If you've spent the last few years getting your head around Essential Eight maturity levels, we have news. On 15 October 2026, the Australian Signals Directorate (ASD) published ASD Essentials, the evolution of the Essential Eight.
Before anyone throws their laptop across the room: your Essential Eight work still counts. Nothing has been switched off, and you don't need to start again. But the way Australian Signals Directorate (ASD) wants you to think about cyber security has changed, and so has the way it's measured.
Here's what you need to know.
The Essential Eight first appeared in 2017. It was a short list of eight mitigation strategies, from patching to backups, designed for Windows-based networks. It did a great job of giving Australian organisations a common baseline, and plenty of them built their security programs around it.
A lot has changed since 2017. Most organisations now run a mix of on-premises systems, cloud services and SaaS tools. Critical infrastructure operators manage operational technology that looks nothing like an office network. And AI is making attacks faster and cheaper to run.
ASD's The case for change paper argues that a fixed list of controls no longer fits that reality. ASD Essentials focuses on outcomes instead, so organisations can choose controls that suit their environment while working towards the same results.
The timeline was quick. ASD announced the change in June 2026, consulted with government, industry and regulators from 15 June to 12 July 2026, and published the final series in October 2026.
ASD Essentials is a threat-informed cyber security framework built from three layers:
Or, in ASD's own neat summary: principles cover what you're trying to achieve, actions cover how and domains cover where.
ASD says the framework is written mainly for Commonwealth entities, critical infrastructure owners and operators, and large organisations. Smaller organisations can use it too, and ASD keeps separate guidance for small businesses.
Instead of eight strategies, there are now eight domains. Six cover your technology:
|
Domain |
What it covers |
|
Boundary services |
Internet-facing services, gateways and edge devices |
|
Identity services |
Directories, authentication and credential stores |
|
Critical processes and services |
The systems that deliver your core business outcomes |
|
Privileged environments |
Accounts and systems used for high-impact administration |
|
Business systems |
Enterprise systems that support day-to-day operations |
|
User devices |
Desktops, laptops and other staff devices |
|
Governance and culture |
Executive accountability, supplier assurance, AI accountability and security culture |
|
Visibility and response |
Logging, detection and incident response |
The biggest additions are the last two capability domains, because they run across everything: Governance and Culture, and Visibility and Response. Governance and Culture covers executive accountability, supplier assurance, AI accountability and security culture. Visibility and Response brings logging, detection and incident response into the framework properly.
A domain is a logical grouping, not a part of your network. One customer-facing application might sit in Boundary Services and Critical Processes and Services at the same time. You only implement each action on it once.
ASD recommends tackling the domains in a set order, called priority phases. For enterprise IT:
Governance and Culture, and Visibility and Response, apply in every phase.
Boundary and identity come first because they're the most common way attackers get in. And here's the important bit: reaching "phase 2" doesn't mean you're twice as secure. Phases tell you where to work next. They don't rate how well you're doing.
ASD Essentials comes in chapters, each written for a different technology environment:
ASD has said more chapters may follow.
Alongside the chapters sit supporting publications: overview papers for newcomers and senior executives, AI considerations within the Essentials, and practical guides for transitioning from the Essential Eight, planning implementation and running assessments.
This is the biggest change of all.
Under the Essential Eight, you aimed for a maturity level across all eight strategies. Under ASD Essentials, each action is rated in each domain where it applies:
Assessors consider four things: coverage, consistency, currency and evidence quality. The lowest rating governs, so one weak spot pulls the whole principle down.
In practice, this means a screenshot proving you turned something on once isn't going to cut it. ASD Essentials wants evidence that controls keep working, such as test results, monitoring records and exercise outcomes.
For now, yes. ASD is keeping both frameworks on cyber.gov.au during the transition, and hasn't set a date for retiring the Essential Eight. ASD says it's working with regulators on timeframes and will advise in due course.
Until then, any contract, tender, insurance form or regulation that names the Essential Eight still applies. Keep meeting those obligations.
The Essential Eight maturity levels don't convert into ASD Essentials ratings, because they measure different things. But every Essential Eight strategy maps to at least one ASD Essentials principle, so the controls you've already built carry real value into the new framework. We cover the transition in detail in our next post.
No need to panic, but it's a good time to get organised:
de.iterate was built for exactly this kind of change. Our platform keeps your policies, risks, assets, suppliers, controls and evidence in one place, all connected, so moving to a new framework means building on your existing work instead of starting from a blank spreadsheet.
Book a demo to see how de.iterate supports ASD Essentials, or explore our ASD Essentials framework page.