# ASD Essentials vs Essential Eight: What Changed

On 15 October 2026 the Australian Signals Directorate (ASD) launched [ASD Essentials](/services/asd-essentials), which it calls "an evolution of Australia's widely adopted Essential Eight framework" ([ASD](https://www.asd.gov.au/news/2026-10-15-asd-essentials-evolving-our-approach-cyber-security-resilience)). Maturity levels are gone: the work is now described as principles and actions, applied to eight domains, sequenced in priority phases and rated per domain. The Essential Eight has not been switched off. ASD will maintain both frameworks during a transition that has no dates yet, and says organisations should keep meeting their current obligations until regulators say otherwise.

ASD published the whole series at once: three chapters (enterprise IT, cloud and operational technology), seven overview publications and a set of supporting guides for transition, scoping, planning and assessment. This post is the overview. Each chapter has its own plain-English guide: [enterprise IT](/blog/2026-10-15-asd-essentials-for-enterprise-it), [cloud](/blog/2026-10-15-asd-essentials-for-cloud) and [operational technology](/blog/2026-10-15-asd-essentials-for-operational-technology).

## What is ASD Essentials?

ASD Essentials is a framework of environment-specific chapters that share one model. In ASD's words, "Principles describe the cyber security outcomes an organisation should achieve. Actions describe what needs to be done to achieve those outcomes. Domains describe the business functions and assets to which the actions apply" ([What is the Essentials?](https://www.cyber.gov.au/publication/what-is-the-essentials)). The principles come from the cyber security principles in ASD's [Information Security Manual (ISM)](/services/ism), so they carry ISM identifiers such as GOV-01 and PRO-13.

The eight domains are the same in every chapter:

- **Two capability domains** that run through everything: Governance and culture, and Visibility and response.
- **Six technical domains**: Boundary services (internet-facing services and edge devices), Identity services, Critical processes and services, Privileged environments, Business systems and User devices.

The three chapters published on launch day are:

- **[Essentials for enterprise IT](/blog/2026-10-15-asd-essentials-for-enterprise-it)**, the direct successor to the Essential Eight: 28 principles and 58 actions.
- **[Essentials for cloud](/blog/2026-10-15-asd-essentials-for-cloud)**, for organisations whose technology is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS): 78 actions, each marked as the customer's job, a provider capability the customer must switch on, or the provider's own job.
- **[Essentials for operational technology](/blog/2026-10-15-asd-essentials-for-operational-technology)**, for critical infrastructure operators: 61 actions, with its own priority order.

ASD says "There is no requirement for every organisation to use every chapter or to apply relevant chapters in set order" ([What is the Essentials?](https://www.cyber.gov.au/publication/what-is-the-essentials)). There is no separate AI chapter: ASD says "AI systems are assets within the scope of the ASD Essentials series" and covers them through the principles ([AI considerations](https://www.cyber.gov.au/publication/ai-considerations-within-the-essentials)).

## Is the Essential Eight being phased out?

Eventually, but not yet, and ASD has not set a date. Its launch statement says "During the transition period, ASD will continue to maintain both the Essential Eight and Essentials frameworks on cyber.gov.au" and "Until associated regulatory changes are communicated by regulators, organisations should continue to meet their current regulatory obligations" ([ASD](https://www.asd.gov.au/news/2026-10-15-asd-essentials-evolving-our-approach-cyber-security-resilience)). On timing, ASD's FAQ says only that it "will advise on expectations for transitioning to the new framework in due course" ([FAQ](https://www.cyber.gov.au/publication/frequently-asked-questions)).

So anything that requires the Essential Eight today still does: a government policy, a contract, a customer's supplier questionnaire or a cyber insurance application. For government, iTnews reports that "government agencies will be assessed against both next year" ([iTnews](https://www.itnews.com.au/news/asds-essential-eight-replacement-moves-away-from-maturity-ladder-629637)). Our [Essential Eight page](/services/essential-eight) covers who must meet it now.

