--- title: "Essential Eight to ASD Essentials: What Changes | StartCloud" url: https://startcloud.au/resources/essential-eight-to-asd-essentials description: "ASD is replacing the Essential Eight with ASD Essentials. What changed in October 2026, what carries over, and what smaller businesses should do now." lang: en --- A plain-English guide to ASD Essentials, the successor to the Essential Eight published by the Australian Signals Directorate on 15 October 2026. The series has chapters for enterprise IT, cloud (SaaS and PaaS) and operational technology, and uses three layers: principles, actions and domains. It groups systems into eight domains (Governance and culture, and Visibility and response, apply across everything; Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems and User devices are tackled in three priority phases). Priority phases are an order of work, not maturity levels, and organisations no longer pick a target level. Each action is rated not assessed, not effective, partially effective or fully effective. Essential Eight maturity levels do not convert, but existing controls and evidence carry forward where current. ASD has not set a transition date and says organisations with Essential Eight obligations should keep meeting them. ASD wrote the series mainly for government, critical infrastructure and large organisations; smaller businesses can use it where relevant. Includes where each of the eight controls now sits, what's new, five steps for a business with 5 to 50 staff, and mistakes to avoid. Published by StartCloud, Perth, 12 November 2026. Cybersecurity guide # The Essential Eight is changing: what ASD Essentials means for your business In October 2026 the Australian Signals Directorate published ASD Essentials, the successor to the Essential Eight. Here's what changed, what carries over, and what a business with 5 to 50 staff should do about it, without the jargon. ASD published 15 October 2026 StartCloud 12 November 2026 9 min read 5.0 on Google Microsoft Solutions Partner In brief ## The three things to know **ASD Essentials is the successor to the Essential Eight.** It swaps maturity levels for priority phases, and checks whether each control is working, not just whether it's switched on. **Your Essential Eight work still counts.** Controls and evidence carry forward where they're current. The maturity level itself doesn't convert. **There's no switch-over date yet.** Insurers, clients and tenders will keep asking about the Essential Eight for a while, so keep the basics strong and plan the move in ASD's order. What changed ## What ASD announced, and why On 15 October 2026 the Australian Signals Directorate, the agency behind the Australian Cyber Security Centre, published the ASD Essentials series. It's the next version of the Essential Eight (https://startcloud.au/learn/what-is-the-essential-eight), the list of eight controls Australian businesses have been measured against for years. The series is split into chapters for different kinds of technology: enterprise IT, cloud, and operational technology such as industrial control systems. ASD says more chapters may follow. The reason is practical. Most businesses no longer run everything on servers in a back room. They use a mix of cloud apps, laptops that work from anywhere and a few systems on site, and attackers have changed with them. A fixed list of controls with maturity levels fitted that world less and less well, so ASD has moved to a framework built around outcomes and where the risk sits. ASD's own summary of the transition puts it simply: "Existing investment carries forward, but it is assessed differently." Side by side ## Essential Eight and ASD Essentials, compared The new framework has three layers. Principles describe the security outcome you're after. Actions describe what needs doing to get there. Domains describe where in your business each action applies. | Essential Eight | ASD Essentials | | --- | --- | | Eight mitigation strategies, each with a list of requirements | Principles (the outcome you want) supported by actions (what to do) | | Maturity levels zero to three, and you pick a target | No target level. Priority phases set the order of work, and they are not a score | | Requirements applied across the whole environment | Eight domains, so each action is applied where the risk sits | | Assessed against specific requirements | Each action rated not assessed, not effective, partially effective or fully effective | | Deployment evidence usually enough | Evidence that the control keeps working over time | The new structure ## Eight domains, three phases Instead of applying every control across the whole business, ASD Essentials groups your systems into eight domains with similar risks. Six cover your technology. Two cover how you run security, and they apply everywhere. The six technical domains are tackled in three priority phases. A phase is the order ASD recommends you work in, starting where effort cuts the most risk soonest. It is not a level, a rating or a badge. Phase 1 - Boundary services - Identity