On 15 October 2026 the published the Essentials series, the framework that will eventually replace the . All three chapters went live at once: enterprise IT, cloud and operational technology. If your business was working toward an Essential Eight , or weighing it up against , the choice now has three options instead of two.
They are not three versions of the same thing. Each was written for a different kind of organisation and measures something different. Only one gives you a certificate. This article sets out the differences and then answers the question most small and mid-sized businesses actually have, which is what to work to over the next year.
The short answer
If a contract or insurer names the Essential Eight, keep working to it. ASD is maintaining it through the transition and there is no retirement date yet.
If customers or insurers want a certificate, SMB1001 is still the option built for businesses your size. Nothing in the new ASD framework changes that.
If you are a large organisation or a government entity, plan your next round of work against ASD Essentials. It is written for you, and the regulators who reference the Essential Eight will eventually move to it.
For most SMBs the practical answer is a combination: the Essential Eight as the technical baseline, SMB1001 if a certificate helps you win work, and the first priority phase of ASD Essentials as the next thing to fix.
What each one is
The Essential Eight
Eight mitigation strategies published by ASD, first released in 2017. The maturity model was last revised in November 2023 and that version is still current. Each strategy is rated from Maturity Level 0 to Maturity Level 3, and an organisation usually quotes one overall level. It is free to self-assess and there is no certificate at the end. Commonwealth entities have been required to reach Maturity Level 2, and plenty of private contracts and insurance questionnaires now ask for the same.
SMB1001
A certifiable cyber security standard for small and medium businesses, published by Dynamic Standards International and certified through CyberCert. It has five levels, Bronze to Diamond, covering technology management, access management, backup and recovery, policies and processes, and staff training. The lower three levels are self-attested by a director. Platinum and Diamond need an independent audit. Certificates last 12 months and the standard is revised each year. The 2026 edition expanded Gold to 27 controls. It is not a government standard, but its recognition is growing: the Queensland Law Society recommends it, and ARNECC's draft version 8 of the Model Participation Rules names it alongside the Essential Eight and as a cyber safe harbour for conveyancers.
ASD Essentials
ASD's new principles-based framework. Instead of prescribing eight controls, each chapter sets out security outcomes (principles), the actions needed to meet them, and the domains of the business they apply to. , the chapter that replaces the Essential Eight for ordinary corporate IT, has eight domains. Two are capability domains, Governance and culture, and Visibility and response. Six are technical: boundary services, identity services, critical processes and services, privileged environments, business systems and user devices.
Each action is rated per domain as not assessed, not effective, partially effective or fully effective. A principle's rating in a domain is set by its weakest action. There is no single score: results are reported domain by domain. Like the Essential Eight, there is no certificate.
How they compare
Who each is written for
This is the difference that matters most for small businesses, and it is the one that gets missed. ASD says the Essentials series is "written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations". Small and medium businesses can use it where it is relevant, and ASD is clear that the outcomes matter just as much at that size. What differs is how you achieve them, and how much of the work sits with your IT provider.
The Essential Eight, by contrast, is used by businesses of every size, and cyber.gov.au still lists it under small and medium business. SMB1001 was written for SMBs from the start, with levels scaled to the size of the business.
What you get at the end
- Essential Eight: a maturity level per strategy, usually summarised as one level.
- SMB1001: a certificate at a named level, valid for 12 months, that you can show customers and insurers.
- ASD Essentials: an effectiveness rating per principle, per domain, reported as a percentage for each domain.
If a customer has asked you to prove your cyber security with a document they can file, only SMB1001 gives you that. An Essential Eight or Essentials assessment report can be evidence, but it is a report, not a certification.
What gets checked
The Essential Eight focused on technical controls on endpoints and servers: application control, patching, macros, application hardening, admin privileges, and backups. Logging and turned up inside several strategies at the higher maturity levels, but governance was never assessed at all.
ASD Essentials gives each of these its own place. Board and executive accountability for cyber security is a formal principle. Detection and incident response have their own domain. Supplier assurance, legacy systems and executive accountability for AI use all appear in the enterprise IT chapter.
SMB1001 sits in between. It includes policies, training and governance from its lower levels, and the 2026 edition added items such as , enforced , a digital asset register and at Gold.