## What changed from the Essential Eight?

The model changed more than the controls. ASD's transition guide sets out the translation ([Transitioning from the Essential Eight](https://www.cyber.gov.au/publication/transitioning-from-the-essential-eight)):

| Essential Eight | ASD Essentials | What it means |
| --- | --- | --- |
| Eight mitigation strategies with requirements | Principles supported by actions | One old strategy can feed several principles and actions |
| Maturity Levels One to Three | Three priority phases | Phases set the order of work. "Priority phases are a sequencing mechanism, not a rating" |
| Applied across the whole environment | Eight domains | Each action is applied and rated in the domains it maps to |
| Pick a target maturity level | No target level | "Organisations no longer select a target maturity level." |
| Pass or fail each level | Four ratings per action, per domain | Not assessed, not effective, partially effective, fully effective |

ASD's guidance says "Every Essential Eight mitigation strategy maps to at least one principle in the Essentials series" ([FAQ](https://www.cyber.gov.au/publication/frequently-asked-questions)). Here is where each one went, using ASD's own mapping:

![Chart: where each Essential Eight strategy went in ASD Essentials for enterprise IT. Patch applications and patch operating systems map to vulnerability management, asset identification and legacy system management; multi-factor authentication to identity, credential and access management; restrict administrative privileges to four principles; application control and Office macros to trustworthy software and secure configuration management; user application hardening to secure configuration management; regular backups to regular and proven backups. New areas include executive and AI accountability, supply chain security, content filtering, awareness training, and logging, detection and incident response.](asd-essentials-e8-mapping.webp)

| Essential Eight strategy | ASD Essentials principles | What changes |
| --- | --- | --- |
| Patch applications and patch operating systems | Vulnerability management; Asset identification; Legacy system management | One principle for both. The fixed 48-hour, two-week and one-month deadlines give way to "defined risk-based timeframes"; ISM and regulatory timeframes still apply |
| Multi-factor authentication | Identity, credential and access management | "Use phishing-resistant MFA for users authenticating to systems", in every technical domain, as one action within a wider identity principle |
| Restrict administrative privileges | Identity, credential and access management; Least privilege access; Secure administration; Network segmentation and segregation | Split four ways, adding time-bound privilege grants and least privilege for service accounts |
| Application control | Trustworthy software; Secure configuration management | No longer named on its own; software must also be supported, verified and authorised |
| Restrict Microsoft Office macros | Trustworthy software; Secure configuration management | The chapter no longer mentions macros; macro settings become part of approved configuration baselines |
| User application hardening | Secure configuration management | Baselines and drift detection in every technical domain, not only on laptops |
| Regular backups | Regular and proven backups; Least privilege access | Protected storage (immutable, offline or isolated) and restores tested against recovery targets |

Some of the enterprise IT chapter is new rather than moved. By our count, 23 of its 58 actions have no Essential Eight reference in ASD's assessment evidence guide: executive accountability, resourcing, supplier assurance, accountability for AI, legacy systems, content filtering, awareness training, supply chain security and network segmentation, plus a whole domain for logging, detection and incident response. The [enterprise IT guide](/blog/2026-10-15-asd-essentials-for-enterprise-it) goes through them.

## How is ASD Essentials assessed?

Each action is rated in each domain it applies to as not assessed, not effective, partially effective or fully effective ([Assessment process guide](https://www.cyber.gov.au/publication/assessment-process-guide)). "The principle rating is determined by the lowest applicable action rating", so one weak action drags its principle down. Each domain then gets a percentage: fully effective scores 1, partially effective 0.5 and not effective 0, divided by the number of applicable principles.

A worked example: a domain with 16 applicable principles, of which 10 are fully effective, 4 partially effective and 2 not effective, scores (10 + 4 × 0.5) ÷ 16 = 75 per cent. Two points matter in practice. "Partial activity alone, such as work commencing or a plan existing, is not partial effectiveness", and "Deployment is not effectiveness": a tool that is installed but not configured or not covering every asset does not count.

The guide is written for organisations assessing themselves. ASD's implementation planning guide says organisations "may choose to engage an independent assessor, but this is not required" ([Implementation planning guide](https://www.cyber.gov.au/publication/implementation-planning-guide)). An old maturity level does not carry across either: Essential Eight ratings "do not automatically convert into effectiveness outcomes under the Essentials series" ([FAQ](https://www.cyber.gov.au/publication/frequently-asked-questions)).

## Which chapter applies to you?

ASD's advice is to start where your systems are ([Which chapter should I start with?](https://www.cyber.gov.au/publication/which-chapter-should-i-start-with)):

- **Your own servers, a hybrid setup or infrastructure-as-a-service:** start with enterprise IT.
- **Everything runs as cloud services you subscribe to,** with no servers or network of your own: start with cloud.
- **You operate industrial control systems or other operational technology:** the OT chapter, alongside enterprise IT for the office side.