services Anything facing the internet, and sign-in Phase 2 - Critical processes and services - Privileged environments Your most important systems, and admin access Phase 3 - Business systems - User devices Everyday business apps, laptops and phones Across all phases Governance and culture Who's accountable, how risk is managed, and the security habits of your team. Across all phases Visibility and response Logging, spotting trouble early, and a tested plan for when something goes wrong. What carries over ## Where each of the eight controls lives now Every one of the eight maps to at least one principle in ASD Essentials. The work you've done is still the right work. What changes is how far it has to reach and how you prove it's working. | Essential Eight control | Now part of these ASD Essentials principles | | --- | --- | | Application control | Trustworthy software; Secure configuration management | | Patch applications | Vulnerability management; Asset identification; Legacy system management | | Patch operating systems | Vulnerability management; Asset identification; Legacy system management | | Multi-factor authentication | Identity, credential and access management | | Restrict administrative privileges | Identity, credential and access management; Least privilege access; Secure administration; Network segmentation and segregation | | Restrict Microsoft Office macros | Trustworthy software; Secure configuration management | | User application hardening | Secure configuration management; Content filtering | | Regular backups | Regular and proven backups; Least privilege access | A few examples of how controls stretch. Multi-factor authentication now sits inside a wider identity principle that also covers removing unused accounts, storing passwords and keys securely, and turning off old sign-in methods. Macro settings become part of approved configuration baselines that you check for drift. Backups need to be isolated from everyday systems and tested against the recovery times you've agreed. What's new ## What the Essential Eight didn't cover Some of the new principles have no Essential Eight equivalent. Plenty of businesses already do parts of these, they just weren't measured before. ### Governance and accountability Named executive accountability for cyber security and for AI, proper resourcing, checking your suppliers, and a plan for legacy systems. ### Knowing what you have An inventory that covers identities, credentials and data, not just devices and software. ### Visibility and response Logging, detection and incident response pulled into one domain that runs alongside everything else. ### Content filtering Blocking connections to known malicious or untrusted destinations, beyond browser settings. ### Staff awareness training Now a principle in its own right, where the Essential Eight left it out. ### Supply chain security The software, services and providers you rely on are part of your security picture. The AI accountability principle is worth a second look if your team uses Copilot, ChatGPT or Claude. ASD treats AI as another asset to scope and govern, which lines up with the work in our AI security (https://startcloud.au/cybersecurity/ai-agent-security) service. Your maturity level ## Does your maturity level still count? Your work counts. Your level doesn't convert. That's the part most people will want to know. The Essential Eight measured whether specific controls were in place, at levels matched to more and more capable attackers. ASD Essentials asks a different question: is each action achieving its intended outcome for the systems in each domain? Each action gets one of four ratings: not assessed, not effective, partially effective or fully effective. "Not assessed" is neutral. It means nobody has checked yet, not that it's failing. Because the two measure different things, ASD is clear that a maturity level doesn't turn into a rating, not even Maturity Level Three. What does carry forward is the evidence behind it: configuration records, policies, assessment reports and test results, as long as they still reflect how things are today. If you reached Maturity Level Two, expect many of your controls to line up with the early phases. If you were working towards Maturity Level One, expect more of the actions to need work. Either way, the next step is the same: a gap analysis using what you already have. Smaller businesses ## What it means for a business with 5 to 50 staff ASD wrote the series mainly for Commonwealth agencies, critical infrastructure and large organisations. It says smaller businesses can use it where relevant, and it keeps separate, simpler guidance for small business. So a 15-person accounting firm isn't the audience ASD had in mind. What does reach smaller businesses is the questions. Cyber insurance renewals, larger clients' supplier questionnaires and WA Government tenders ask about the Essential Eight today, and some will move to the new language over time. The WA Government Cyber Security Policy (https://startcloud.au/cybersecurity/essential-eight-wa-government) still