ASD Essentials for enterprise IT is the chapter of the new ASD Essentials series that the Australian Signals Directorate (ASD) launched on 15 October 2026 as, in the words of its news release, "an evolution of the Essential Eight". In place of eight mitigation strategies and maturity levels, the chapter sets out 58 actions under 28 principles, applied across eight domains in three priority phases and rated on whether each action achieves its outcome. Your Essential Eight work carries forward as evidence, but ASD's transition guide says old maturity ratings "do not automatically translate into effectiveness ratings".

Nothing has been switched off: the news release says ASD "will continue to maintain both the Essential Eight and Essentials frameworks on cyber.gov.au" during the transition. Our ASD Essentials hub covers the series, with separate posts on the cloud and operational technology chapters.

#What is ASD Essentials for enterprise IT?

ASD's chapter defines enterprise information technology (IT) as "the IT environments operated by organisations whose scale, complexity, regulatory exposure or reliance on technology requires a structured and deliberate approach to the management of cyber security." The transition guide states the lineage plainly: ASD "has evolved the Essential Eight into the ASD Essentials for enterprise IT to address contemporary cyber threats and modern enterprise environments."

#Who should start with the enterprise IT chapter?

ASD's Which chapter should I start with? page says: "Where an organisation operates on-premises infrastructure, a hybrid environment or infrastructure-as-a-service, the enterprise IT chapter is the ideal starting point." An organisation running "predominantly platform-as-a-service or software-as-a-service" starts with the cloud chapter instead, though the same page adds that "Most organisations will need both chapters over time." Organisations that never implemented the Essential Eight can, says the transition guide, "implement ASD Essentials for enterprise IT directly".

#How is the enterprise IT chapter organised?

The chapter has three layers: principles are the security outcomes, actions are what must be done to achieve them, and domains are where that work applies. Each principle comes from the Information Security Manual (ISM) and keeps its ISM identifier, such as GOV-01, and the chapter says these identifiers "are provided for traceability and do not indicate an implementation order."

The eight domains (the chapter's Table 1), with principle counts from the Domain Summary sheet of ASD's Assessment Workbook:

The chapter says "Priority phases are a sequencing mechanism, not a rating", and puts boundary and identity first because they "are common pathways for adversaries seeking initial access to an organisation’s environment." The two capability domains run through every phase.

Counting the chapter's three matrices gives 28 principles and 58 actions, and ASD's Assessment evidence guide numbers each action, such as IT.PRO-13.4 for phishing-resistant multi-factor authentication (MFA).

Two scoping rules catch people out: the chapter puts development, testing and staging environments in scope, and ASD's asset scoping guide says "A workstation used to perform administrative work is part of a privileged environment".

#Where did each Essential Eight strategy go?

The transition guide says "Every Essential Eight mitigation strategy maps to at least one principle in the ASD Essentials for enterprise IT." The first two columns are its Table 2; the third is our summary of the guide and the chapter.

The Essential Eight maturity model set fixed patching windows (48 hours where a vulnerability is critical or a working exploit exists, otherwise two weeks or one month); the chapter has none, though the transition guide adds that "Applicable ISM, regulatory and other mandatory timeframes continue to apply." Logging and incident response, once spread across several strategies, now come together, in the transition guide's words, "through the Visibility and response domain".

#What is new compared with the Essential Eight?

The transition guide says the chapter "introduces security outcomes that were not directly addressed by the Essential Eight". In the Assessment evidence guide, 23 of the 58 actions list no Essential Eight control among their potential evidence sources. By our grouping:

• Governance (7 actions): executive accountability for cyber security and for artificial intelligence (AI), resourcing (two), risk methodology, and supplier assurance (two).
• Awareness training (2): role-based training before access, refreshed regularly.
• Assets and risk (2): fuller asset records and threat-informed risk assessment.
• Identity (2): scanning for exposed secrets, and disabling legacy authentication protocols.
• Build and supply chain (3): secure build and deployment, verifying software and updates before use, and acting on vendor advisories.
• Networks (1): zoning systems by business criticality and trust.
• Content filtering (3): inspecting outbound data, blocking known malicious destinations, inspecting inbound content.
• Detection and learning (3): normalised, time-synchronised logs, and two kinds of post-incident review.

ASD's AI considerations publication adds that "AI systems are assets within the scope of the ASD Essentials series."

