant, and the outcomes matter just as much, but how they are achieved will differ and more of the work sits with your IT provider. For most SMBs the practical choice is still the Essential Eight as a control baseline, SMB1001 if customers want a certificate, or both.
What does ASD Essentials add that the Essential Eight did not cover?
Mostly governance. The Essential Eight never assessed board accountability, and logging and incident response only appeared as steps inside some of the eight strategies. Essentials for enterprise IT makes executive accountability for cyber security a formal principle, gives visibility and response its own domain, and adds supplier assurance, legacy systems and accountability for AI use.
Start with phase 1
Find out where your Essential Eight
work lands under Essentials.
Bring your last Essential Eight assessment, or none at all. We map what you have onto the domains ASD says to fix first, and the plan you leave with still satisfies whatever your contracts name today.
General guidance, not legal or compliance advice. Current at 17 October 2026. Sources: ASD's 15 October announcement, Essentials for enterprise IT, Transitioning from the Essential Eight and the Essentials FAQ.