refers to Essential Eight Maturity Level One, and that stays the expectation until the state updates it. The other thing worth knowing is which chapter fits. If your business runs on Microsoft 365 and other cloud apps with no servers of your own, ASD's cloud chapter is likely the closer fit, and it spells out which security jobs sit with Microsoft and which stay with you. If you still have a server in the cupboard or your own network to look after, the enterprise IT chapter applies too. Most of the early work lands in Microsoft 365 anyway: sign-in, admin access, device settings and logging. If you're on Business Premium, you already pay for most of the tools. Practical steps ## Five things to do now None of this needs a compliance department. It follows the order ASD recommends, sized for a smaller business. ### Write down where you are Your last Essential Eight assessment or self-check, what's in place, what's planned and any exceptions. ASD calls this the transition baseline. ### Keep your promises If an insurer, client, contract or tender asks about the Essential Eight, keep answering in those terms. ASD says the same. ### Don't chase a level for the score ASD advises against starting work just to reach a superseded Essential Eight target, unless someone still requires it or it fixes a real risk. ### Start with sign-in and the internet edge Phishing-resistant multi-factor authentication, tight admin access and anything exposed online. That's phase one, where ASD says to start. ### Collect proof that controls work Restore tests, sign-in reports, monitoring records and review notes. Under the new approach, showing it keeps working matters more than showing it was switched on. Not sure where you stand on the eight today? Our free Essential Eight checklist (https://startcloud.au/cybersecurity/essential-eight-checklist) takes about five minutes, and the answers make a good transition baseline. Watch out for ## Six mistakes to avoid - ### Treating priority phases as maturity levels They're an order of work. Finishing phase one doesn't make you "phase one compliant". - ### Assuming your old level converts Your evidence is the starting point. Your level doesn't translate into a rating. - ### Judging the whole business at once A control can work well in one domain and only partly in another. Each domain is looked at on its own. - ### Leaving governance and monitoring until last They run alongside all three phases from the start. - ### Trying to do everything at once Use the phases to focus effort. Spreading the work across every domain at once slows everything down. - ### Relying on stale evidence A restore test from two years ago, or an expired exception, doesn't prove much today. What we'd do ## The takeaway Don't panic, and don't throw anything away. The Essential Eight controls are still the right foundation, and the people asking you about them will keep asking for a while. Use the change as a reason to check two things: that your controls cover the systems that matter most, and that you can show they keep working. That's what ASD Essentials asks for, and it's what an insurer wants to see after an incident anyway. If you'd like a hand, our Essential Eight to ASD Essentials gap analysis follows ASD's steps: it records where you are, picks the right chapter, and shows what's already covered, what's partly covered and what's missing, with a costed plan to close the gaps. See the gap analysis: https://startcloud.au/cybersecurity/essential-eight Try the free checklist: https://startcloud.au/cybersecurity/essential-eight-checklist Sources ## Where this comes from Everything here comes from ASD's own publications, all free on cyber.gov.au. We read them on 12 November 2026, and we'll update this page when ASD announces transition timing. ### Transitioning from the Essential Eight Australian Signals Directorate How each of the eight maps to the new principles, what carries forward, and ASD's recommended transition steps. Published 15 October 2026. https://www.cyber.gov.au/publication/transitioning-from-the-essential-eight ### What is the Essentials? Australian Signals Directorate The structure of the series: principles, actions and domains, and the chapters for enterprise IT, cloud and operational technology. https://www.cyber.gov.au/publication/what-is-the-essentials ### ASD Essentials: frequently asked questions Australian Signals Directorate Why the change, who the series is for, and ASD's position on transition timing. https://www.cyber.gov.au/publication/frequently-asked-questions ### Essentials for cloud Australian Signals Directorate The chapter for organisations that run entirely on software-as-a-service and platform-as-a-service, including who is responsible for what. https://www.cyber.gov.au/publication/essentials-for-cloud ### Small business hub Australian Signals Directorate ASD's separate, tailored guidance for small businesses. https://www.cyber.gov.au/small-business-hub FAQ ## Common questions ### Has the Essential Eight been scrapped? Not scrapped, superseded. ASD published ASD Essentials on 15 October 