ASD has launched the Essentials, the successor to the Essential Eight. What changes for your business

The Australian Signals Directorate (ASD) has launched the ASD Essentials, the framework that will take over from the Essential Eight. ASD’s announcement, published on 15 October 2026, calls it “an evolution” of the Essential Eight, built to cover a wider range of technology than the original eight strategies.

If you, your IT provider or a client has been working towards an Essential Eight maturity level, the short version is: nothing stops today. ASD says organisations should keep meeting their current regulatory obligations until regulators communicate changes, and it will keep both the Essential Eight and the Essentials on cyber.gov.au, with their supporting guidance, during the transition.

Our plain-English guide to the Essential Eight still describes the framework most businesses are being asked about. This story covers what has changed.

What the Essentials is

The Essentials is a series of chapters, each for a different type of technology environment. The first three are:

• Enterprise IT, which ASD describes as an evolution of the Essential Eight
• Operational technology, for critical infrastructure operators protecting their operational technology environments
• Cloud, for organisations whose technology is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS)

ASD has also published guidance on how AI-enabled systems fit within the framework. Its FAQ says the Essentials treats AI as another asset to be included when scoping.

Each chapter uses the same three layers, according to ASD’s overview. Principles describe the security outcomes to achieve. Actions describe what needs to be done to get there. Domains group the business functions and assets the actions apply to, such as identity services or user devices.

What changes from the Essential Eight

No more maturity levels. The Essential Eight asked organisations to reach Maturity Level One, Two or Three. The Essentials instead sets out priority phases: the order in which ASD recommends tackling each domain. ASD stresses that phases are “a sequencing mechanism, not a rating”. In the enterprise IT chapter, phase one covers boundary services (internet-facing services and edge devices) and identity services (directories, sign-in and credential stores), because those are common ways attackers get in. Phase two covers critical processes and services and privileged environments, and phase three covers business systems and user devices. Two capability domains, governance and culture and visibility and response, apply from phase one onwards.

Effectiveness, not just deployment. Each action is rated not effective, partially effective or fully effective for the assets in scope (or not assessed, if it hasn’t been yet). ASD’s transition guidance says evidence that a control was switched on may not be enough. Assessors look for evidence that it keeps working as intended, such as testing, monitoring records or exercise results.

Wider scope. The enterprise IT chapter adds areas the Essential Eight didn’t directly cover, including executive accountability for cyber security, supplier security assurance, content filtering, staff security awareness training and cyber supply chain security. Its identity principle covers more than multi-factor authentication (MFA): accounts, credentials and how they are stored are included too, and both the enterprise IT and cloud chapters call for phishing-resistant MFA.

What happens to Essential Eight work already done

ASD says it carries forward. Every Essential Eight mitigation strategy maps to at least one principle in the Essentials, and in most cases existing controls “directly satisfy, or substantially contribute to” a corresponding action, according to the FAQ.

The catch is that ratings don’t transfer. ASD says Essential Eight maturity levels “do not automatically convert” into effectiveness ratings, because the two measure different things. Its advice is to use existing evidence as the starting point for a gap analysis. ASD also says organisations shouldn’t slow down or stop Essential Eight uplift work already under way, but should keep going while assessing how it lines up with the new framework.

When will regulators require it?

ASD hasn’t set a date. Its FAQ says it has been talking to regulators about the impact and expected timeframes, and “will advise on expectations for transitioning to the new framework in due course”. ACSC head Stephanie Crowe told iTnews that work on a regulatory transition timeframe would run over the next year or two.

Does it apply to small businesses?

Not directly. ASD says the Essentials is written mainly for Commonwealth entities, critical infrastructure owners and operators, and large organisations. Small and medium businesses that don’t run IT at enterprise scale “can still use this guidance where relevant”, and ASD continues to publish separate guidance for small businesses, home offices and individuals.

The cloud chapter is the one most small businesses will recognise themselves in. It is written for organisations that run no servers of their own and rely on cloud productivity and collaboration suites and other business apps. It explains which security jobs the customer keeps (identity, data, settings, connected apps and checking the provider’s own assurance) and which sit with the provider. ASD’s chapter guide says organisations that mainly use SaaS or PaaS should start with the cloud chapter, and those with their own servers, a hybrid setup or infrastructure-as-a-service should start with enterprise IT.

On our reading, the practical pressure on smaller businesses is more likely to come from customers, insurers and contracts that currently ask about the Essential Eight, and those questions may start referring to the Essentials as regulators and agencies move across.

Checklist

• Keep current Essential Eight work going. ASD advises against slowing or stopping uplift programs already under way.
• Ask your IT provider which Essentials chapter fits your business. ASD suggests the cloud chapter for businesses that mainly use SaaS or PaaS, and the enterprise IT chapter for those with their own servers or a hybrid setup.
• Record where you stand now. Write down your Essential Eight maturity, existing controls, risk assessment results and key business functions as a starting point for a gap analysis.
• Start with identity and internet-facing systems. These are the first priority phase in the enterprise IT chapter: internet-facing services, edge devices, directories and sign-in services.
• Check whether your MFA is phishing-resistant. Both the enterprise IT and cloud chapters call for phishing-resistant MFA for users signing in to systems.
• Check contracts and insurance that mention the Essential Eight. Ask the client or insurer whether, and when, they will move to the Essentials.