A plain-English guide to ASD Essentials, the successor to the Essential Eight published by the Australian Signals Directorate on 15 October 2026. The series has chapters for enterprise IT, cloud (SaaS and PaaS) and operational technology, and uses three layers: principles, actions and domains. It groups systems into eight domains (Governance and culture, and Visibility and response, apply across everything; Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems and User devices are tackled in three priority phases). Priority phases are an order of work, not maturity levels, and organisations no longer pick a target level. Each action is rated not assessed, not effective, partially effective or fully effective. Essential Eight maturity levels do not convert, but existing controls and evidence carry forward where current. ASD has not set a transition date and says organisations with Essential Eight obligations should keep meeting them. ASD wrote the series mainly for government, critical infrastructure and large organisations; smaller businesses can use it where relevant. Includes where each of the eight controls now sits, what's new, five steps for a business with 5 to 50 staff, and mistakes to avoid. Published by StartCloud, Perth, 12 November 2026.
Cybersecurity guide
The Essential Eight is changing: what ASD Essentials means for your business
5.0on GoogleMicrosoft Solutions Partner
The three things to know
ASD Essentials is the successor to the Essential Eight. It swaps maturity levels for priority phases, and checks whether each control is working, not just whether it's switched on.
Your Essential Eight work still counts. Controls and evidence carry forward where they're current. The maturity level itself doesn't convert.
There's no switch-over date yet. Insurers, clients and tenders will keep asking about the Essential Eight for a while, so keep the basics strong and plan the move in ASD's order.
What ASD announced, and why
On 15 October 2026 the Australian Signals Directorate, the agency behind the Australian Cyber Security Centre, published the ASD Essentials series. It's the next version of the Essential Eight, the list of eight controls Australian businesses have been measured against for years.
The series is split into chapters for different kinds of technology: enterprise IT, cloud, and operational technology such as industrial control systems. ASD says more chapters may follow.
The reason is practical. Most businesses no longer run everything on servers in a back room. They use a mix of cloud apps, laptops that work from anywhere and a few systems on site, and attackers have changed with them. A fixed list of controls with maturity levels fitted that world less and less well, so ASD has moved to a framework built around outcomes and where the risk sits.
ASD's own summary of the transition puts it simply: "Existing investment carries forward, but it is assessed differently."
Essential Eight and ASD Essentials, compared
The new framework has three layers. Principles describe the security outcome you're after. Actions describe what needs doing to get there. Domains describe where in your business each action applies.
| Essential Eight | ASD Essentials |
|---|---|
| Eight mitigation strategies, each with a list of requirements | Principles (the outcome you want) supported by actions (what to do) |
| Maturity levels zero to three, and you pick a target | No target level. Priority phases set the order of work, and they are not a score |
| Requirements applied across the whole environment | Eight domains, so each action is applied where the risk sits |
| Assessed against specific requirements | Each action rated not assessed, not effective, partially effective or fully effective |
| Deployment evidence usually enough | Evidence that the control keeps working over time |
Eight domains, three phases
Instead of applying every control across the whole business, ASD Essentials groups your systems into eight domains with similar risks. Six cover your technology. Two cover how you run security, and they apply everywhere.
The six technical domains are tackled in three priority phases. A phase is the order ASD recommends you work in, starting where effort cuts the most risk soonest. It is not a level, a rating or a badge.
Phase 1
- Boundary services
- Identity services
Anything facing the internet, and sign-in
Phase 2
- Critical processes and services
- Privileged environments
Your most important systems, and admin access
Phase 3
- Business systems
- User devices
Everyday business apps, laptops and phones
Across all phases
Governance and culture
Who's accountable, how risk is managed, and the security habits of your team.
Across all phases
Visibility and response
Logging, spotting trouble early, and a tested plan for when something goes wrong.