2026 and describes it as an evolution of the Essential Eight. The Essential Eight and its maturity model are still published, and the eight controls remain the foundation of the new framework. ### When do we have to switch to ASD Essentials? There's no date yet. ASD says it is working with regulators on timing and will advise. Until then, anyone with obligations written in Essential Eight terms, such as a contract, an insurer or a government policy, should keep meeting them. ### Does our Maturity Level One or Two still mean anything? The work does. The level itself doesn't convert, because the two frameworks measure different things. ASD Essentials rates each action in each domain, and your existing controls and evidence are the starting point for that, as long as they're current. ### Is ASD Essentials meant for small businesses? ASD wrote it mainly for Commonwealth entities, critical infrastructure and large organisations, and says smaller businesses can use it where relevant. ASD also publishes separate small business guidance. For most businesses with 5 to 50 staff, the practical path is to keep the Essential Eight basics strong and adopt the new approach where it helps. ### Which chapter applies to a business on Microsoft 365? If you run on Microsoft 365 and other cloud apps with no servers of your own, the cloud chapter is likely the closer fit. If you still run servers, a file server or your own network, the enterprise IT chapter applies too. Many Perth businesses sit across both. ### Is there an ASD Essentials certification? No, and there's no Essential Eight certification either. Be wary of anyone selling one. What insurers, clients and assessors want is evidence that your controls are in place and working. This article is general information based on ASD publications as at 12 November 2026. ASD will publish transition timing and may update the framework. Check cyber.gov.au for the current version before relying on it for a contract or compliance decision. Keep reading ## Related pages Service ### Essential Eight and ASD Essentials Our gap analysis: keep the work you've done, close the gaps in ASD's order, and prove it. Service https://startcloud.au/cybersecurity/essential-eight Free training ### Essential Eight for Australian business Eight short modules for owners and managers, from the controls to proving where you stand. Learn https://startcloud.au/learn/essential-eight-for-australian-business Guide ### Essential Eight for WA Government What WA agencies expect from suppliers, and how ASD Essentials fits in for now. Guide https://startcloud.au/cybersecurity/essential-eight-wa-government IT that's safe, sorted and ready for AI. Managed IT, cybersecurity and Microsoft 365 for Perth businesses, from one local team. Ground Floor West, 6 Gibberd Road, Balcatta WA 6021 08 6285 0001 (+61862850001) Image: Microsoft Solutions Partner - Modern Work (https://startcloud.au/assets/microsoft-solutions-partner-white-CHo8DBPT.png) © 2026 Start Technologies Pty Ltd trading as StartCloud. All rights reserved. ABN 17 676 121 449 LinkedIn: https://www.linkedin.com/company/startcloudau Facebook: https://www.facebook.com/startcloudaus/ Google Business Profile: https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj Terms of service: https://startcloud.au/terms-of-service Privacy policy: https://startcloud.au/privacy-policy Modern slavery policy: https://startcloud.au/modern-slavery-policy Cookie policy: https://startcloud.au/cookie-policy ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://startcloud.au/#business", "name": "StartCloud", "legalName": "Start Technologies Pty Ltd", "alternateName": "StartCloud Australia", "identifier": { "@type": "PropertyValue", "propertyID": "ABN", "value": "17 676 121 449" }, "slogan": "IT that's safe, sorted and ready for AI.", "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.", "url": "https://startcloud.au", "logo": "https://startcloud.au/og-image.png", "image": "https://startcloud.au/og-image.png", "telephone": "+61862850001", "email": "web@startcloud.com.au", "priceRange": "$$", "currenciesAccepted": "AUD", "paymentAccepted": "Invoice", "foundingDate": "2023", "contactPoint": { "@type": "ContactPoint", "telephone": "+61862850001", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English" }, "address": { "@type": "PostalAddress", "streetAddress": "Ground Floor West, 6 Gibberd Road", "addressLocality": "Balcatta", "addressRegion": "WA", "postalCode": "6021", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "07:00", "closes": "16:30", "description": "General support hours" }, { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "opens": "00:00", "closes": "23:59", "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring" } ], "areaServed": [ { "@type": "City", "name": "Perth" }, { "@type": "State", "name": "Western Australia" }, { "@type": "Country", "name": "Australia" } ], "serviceArea": { "@type": "GeoCircle", "geoMidpoint": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "geoRadius": "50000" }, "knowsAbout": [ "Cybersecurity", "Managed Security