ASD Essentials Explained: What Replaces the Essential Eight in 2026

On 15 October 2026 the Australian Signals Directorate (ASD) published ASD Essentials, the framework that replaces the Essential Eight. Instead of eight mitigation strategies and three maturity levels, ASD Essentials uses principles (the security outcome), actions (what to do) and domains (where it applies), with separate chapters for enterprise IT, operational technology (OT) and cloud. Your Essential Eight work still counts, but your maturity level does not convert automatically, and the Essential Eight stays in place until ASD and your regulator set transition dates.

This guide explains what changed, how the three chapters differ, which chapter to start with, how Essential Eight controls map across, and the six steps ASD recommends for the move. It is written for CISOs, IT and OT leaders, assessors and boards in Australian organisations, especially Commonwealth entities and critical infrastructure operators.

What is ASD Essentials?

ASD Essentials is a threat-informed cyber security framework that gives organisations one consistent approach across different technology environments. It is made up of environment-specific chapters, and every chapter uses the same three layers:

• Principles describe the cyber security outcome you should achieve. They are drawn from the cyber security principles in ASD’s Information Security Manual (ISM) and carry ISM identifiers such as GOV-01.
• Actions describe the administrative and technical work needed to achieve each principle. They are technology-agnostic and, where it helps, mapped to MITRE ATT&CK techniques.
• Domains group business functions and assets that share similar risk, so effort goes where it reduces the most risk.

ASD’s own one-line summary is useful: the principle answers “what outcome am I trying to achieve?”, the action answers “what needs to be done?” and the domain answers “where does it apply?”.

Why is ASD replacing the Essential Eight?

The Essential Eight was built in 2017 as a fixed set of controls for Microsoft Windows networks. ASD’s case for change says a prescriptive control list no longer translates well across hybrid cloud, SaaS and OT environments, or keeps pace with AI-enabled threats. ASD Essentials focuses on outcomes, so organisations can choose controls that suit their environment while working towards the same result.

The timeline so far:

• June 2026: ASD announced that the Essential Eight would be retired within about two years and opened consultation on ASD Essentials for enterprise IT.
• 15 June to 12 July 2026: public consultation. ASD added executive guidance, clearer domain scoping and AI guidance in response.
• 15 October 2026: the final ASD Essentials series was published on cyber.gov.au.
• Next: ASD will advise on transition expectations after working with regulators, and will publish a strategy for future chapters.

Essential Eight vs ASD Essentials: what actually changes

The biggest change is what gets measured. The Essential Eight maturity model asked whether specific controls were in place. ASD Essentials asks whether each action achieves its intended outcome for the assets in each domain.

Essential Eight	ASD Essentials	What it means in practice
Mitigation strategies with requirements	Principles supported by actions	One Essential Eight strategy can contribute to several principles and actions.
Maturity Levels One to Three	Priority phases 1 to 3	Phases sequence the work. They are not a maturity or assurance rating.
Whole-of-environment implementation	Eight domains	Actions are applied and assessed in each domain they map to.
Choosing a maturity level by adversary tradecraft	Threat-informed throughout	You no longer pick a target maturity level.
Assessment against specific requirements	Four-tier, outcome-based assessment	Ratings are not assessed, not effective, partially effective or fully effective.

The eight domains and the priority phases

ASD Essentials for enterprise IT has six technical domains and two capability domains. The technical domains are grouped into three priority phases that reflect where ASD’s intelligence and incident data say effort cuts risk fastest. The capability domains run through every phase.

Domain	What it covers	Enterprise IT phase
Boundary services	Internet-facing services, gateways and edge devices that connect zones of different trust	Phase 1
Identity services	Directories, authentication and authorisation services and credential stores	Phase 1
Critical processes and services	The core processes and services that deliver your primary outcomes	Phase 2
Privileged environments	Systems, services and accounts used for privileged and high-impact administration	Phase 2
Business systems	Enterprise systems that support day-to-day operations	Phase 3
User devices	Desktops, laptops and other endpoints issued to staff	Phase 3
Governance and culture	Policies, risk management, roles, accountability and security culture	All phases
Visibility and response	Logging, detection, analysis and incident response	All phases

Boundary and identity services come first because they are the most common paths to initial access, and strong identity is the foundation for everything after it. A domain is a logical grouping, not a network zone: one internet-facing customer application can sit in Boundary services in phase 1 and Critical processes and services in phase 2, and you implement each action on it only once.

The ASD Essentials chapters

ASD Essentials for enterprise IT

This is the direct successor to the Essential Eight. It is for organisations whose scale, complexity or regulatory exposure needs a structured approach: Commonwealth entities, critical infrastructure owners and large organisations. Use it for on-premises, hybrid and infrastructure-as-a-service environments, where you still run the operating systems, applications, identity infrastructure and network. It comes with an asset scoping guide, an assessment evidence guide and the transition guidance covered below.