#How is it assessed?

ASD's Assessment process guide says "Each action is assessed against each applicable domain using a four-tier, outcome-based rating scale: not assessed, not effective, partially effective and fully effective." It adds: "Partial activity alone, such as work commencing or a plan existing, is not partial effectiveness."

Under the same guide, "The principle rating is determined by the lowest applicable action rating." Each domain then gets a percentage: not effective scores 0, partially effective 0.5 and fully effective 1, and the total is divided by the number of applicable principles in the domain.

A worked example (ours, not ASD's). Identity services has 16 applicable principles. Under Identity, credential and access management, five actions apply there. Say four are fully effective, but phishing-resistant MFA is only partially effective because some contractor accounts have not moved to it yet. The weakest action sets the principle: partially effective. Across the domain, say 10 principles are fully effective, 4 partially effective and 2 not effective: (10 × 1) + (4 × 0.5) + (2 × 0) = 12, and 12 ÷ 16 = 75%.

The Implementation planning guide reports principle ratings rather than an overall level, and treats an independent assessor as optional: "this is not required."

#Can I reuse my Essential Eight evidence?

ASD's frequently asked questions say that "in most cases, controls implemented under the Essential Eight will directly satisfy, or substantially contribute to, a corresponding action underneath the principle." The transition guide agrees that "Existing evidence can be reused where it remains current and relevant", then adds: "However, deployment alone does not demonstrate effectiveness." It warns that "Maturity Level Three does not automatically produce fully effective ratings".

ASD's Assessment Workbook, a spreadsheet on the chapter page, opens with a sheet called "Existing E8 Controls" (E8 is ASD's shorthand for the Essential Eight). You fill it in, its instructions say, "to see where existing evidence could be leveraged for assessment against the Essentials for Enterprise IT": the mapped Essential Eight controls then appear under each action. The evidence guide adds a caution about such mappings: "The list is not intended to define the controls required to meet the intent of the actions."

#What should you do first?

ASD's transition guide recommends this sequence:

1. Establish the transition baseline: latest assessment results, existing controls, exception and risk registers, remediation plans and committed uplift work.
2. Scope the priority phase 1 domains: Governance and culture, Visibility and response, Boundary services and Identity services.
3. Run a gap analysis, classifying each action as already effectively addressed, partially addressed or not addressed; ASD notes "These are gap analysis findings, not formal assessment ratings."
4. Plan, deliver and measure, then move through phases 2 and 3.

Meanwhile, the same guide says to "continue to meet any regulatory, contractual or other obligations that require Essential Eight implementation or reporting" (our Essential Eight page covers those), and "Do not initiate work solely to achieve a superseded Essential Eight target unless it remains required by a regulator or other obligation or continues to address material cyber security risk." The frequently asked questions say ASD "does not recommend slowing or stopping the roll-out of pre-approved cyber security initiatives" and sets no deadline yet.

#What does it mean for a small business?

ASD's frequently asked questions say the series "is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations", and the chapter says smaller businesses "can still use this guidance where relevant". If an IT provider runs your systems, the Which chapter should I start with? page is blunt: "outsourcing a service does not transfer accountability for the security outcomes that service is expected to achieve."

Because the principles come from the ISM, a quick first look is the free coverage check, which reads the products you already pay for against the ISM and the Essential Eight in about three minutes.

Our ASD Essentials transition review follows ASD's sequence with you and your IT provider: we start from your Essential Eight position, scope the priority phase 1 domains, sort each action into already effectively addressed, partially addressed or not addressed, and build the evidence register and the plan.

#Sources

• ASD, ASD Essentials: evolving our approach to cyber security resilience, news release, 15 October 2026.
• ASD, ASD Essentials, the series hub.
• ASD, Essentials for enterprise IT, the chapter, with its PDF and Assessment Workbook downloads.
• ASD, Transitioning from the Essential Eight.
• ASD, Assessment evidence guide for enterprise IT.
• ASD, Asset scoping guide for enterprise IT.
• ASD, Assessment process guide.
• ASD, Implementation planning guide.
• ASD, Which chapter should I start with?
• ASD, AI considerations within the Essentials.
• ASD, Frequently asked questions.
• ASD, Essential Eight maturity model.

ASD Essentials content © Commonwealth of Australia, CC BY 4.0, via cyber.gov.au.