ASD Essentials is here

ASD Essentials: what it is, how it works and what it means for you

If you've spent the last few years getting your head around Essential Eight maturity levels, we have news. On 15 October 2026, the Australian Signals Directorate (ASD) published ASD Essentials, the evolution of the Essential Eight.

Before anyone throws their laptop across the room: your Essential Eight work still counts. Nothing has been switched off, and you don't need to start again. But the way Australian Signals Directorate (ASD) wants you to think about cyber security has changed, and so has the way it's measured.

Here's what you need to know.

Why ASD has moved on from the Essential Eight

The Essential Eight first appeared in 2017. It was a short list of eight mitigation strategies, from patching to backups, designed for Windows-based networks. It did a great job of giving Australian organisations a common baseline, and plenty of them built their security programs around it.

A lot has changed since 2017. Most organisations now run a mix of on-premises systems, cloud services and SaaS tools. Critical infrastructure operators manage operational technology that looks nothing like an office network. And AI is making attacks faster and cheaper to run.

ASD's The case for change paper argues that a fixed list of controls no longer fits that reality. ASD Essentials focuses on outcomes instead, so organisations can choose controls that suit their environment while working towards the same results.

The timeline was quick. ASD announced the change in June 2026, consulted with government, industry and regulators from 15 June to 12 July 2026, and published the final series in October 2026.

What ASD Essentials actually is

ASD Essentials is a threat-informed cyber security framework built from three layers:

• Principles describe the outcome you're trying to achieve. They come from the cyber security principles in ASD's Information Security Manual (ISM), and keep the ISM's identifiers, such as GOV-01.
• Actions describe what needs to be done to achieve each principle. They're technology-agnostic, so you're not locked into one vendor's way of doing things.
• Domains describe where each action applies, by grouping business functions and assets that share similar risks.

Or, in ASD's own neat summary: principles cover what you're trying to achieve, actions cover how and domains cover where.

ASD says the framework is written mainly for Commonwealth entities, critical infrastructure owners and operators, and large organisations. Smaller organisations can use it too, and ASD keeps separate guidance for small businesses.

The eight domains

Instead of eight strategies, there are now eight domains. Six cover your technology:

The biggest additions are the last two capability domains, because they run across everything: Governance and Culture, and Visibility and Response. Governance and Culture covers executive accountability, supplier assurance, AI accountability and security culture. Visibility and Response brings logging, detection and incident response into the framework properly.

A domain is a logical grouping, not a part of your network. One customer-facing application might sit in Boundary Services and Critical Processes and Services at the same time. You only implement each action on it once.

Priority phases (which are definitely not maturity levels)

ASD recommends tackling the domains in a set order, called priority phases. For enterprise IT:

• Phase 1: Boundary services and Identity services
• Phase 2: Critical processes and services, and Privileged environments
• Phase 3: Business systems and User devices

Governance and Culture, and Visibility and Response, apply in every phase.

Boundary and identity come first because they're the most common way attackers get in. And here's the important bit: reaching "phase 2" doesn't mean you're twice as secure. Phases tell you where to work next. They don't rate how well you're doing.

Three chapters, for three kinds of environment

ASD Essentials comes in chapters, each written for a different technology environment:

• ASD Essentials for enterprise IT is the direct evolution of the Essential Eight, for on-premises, hybrid and infrastructure-as-a-service environments.
• ASD Essentials for cloud is for organisations that run entirely on SaaS and PaaS. Each action is marked to show whether you, the provider or both are responsible. A security feature you're paying for but haven't switched on doesn't count, so it's worth checking your settings.
• ASD Essentials for OT is for operational technology, such as industrial control systems in energy, water and transport. It changes the phase order, putting Critical processes and services first because a compromise there can affect safety.

ASD has said more chapters may follow.

Alongside the chapters sit supporting publications: overview papers for newcomers and senior executives, AI considerations within the Essentials, and practical guides for transitioning from the Essential Eight, planning implementation and running assessments.

Goodbye maturity levels, hello effectiveness ratings

This is the biggest change of all.

Under the Essential Eight, you aimed for a maturity level across all eight strategies. Under ASD Essentials, each action is rated in each domain where it applies:

• Not assessed
• Not effective
• Partially effective
• Fully effective

Assessors consider four things: coverage, consistency, currency and evidence quality. The lowest rating governs, so one weak spot pulls the whole principle down.

In practice, this means a screenshot proving you turned something on once isn't going to cut it. ASD Essentials wants evidence that controls keep working, such as test results, monitoring records and exercise outcomes.

Does the Essential Eight still apply?

For now, yes. ASD is keeping both frameworks on cyber.gov.au during the transition, and hasn't set a date for retiring the Essential Eight. ASD says it's working with regulators on timeframes and will advise in due course.

Until then, any contract, tender, insurance form or regulation that names the Essential Eight still applies. Keep meeting those obligations.

The Essential Eight maturity levels don't convert into ASD Essentials ratings, because they measure different things. But every Essential Eight strategy maps to at least one ASD Essentials principle, so the controls you've already built carry real value into the new framework. We cover the transition in detail in our next post.

What should you do right now?

No need to panic, but it's a good time to get organised:

1. Read the right documents. Start with What is the Essentials? and ASD's Reading guide, then the chapter that matches your environment.
2. Brief your executives. ASD Essentials makes executive accountability explicit, and ASD has written a paper specifically for senior leaders.
3. Keep your current program going. ASD recommends continuing approved Essential Eight uplift work while you check how it lines up with the new framework.
4. Take stock of your evidence. If your current evidence is mostly screenshots and signed statements, now's the time to think about how you'll show controls are working over time.

How de.iterate can help

de.iterate was built for exactly this kind of change. Our platform keeps your policies, risks, assets, suppliers, controls and evidence in one place, all connected, so moving to a new framework means building on your existing work instead of starting from a blank spreadsheet.

Book a demo to see how de.iterate supports ASD Essentials, or explore our ASD Essentials framework page.