ASD Essentials for operational technology

The OT chapter covers process automation, instrumentation and industrial control systems in sectors such as energy, water, transport, health and large-scale industry. It uses the same domains but changes the order: Boundary services and Critical processes and services come first, because compromise of an OT process can affect safety and essential services. Privileged environments and identity services follow in phase 2, and business systems in phase 3. ASD also says every device inside an OT system should be treated as privileged, and that compensating controls are often needed where patching or replacing legacy equipment would disrupt operations.

ASD Essentials for cloud

The cloud chapter is for organisations whose technology is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS). Its phases match enterprise IT, but every action carries a shared responsibility marker:

• (C) Customer: you deliver and operate the control.
• (S) Supplied: the provider supplies the capability, but you must enable, configure and operate it.
• (P) Provider-inherited: the provider delivers the outcome and you verify it through assurance evidence.

The practical lesson is that a security feature you pay for but have not switched on does not count.

The Essentials for senior executives

ASD Essentials makes executive accountability explicit. The Governance and culture domain includes principles on executive cyber security accountability, cyber security resourcing, security risk management assurance, supplier assurance, AI accountability and legacy systems. ASD’s executive guide asks boards to define risk appetite, fund sustainment as well as delivery, demand evidence of effectiveness and agree what will be reported and how often. Saying “we have reached priority phase 2” describes scope, not how secure you are.

AI considerations within the Essentials

ASD treats AI as another asset that must be scoped into the domains, whether you consume, develop or deploy it. That includes models, hosting infrastructure, external AI services, training data, prompts and outputs, connectors and APIs, and the non-person identities used by AI agents. ASD also flags new attack paths such as indirect prompt injection through documents and email processed by AI agents.

Which ASD Essentials chapter should you start with?

There is no required order, and most organisations will need more than one chapter. ASD suggests working through four questions:

1. What do you operate? List your technology environments and where they connect, because compromise in one often leads into another.
2. What are you required to do? A regulatory obligation for a specific environment makes that chapter a logical start. ASD notes an obligation sets a floor, not a priority order.
3. Where is the biggest gap? OT often carries the most technical debt because systems stay in service for decades.
4. Where is the greatest risk? Start where both the consequence and likelihood of compromise are high.

For the common choice between enterprise IT and cloud: if you run on-premises, hybrid or IaaS infrastructure, start with enterprise IT. If you run mainly on SaaS and PaaS and need clarity on the provider’s share, start with cloud.

One rule applies to every chapter: outsourcing a service does not transfer accountability. Where a provider delivers part of an action, you still need current evidence that it is being met, or a documented and accepted risk.

What happens to your Essential Eight maturity level?

It does not convert. ASD is clear that Essential Eight maturity ratings and ASD Essentials effectiveness ratings measure different things, so a Maturity Level Two or Three result becomes a starting point for gap analysis, not a rating.

• Maturity Level Two organisations can expect many controls to count toward phase 1 actions, such as phishing-resistant MFA, patching of internet-facing services, privileged access, application control and central logging. The usual extra work is extending controls to new domains, meeting the governance principles, expanding detection and response, and proving sustained effectiveness rather than deployment.
• Maturity Level Three organisations can reuse more controls and evidence, but still face actions with no Essential Eight equivalent, including credential exposure, supply chain security and the two capability domains.
• Maturity Level One organisations follow the same approach with more actions to implement.

How the Essential Eight maps to ASD Essentials principles

Every Essential Eight mitigation strategy maps to at least one principle in ASD Essentials for enterprise IT:

Essential Eight strategy	ASD Essentials principles
Application control	Trustworthy software; Secure configuration management
Patch applications	Vulnerability management; Asset identification; Legacy system management
Patch operating systems	Vulnerability management; Asset identification; Legacy system management
Multi-factor authentication	Identity, credential and access management
Restrict administrative privileges	Identity, credential and access management; Least privilege access; Secure administration; Network segmentation and segregation
Restrict Microsoft Office macros	Trustworthy software; Secure configuration management
User application hardening	Secure configuration management
Regular backups	Regular and proven backups; Least privilege access

The principles are broader than the strategies. Macro restrictions, for example, now contribute to a wider Trustworthy software outcome that also covers whether software is supported, verified and authorised, and whether administrative tools only run from approved locations. Patching becomes risk-based vulnerability management, with treatment timeframes that can differ by domain.

What is new compared with the Essential Eight?