Where each of the eight controls lives now
Every one of the eight maps to at least one principle in ASD Essentials. The work you've done is still the right work. What changes is how far it has to reach and how you prove it's working.
| Essential Eight control | Now part of these ASD Essentials principles |
|---|---|
| Application control | Trustworthy software; Secure configuration management |
| Patch applications | Vulnerability management; Asset identification; Legacy system management |
| Patch operating systems | Vulnerability management; Asset identification; Legacy system management |
| Multi-factor authentication | Identity, credential and access management |
| Restrict administrative privileges | Identity, credential and access management; Least privilege access; Secure administration; Network segmentation and segregation |
| Restrict Microsoft Office macros | Trustworthy software; Secure configuration management |
| User application hardening | Secure configuration management; Content filtering |
| Regular backups | Regular and proven backups; Least privilege access |
A few examples of how controls stretch. Multi-factor authentication now sits inside a wider identity principle that also covers removing unused accounts, storing passwords and keys securely, and turning off old sign-in methods. Macro settings become part of approved configuration baselines that you check for drift. Backups need to be isolated from everyday systems and tested against the recovery times you've agreed.
What the Essential Eight didn't cover
Some of the new principles have no Essential Eight equivalent. Plenty of businesses already do parts of these, they just weren't measured before.
Governance and accountability
Named executive accountability for cyber security and for AI, proper resourcing, checking your suppliers, and a plan for legacy systems.
Knowing what you have
An inventory that covers identities, credentials and data, not just devices and software.
Visibility and response
Logging, detection and incident response pulled into one domain that runs alongside everything else.
Content filtering
Blocking connections to known malicious or untrusted destinations, beyond browser settings.
Staff awareness training
Now a principle in its own right, where the Essential Eight left it out.
Supply chain security
The software, services and providers you rely on are part of your security picture.
The AI accountability principle is worth a second look if your team uses Copilot, ChatGPT or Claude. ASD treats AI as another asset to scope and govern, which lines up with the work in our AI security service.
Does your maturity level still count?
Your work counts. Your level doesn't convert. That's the part most people will want to know.
The Essential Eight measured whether specific controls were in place, at levels matched to more and more capable attackers. ASD Essentials asks a different question: is each action achieving its intended outcome for the systems in each domain? Each action gets one of four ratings: not assessed, not effective, partially effective or fully effective. "Not assessed" is neutral. It means nobody has checked yet, not that it's failing.
Because the two measure different things, ASD is clear that a maturity level doesn't turn into a rating, not even Maturity Level Three. What does carry forward is the evidence behind it: configuration records, policies, assessment reports and test results, as long as they still reflect how things are today.
If you reached Maturity Level Two, expect many of your controls to line up with the early phases. If you were working towards Maturity Level One, expect more of the actions to need work. Either way, the next step is the same: a gap analysis using what you already have.
What it means for a business with 5 to 50 staff
ASD wrote the series mainly for Commonwealth agencies, critical infrastructure and large organisations. It says smaller businesses can use it where relevant, and it keeps separate, simpler guidance for small business.
So a 15-person accounting firm isn't the audience ASD had in mind. What does reach smaller businesses is the questions. Cyber insurance renewals, larger clients' supplier questionnaires and WA Government tenders ask about the Essential Eight today, and some will move to the new language over time. The WA Government Cyber Security Policy still refers to Essential Eight Maturity Level One, and that stays the expectation until the state updates it.
The other thing worth knowing is which chapter fits. If your business runs on Microsoft 365 and other cloud apps with no servers of your own, ASD's cloud chapter is likely the closer fit, and it spells out which security jobs sit with Microsoft and which stay with you. If you still have a server in the cupboard or your own network to look after, the enterprise IT chapter applies too.
Most of the early work lands in Microsoft 365 anyway: sign-in, admin access, device settings and logging. If you're on Business Premium, you already pay for most of the tools.
Five things to do now
None of this needs a compliance department. It follows the order ASD recommends, sized for a smaller business.
Write down where you are
Your last Essential Eight assessment or self-check, what's in place, what's planned and any exceptions. ASD calls this the transition baseline.
Keep your promises
If an insurer, client, contract or tender asks about the Essential Eight, keep answering in those terms. ASD says the same.
Don't chase a level for the score
ASD advises against starting work just to reach a superseded Essential Eight target, unless someone still requires it or it fixes a real risk.
