ASD launches ASD Essentials, the successor to the Essential Eight
The first chapters cover enterprise IT, operational technology and cloud, and the enterprise IT chapter replaces the Essential Eight.
On this page
What ASD released
ASD calls the Essentials the evolution of the Essential Eight. Its cloud chapter covers environments delivered entirely as software or platform services.
ASD consulted on the framework from 15 June to 12 July 2026. It writes the Essentials primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations, and says smaller businesses can use it where relevant.
How the Essentials differs from the Essential Eight
Each chapter uses three layers. Principles state the security outcome, drawn from the Information Security Manual. Actions state what to do, and many map to MITRE ATT&CK techniques. Domains group the business functions and assets the actions apply to: six technical domains and two capability domains.
Maturity levels give way to priority phases, which set the order domains are addressed. Each action is rated not effective, partially effective or fully effective, and a principle takes its lowest action rating.
What happens to an Essential Eight program
ASD says every Essential Eight mitigation strategy maps to at least one Essentials principle, and that uplift programs already approved should continue. Maturity level ratings do not convert automatically into Essentials ratings.
Until regulators communicate changes, organisations meet their current obligations. ASD will advise transition timeframes in due course. A tender or insurer questionnaire that asks for an Essential Eight maturity level is still answered against the Essential Eight.
- Record the current Essential Eight position as a transition baseline
- Scope the priority phase one domains: boundary services, identity services, governance and culture, and visibility and response
- Keep evidence from Essential Eight work, since it supports the Essentials actions
Sources
- PrimaryASD, ASD Essentials: evolving our approach to cyber security resilience (15 October 2026)Retrieved 25 Oct 2026
- PrimaryASD, Frequently asked questions about the ASD EssentialsRetrieved 25 Oct 2026
- PrimaryASD, What is the Essentials?Retrieved 25 Oct 2026
- SecondaryInformation Age, ASD overhauls Essential Eight with new cyber frameworkRetrieved 25 Oct 2026