• Governance: executive accountability, resourcing, risk management assurance, supplier assurance, AI accountability and legacy system management.
• Asset and risk identification: a continuous inventory of infrastructure, operating systems, applications, identities, credentials and data, plus threat-informed risk assessment.
• New protect principles: content filtering, cyber security awareness training and cyber supply chain security.
• Visibility and response: event logging, detection, incident identification, detection efficacy, incident coordination, response and post-incident insights, brought together in one domain.

How is ASD Essentials assessed?

Each action is assessed in each applicable domain and rated not effective, partially effective or fully effective. Actions not yet examined are not assessed, which is a neutral rating and must be reported separately from not effective. A principle’s rating in a domain is its lowest action rating. For boards, ASD describes a weighted calculation that turns principle ratings into a percentage of progress toward full effectiveness for each domain.

Assessors look at four things: coverage, consistency, currency and evidence quality. Configuration screenshots show a control was deployed; ASD Essentials also expects evidence that it keeps working, such as validation testing, exercise results and monitoring records.

How to transition from the Essential Eight: six steps

1. Establish the transition baseline. Record your latest Essential Eight results, controls, exception and risk registers, remediation plans and committed uplift. Do not start new work only to reach a superseded Essential Eight target unless a regulator still requires it.
2. Scope the priority phase 1 domains. Map assets and functions to Boundary services, Identity services, Governance and culture, and Visibility and response, reusing existing inventories and business impact assessments.
3. Run a gap analysis. For each action, mark it already addressed, partially addressed or not addressed, and record how existing controls contribute.
4. Plan implementation. Fix single-domain gaps in place; build shared capabilities once and roll them out in phase order.
5. Deliver and measure. Prepare evidence of coverage, consistency, currency and quality as controls land.
6. Progress through the phases. Move to phase 2 and phase 3 domains and set a reassessment cycle.

ASD also lists the mistakes to avoid: treating priority phases as maturity levels, claiming equivalence instead of assessing, assessing the enterprise instead of the domain, deferring the two capability domains, trying to move every domain at once, reusing stale evidence and overlooking the new requirements.

Five questions boards should ask now

1. Which of our key functions and assets sit in each domain, and which domain holds the assets whose compromise would hurt us most?
2. What did our Essential Eight investment buy us under ASD Essentials, and what is new work?
3. When will we see the first posture report, and what will be reported as not assessed?
4. Where does our plan depart from ASD’s recommended sequence, and what is the documented reason?
5. How will effectiveness be validated, and will independent assessment or adversary simulation be used?

Frequently asked questions

Is the Essential Eight being replaced?

Yes. ASD Essentials is ASD’s successor to the Essential Eight. The Essential Eight remains available during the transition, and organisations should keep meeting any regulatory or contractual obligation that refers to it until told otherwise.

When do we have to move to ASD Essentials?

ASD has not set a mandatory date. It is working with regulators on timeframes and will advise expectations. Reporting in June 2026 said the Essential Eight would be retired within about two years.

Does our Essential Eight Maturity Level Two carry over?

Not as a rating. Maturity levels do not convert into ASD Essentials effectiveness ratings, but your controls and evidence can be reused in a gap analysis, and many will count toward phase 1 actions.

Should we pause our Essential Eight uplift program?

No. ASD recommends continuing approved uplift programs while you check them against the new framework. Map planned work to ASD Essentials actions before deciding whether it continues unchanged.

Who is ASD Essentials for?

It is written mainly for Commonwealth entities, critical infrastructure owners and operators and large organisations. Smaller businesses can use it where relevant, and ASD keeps separate guidance for small businesses.

How does ASD Essentials relate to ISO 27001 and NIST?

Its principles come from the ISM, and ASD designed it to work alongside other frameworks. The assessment evidence guide references controls from other frameworks that can serve as evidence where you have already implemented them.

How Security Solution Consultants can help

Security Solution Consultants helps Australian organisations move from the Essential Eight to ASD Essentials without losing the value of work already done. We turn your last Essential Eight assessment into a transition baseline, scope your assets into the eight domains, run the action-by-action gap analysis and build a phase-ordered plan your board can fund. If you are still deciding between frameworks, our guides to Essential Eight compliance, Maturity Level Two vs Three and ISO 27001 vs the Essential Eight show how they fit together.

Our maturity assessment and uplift team pairs the work with GRCLens, our GRC platform, so domains, action ratings, evidence, exceptions and board reporting live in one place. Talk to us about an ASD Essentials readiness assessment.

Sources

• ASD Essentials series (cyber.gov.au)
• What is the Essentials?
• The case for change
• Which chapter should I start with?
• Transitioning from the Essential Eight
• The Essentials for senior executives
• Essentials for OT and Essentials for cloud
• ASD Essentials frequently asked questions
• Australian Cyber Security Magazine: ASD to retire Essential Eight within two years