"Most organisations will need both chapters over time." The chapter guides set out the test for each.

## What does it mean for smaller businesses and IT providers?

ASD is clear about its audience: "The Essentials series is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations." Smaller businesses "can still use this guidance where relevant" ([FAQ](https://www.cyber.gov.au/publication/frequently-asked-questions)). Nothing changes overnight for a small business that is working towards the Essential Eight: those controls still map into the new framework, and insurers and customers will keep asking Essential Eight questions until their own forms change. A business that runs entirely on a cloud office suite such as Microsoft 365 or Google Workspace should read the [cloud chapter guide](/blog/2026-10-15-asd-essentials-for-cloud) first: ASD's own example of a cloud-only organisation looks a lot like one.

For IT providers and managed service providers, one line in ASD's guidance changes conversations with clients: "outsourcing a service does not transfer accountability for the security outcomes that service is expected to achieve" ([Which chapter should I start with?](https://www.cyber.gov.au/publication/which-chapter-should-i-start-with)). Clients will need evidence that the controls you run for them work, domain by domain.

## What should you do now?

ASD's own guidance gives the order:

1. **Keep meeting your current obligations.** Any Essential Eight target in a policy, contract or insurance application still applies.
2. **Keep your Essential Eight work going.** ASD says "Organisations should continue their current uplift programs, while assessing alignment with the new framework" ([FAQ](https://www.cyber.gov.au/publication/frequently-asked-questions)), but also "Do not initiate work solely to achieve a superseded Essential Eight target" unless something still requires it ([Transitioning from the Essential Eight](https://www.cyber.gov.au/publication/transitioning-from-the-essential-eight)).
3. **Record a transition baseline.** ASD suggests "establishing a transition baseline" from your current Essential Eight position, controls and risks.
4. **Scope the first priority phase:** boundary services, identity services, governance and culture, and visibility and response.
5. **Collect evidence that controls work,** not only that they exist.

To see where you stand today, the [free coverage check](https://check.teresec.com.au/?utm_source=teresec.com.au&utm_medium=blog&utm_campaign=asd-essentials) shows which ISM and Essential Eight controls the products you already pay for can reach. For help with the move itself, our [ASD Essentials transition review](/services/asd-essentials) starts from your Essential Eight position, and the [$399 IT Security Review](/security-review) is the place to start for a smaller business.

## What did early reports get wrong?

Much of what was written before launch day came from the June consultation. Measured against ASD's own publications:

- **"The Essential Eight is retired" or "scrapped".** ASD's pages do not say that. Both frameworks are maintained during the transition.
- **Retirement in mid-2027 or mid-2028.** Those dates trace back to a June 2026 interview, not to anything ASD has published. ASD's FAQ says it will advise on timing "in due course".
- **"Mandatory" new standards.** ASD's launch says to keep meeting current obligations until regulators change them.
- **Independent testing is required.** ASD says an independent assessor is "not required".
- **A separate AI chapter.** There isn't one; AI is handled through the principles.
- **Your maturity level carries over.** ASD says the ratings "do not automatically convert".

## Sources

- ASD, [ASD Essentials: evolving our approach to cyber security resilience](https://www.asd.gov.au/news/2026-10-15-asd-essentials-evolving-our-approach-cyber-security-resilience), 15 October 2026
- ASD, [ASD Essentials](https://www.cyber.gov.au/essentials) and [What is the Essentials?](https://www.cyber.gov.au/publication/what-is-the-essentials)
- ASD, [Transitioning from the Essential Eight](https://www.cyber.gov.au/publication/transitioning-from-the-essential-eight)
- ASD, [Frequently asked questions](https://www.cyber.gov.au/publication/frequently-asked-questions)
- ASD, [Assessment process guide](https://www.cyber.gov.au/publication/assessment-process-guide) and [Implementation planning guide](https://www.cyber.gov.au/publication/implementation-planning-guide)
- ASD, [Which chapter should I start with?](https://www.cyber.gov.au/publication/which-chapter-should-i-start-with) and [AI considerations within the Essentials](https://www.cyber.gov.au/publication/ai-considerations-within-the-essentials)
- iTnews, [ASD's Essential Eight replacement moves away from maturity ladder](https://www.itnews.com.au/news/asds-essential-eight-replacement-moves-away-from-maturity-ladder-629637), 15 October 2026

ASD Essentials content © Commonwealth of Australia, CC BY 4.0, via cyber.gov.au.