Services", "Essential Eight", "Microsoft 365", "Microsoft Azure", "IT Support", "Network Security", "Disaster Recovery", "Compliance Management", "Microsoft Copilot", "AI Readiness", "AI Governance", "AI Agent Development" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "IT and Cybersecurity Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity Services", "url": "https://startcloud.au/cybersecurity" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT Services and Support", "url": "https://startcloud.au/technology" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft 365 and Cloud Solutions", "url": "https://startcloud.au/cloud" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed Networking", "url": "https://startcloud.au/networking" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI and Automation", "url": "https://startcloud.au/ai" } } ] }, "sameAs": [ "https://www.linkedin.com/company/startcloudau", "https://www.facebook.com/startcloudaus/", "https://www.cloudtango.net/providers/12375/startcloud", "https://clutch.co/profile/startcloud", "https://abr.business.gov.au/ABN/View?abn=17676121449", "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301", "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301", "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj" ] }, [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://startcloud.au/" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://startcloud.au/resources" }, { "@type": "ListItem", "position": 3, "name": "Essential Eight to ASD Essentials", "item": "https://startcloud.au/resources/essential-eight-to-asd-essentials" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Has the Essential Eight been scrapped?", "acceptedAnswer": { "@type": "Answer", "text": "Not scrapped, superseded. ASD published ASD Essentials on 15 October 2026 and describes it as an evolution of the Essential Eight. The Essential Eight and its maturity model are still published, and the eight controls remain the foundation of the new framework." } }, { "@type": "Question", "name": "When do we have to switch to ASD Essentials?", "acceptedAnswer": { "@type": "Answer", "text": "There's no date yet. ASD says it is working with regulators on timing and will advise. Until then, anyone with obligations written in Essential Eight terms, such as a contract, an insurer or a government policy, should keep meeting them." } }, { "@type": "Question", "name": "Does our Maturity Level One or Two still mean anything?", "acceptedAnswer": { "@type": "Answer", "text": "The work does. The level itself doesn't convert, because the two frameworks measure different things. ASD Essentials rates each action in each domain, and your existing controls and evidence are the starting point for that, as long as they're current." } }, { "@type": "Question", "name": "Is ASD Essentials meant for small businesses?", "acceptedAnswer": { "@type": "Answer", "text": "ASD wrote it mainly for Commonwealth entities, critical infrastructure and large organisations, and says smaller businesses can use it where relevant. ASD also publishes separate small business guidance. For most businesses with 5 to 50 staff, the practical path is to keep the Essential Eight basics strong and adopt the new approach where it helps." } }, { "@type": "Question", "name": "Which chapter applies to a business on Microsoft 365?", "acceptedAnswer": { "@type": "Answer", "text": "If you run on Microsoft 365 and other cloud apps with no servers of your own, the cloud chapter is likely the closer fit. If you still run servers, a file server or your own network, the enterprise IT chapter applies too. Many Perth businesses sit across both." } }, { "@type": "Question", "name": "Is there an ASD Essentials certification?", "acceptedAnswer": { "@type": "Answer", "text": "No, and there's no Essential Eight certification either. Be wary of anyone selling one. What insurers, clients and assessors want is evidence that your controls are in place and working." } } ] }, { "@context": "https://schema.org", "@type": "WebPage", "url": "https://startcloud.au/resources/essential-eight-to-asd-essentials", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "#hero h1", "#brief" ] } }, { "@context": "https://schema.org", "@type": "BlogPosting", "headline": "The Essential Eight is changing: what ASD Essentials means for your business", "description": "ASD is replacing the Essential Eight with ASD Essentials. What changed in October 2026, what carries over, and what smaller businesses should do now.", "author": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" }, "publisher": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au", "logo": { "@type": "ImageObject", "url": "https://startcloud.au/startcloud-logo.png" } }, "datePublished": "2026-11-12", "dateModified": "2026-11-12", "image": "https://startcloud.au/og-image.png", "about": [ { "@type": "Thing", "name": "Essential Eight" }, { "@type": "Thing", "name": "ASD Essentials" } ], "mainEntityOfPage": { "@type": "WebPage", "@id": "https://startcloud.au/resources/essential-eight-to-asd-essentials" } } ] ] ```