Start with sign-in and the internet edge
Phishing-resistant multi-factor authentication, tight admin access and anything exposed online. That's phase one, where ASD says to start.
Collect proof that controls work
Restore tests, sign-in reports, monitoring records and review notes. Under the new approach, showing it keeps working matters more than showing it was switched on.
Not sure where you stand on the eight today? Our free Essential Eight checklist takes about five minutes, and the answers make a good transition baseline.
Six mistakes to avoid
Treating priority phases as maturity levels
They're an order of work. Finishing phase one doesn't make you "phase one compliant".
Assuming your old level converts
Your evidence is the starting point. Your level doesn't translate into a rating.
Judging the whole business at once
A control can work well in one domain and only partly in another. Each domain is looked at on its own.
Leaving governance and monitoring until last
They run alongside all three phases from the start.
Trying to do everything at once
Use the phases to focus effort. Spreading the work across every domain at once slows everything down.
Relying on stale evidence
A restore test from two years ago, or an expired exception, doesn't prove much today.
The takeaway
Don't panic, and don't throw anything away. The Essential Eight controls are still the right foundation, and the people asking you about them will keep asking for a while.
Use the change as a reason to check two things: that your controls cover the systems that matter most, and that you can show they keep working. That's what ASD Essentials asks for, and it's what an insurer wants to see after an incident anyway.
If you'd like a hand, our Essential Eight to ASD Essentials gap analysis follows ASD's steps: it records where you are, picks the right chapter, and shows what's already covered, what's partly covered and what's missing, with a costed plan to close the gaps.
Where this comes from
Everything here comes from ASD's own publications, all free on cyber.gov.au. We read them on 12 November 2026, and we'll update this page when ASD announces transition timing.
Transitioning from the Essential Eight
Australian Signals Directorate
How each of the eight maps to the new principles, what carries forward, and ASD's recommended transition steps. Published 15 October 2026.
What is the Essentials?
Australian Signals Directorate
The structure of the series: principles, actions and domains, and the chapters for enterprise IT, cloud and operational technology.
ASD Essentials: frequently asked questions
Australian Signals Directorate
Why the change, who the series is for, and ASD's position on transition timing.
Essentials for cloud
Australian Signals Directorate
The chapter for organisations that run entirely on software-as-a-service and platform-as-a-service, including who is responsible for what.
Small business hub
Australian Signals Directorate
ASD's separate, tailored guidance for small businesses.
Common questions
Has the Essential Eight been scrapped?
Not scrapped, superseded. ASD published ASD Essentials on 15 October 2026 and describes it as an evolution of the Essential Eight. The Essential Eight and its maturity model are still published, and the eight controls remain the foundation of the new framework.
When do we have to switch to ASD Essentials?
There's no date yet. ASD says it is working with regulators on timing and will advise. Until then, anyone with obligations written in Essential Eight terms, such as a contract, an insurer or a government policy, should keep meeting them.
Does our Maturity Level One or Two still mean anything?
The work does. The level itself doesn't convert, because the two frameworks measure different things. ASD Essentials rates each action in each domain, and your existing controls and evidence are the starting point for that, as long as they're current.
Is ASD Essentials meant for small businesses?
ASD wrote it mainly for Commonwealth entities, critical infrastructure and large organisations, and says smaller businesses can use it where relevant. ASD also publishes separate small business guidance. For most businesses with 5 to 50 staff, the practical path is to keep the Essential Eight basics strong and adopt the new approach where it helps.
Which chapter applies to a business on Microsoft 365?
If you run on Microsoft 365 and other cloud apps with no servers of your own, the cloud chapter is likely the closer fit. If you still run servers, a file server or your own network, the enterprise IT chapter applies too. Many Perth businesses sit across both.
Is there an ASD Essentials certification?
No, and there's no Essential Eight certification either. Be wary of anyone selling one. What insurers, clients and assessors want is evidence that your controls are in place and working.
This article is general information based on ASD publications as at 12 November 2026. ASD will publish transition timing and may update the framework. Check cyber.gov.au for the current version before relying on it for a contract or compliance decision.