The order of work
This is where ASD Essentials departs most from how Essential Eight programs have usually been run. ASD groups the technical domains into three priority phases. Phase 1 is boundary services and identity services, meaning firewalls, VPNs, remote access gateways and the directory that controls sign-in. Phase 2 is critical processes and services, and privileged environments. Phase 3 is business systems and user devices.
Many Essential Eight programs started with staff laptops, because that is where most of the eight strategies live. ASD now says to start at the edge and with identity, because that is where attackers get in. An exposed remote access appliance or a compromised account is a common starting point in the incidents we respond to, so we think the new order suits a 20-person firm as well as it suits a department.
Cost
The Essential Eight and ASD Essentials are both free to use and self-assess. The cost is the work, and an independent assessment if you want one. SMB1001 has an annual certification fee, from about $95 a year at Bronze, rising at the higher levels, with audit costs at Platinum and Diamond. Check current pricing with CyberCert.
Which one to work to now
Your contract or insurer names the Essential Eight
Keep going. ASD's guidance is that organisations should keep meeting their current obligations until regulators announce changes, and it specifically recommends against pausing uplift work that is already underway. A contract that says Maturity Level 2 still means Maturity Level 2 after 15 October. We have written separately about contract clauses that name the Essential Eight and what to do about them.
Customers want a certificate
SMB1001. Neither ASD framework gives you one. If you also need to show Essential Eight progress, much of the technical work overlaps, and DSI publishes a mapping between SMB1001 and the Essential Eight. Our SMB1001 certification guide covers the levels and costs.
You are a large organisation or a government entity
Start planning against ASD Essentials now. Use ASD's transition guide to map your existing Essential Eight controls and evidence to the new actions, then assess the phase 1 domains. Your maturity level will not convert into an effectiveness rating, because the two frameworks measure different things, so budget for a fresh assessment rather than a relabel.
You have not started any of them
Start with the Essential Eight for the controls and the ASD Essentials phase 1 domains for the order. Lock down your internet-facing devices and put -resistant multi-factor authentication on email and admin accounts. Then test a restore from backup. All of that counts under every one of the three frameworks. Choose SMB1001 when a customer or insurer asks for proof you can show them.
Do you have to choose?
No. The frameworks overlap heavily on the technical basics. Multi-factor authentication, patching, admin privileges and backups appear in all three. The differences are in what each asks you to prove and to whom.
A practical setup for a growing business is SMB1001 for the certificate and the Essential Eight for the contracts that name it, with ASD Essentials setting the order of the next piece of work. It is one program reported three ways.
What has not changed
- The Essential Eight is still current and ASD is maintaining it on cyber.gov.au.
- There is no official deprecation or retirement date. The 12 and 24 month figures quoted since June came from an interview at the start of consultation, not from ASD's publications.
- None of the three is legislated for private businesses. They become obligations through contracts, insurance, sector rules and government procurement.
- Your existing controls are not wasted. ASD maps every Essential Eight strategy to at least one Essentials principle.
Frequently asked questions
Is ASD Essentials the same as Cyber Essentials?
No. Cyber Essentials is a UK certification scheme run by the National Cyber Security Centre. ASD Essentials is the Australian Signals Directorate's framework and has no certificate. If a UK customer asks for Cyber Essentials, they mean the British scheme.
Will ASD Essentials become mandatory?
We expect so for Commonwealth entities, once the government updates the policies that currently reference the Essential Eight, but nothing has been announced. ASD says it is working with regulators on timeframes and will advise in due course. For private businesses it becomes a requirement only when a contract, insurer or sector regulator adopts it.
Can I get certified against ASD Essentials?
No. ASD's assessment process guide is written for organisations assessing themselves, with external help where active testing is needed. ASD has said it will develop an assessor training course, but there is no certification scheme.
Does SMB1001 map to ASD Essentials yet?
Not that we have seen. DSI publishes mappings to the Essential Eight, ISO 27001, UK Cyber Essentials and US CMMC. Given the overlap, we would expect an Essentials mapping in a future edition, but until DSI publishes one, any mapping is unofficial.
Our Essential Eight assessment is a year old. Should we redo it under Essentials?
If you are a large organisation or government supplier, yes, start with the phase 1 domains. If you are an SMB with contracts that name the Essential Eight, refresh it against the Essential Eight first and look at the Essentials phase 1 domains at the same time. Both can be done in one engagement.
If you would like help working out which framework fits, our Essential Eight assessment flags what changes under ASD Essentials, or you can talk to us about SMB1001 and the transition together.
