ASD Essentials Is Replacing the Essential Eight: What It Means for Your Business

ASD Essentials: what ASD published and when

On 15 October 2026 the Australian Signals Directorate (ASD) published ASD Essentials, a new cyber security framework that will replace the Essential Eight. ASD's ASD Essentials FAQ asks the question directly, "Why is ASD replacing the Essential Eight?", and describes the new series as "a principles-based cyber security framework that provides organisations with a consistent approach to cyber security across different technology environments".

The release is a set of publications rather than a single document. The ASD Essentials hub lists:

• Overview publications, including What is the Essentials?, The case for change, guidance for senior executives and the FAQ.
• Three chapters, one each for enterprise IT, cloud and operational technology (OT). Essentials for enterprise IT is the one that replaces the Essential Eight for ordinary office environments.
• Supplementary guides, including Transitioning from the Essential Eight, an implementation planning guide and an assessment process guide.

It followed a public consultation: the FAQ says "The consultation paper was open for feedback from 15 June 2026 to 12 July 2026".

Why ASD says it is replacing the Essential Eight

ASD gives three reasons in the FAQ. The threat landscape "has evolved, with Australian organisations facing increasingly sophisticated threats"; modern environments span on premises, hybrid cloud and emerging technologies; and a "threat-informed, principles-based approach" lets organisations choose controls that achieve an outcome "without being tied to specific technologies". The case for change puts it plainly: "a fixed set of prescriptive controls does not always translate across different technology environments or remain suitable as threats and technologies change."

One thing has not happened yet. When we checked on 27 October 2026, the Essential Eight maturity model was still published on cyber.gov.au, last reviewed 27 November 2023, with no transition notice, and its listed audience still includes small and medium business.

Who ASD Essentials is written for

The FAQ says "The Essentials series is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations." It goes on: "Small and medium sized businesses that do not operate at the scale of enterprise IT can still use this guidance where relevant."

The enterprise IT chapter adds a useful line for smaller organisations: the security outcomes still matter, and "What differs is how those outcomes are achieved and how much responsibility sits with service providers and vendors." For most 10 to 200 person businesses, that means your IT provider and your software vendors carry a large share of the work.

ASD's guidance for smaller organisations hasn't changed to match. Its Small Business Hub and the new small business cyber security handbook, published 7 October 2026, don't mention either the Essential Eight or ASD Essentials. So for a GP clinic, accounting firm or builder in South East Queensland, the Essential Eight remains the practical, well known baseline, and ASD Essentials is the direction of travel.

How CSG fixes this: we start with what applies to you. Our cyber security assessment measures your environment against ASD's Essential Eight, and where you supply government, critical infrastructure or larger organisations, we also show how your controls line up with the ASD Essentials priority phase 1 domains, so you know which framework your customers are likely to ask about.

What changes: from maturity levels to phased priorities

The FAQ sums up the shift in three moves: from maturity levels to phased priorities; from "a list of strategies and prescriptive security requirements" to "principles and actions that help organisations assess whether intended security outcomes are being achieved"; and the introduction of principles, actions and domains.

Principles, actions and domains

What is the Essentials? explains the three layers:

• Principles "describe the cyber security outcomes an organisation should achieve."
• Actions "describe what needs to be done to achieve those outcomes."
• Domains "describe the business functions and assets to which the actions apply."

The enterprise IT chapter defines eight domains. Six are technical: Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems and User devices. Two are capability domains that apply across everything: Governance and culture, and Visibility and response.

Priority phases, not maturity levels

Instead of choosing a target maturity level, organisations work through the technical domains in an order ASD recommends:

• Priority phase 1: Boundary services and Identity services, because they "are common pathways for adversaries seeking initial access".
• Priority phase 2: Critical processes and services, and Privileged environments.
• Priority phase 3: Business systems and User devices.

ASD is firm that "Priority phases are a sequencing mechanism, not a rating." Each action is instead assessed in each domain as not assessed, not effective, partially effective or fully effective.

Essential Eight concepts translated

This summarises the translation table in ASD's transition guidance.

The guidance also lists areas the Essential Eight didn't assess, including executive accountability, supplier assurance, artificial intelligence accountability, legacy system management, content filtering, cyber security awareness training and cyber supply chain security. Logging, monitoring and incident response, previously spread across individual strategies, now sit together in the Visibility and response domain.

How CSG fixes this: using ASD's transition guidance, we map the controls we manage for you to the ASD Essentials domains and record each action as already addressed, partially addressed or not addressed, the gap analysis categories ASD itself uses. Our 24/7 monitoring and, on our Enterprise plan, security information and event management (SIEM), give you a head start on Visibility and response.

What doesn't change: your Essential Eight work still counts

Two misconceptions have spread quickly. ASD's own words correct both.

Misconception 1: there is a fixed deadline to switch

ASD hasn't published a transition date. Asked "What is the transition timeline?", the FAQ answers that ASD "has been communicating with regulatory bodies around the impact and expected timeframes of transitioning to the new framework and will advise on expectations for transitioning to the new framework in due course." Any specific date you have read is not in ASD's published guidance, so don't plan around one until ASD sets it.

Misconception 2: Essential Eight work is wasted

It isn't. The FAQ says "Efforts already completed under Essential Eight remain relevant and will directly support alignment with the Essentials series." It also says "ASD does not recommend slowing or stopping the roll-out of pre-approved cyber security initiatives" and that "Organisations should continue their current uplift programs, while assessing alignment with the new framework."

According to the transition guidance, "Every Essential Eight mitigation strategy maps to at least one principle" in the enterprise IT chapter. For example, multi factor authentication maps to Identity, credential and access management; patching maps to Vulnerability management, Asset identification and Legacy system management; and regular backups map to Regular and proven backups. Where a control needs extending, ASD describes the extra work as "an extension of existing investment rather than its replacement."

Your Essential Eight work carries forward. What changes is how far it reaches and how you prove it works.

Two honest caveats. First, "Maturity level ratings under the Essential Eight maturity model do not automatically convert into effectiveness outcomes under the Essentials series", so a past Maturity Level One result is a starting point for a gap analysis, not a score you keep. Second, the transition guidance tells organisations moving to the new framework not to start work "solely to achieve a superseded Essential Eight target" unless an obligation requires it or it "continues to address material cyber security risk". For a small business, multi factor authentication, patching, admin restrictions and tested backups clearly address material risk, so keep going.

How CSG fixes this: we continue Essential Eight assessment and uplift for every client, so nothing stalls while ASD finalises the transition. We prioritise the controls that carry straight into priority phase 1 (identity and internet facing systems), and we track when a past result needs fresh evidence rather than assuming it still holds.

Insurers, clients and contracts that name the Essential Eight

ASD addresses existing obligations directly. The transition guidance says "Organisations should also continue to meet any regulatory, contractual or other obligations that require Essential Eight implementation or reporting", and that organisations whose reporting obligations still use Essential Eight terminology "should continue to meet those obligations as directed by the relevant authority."

ASD hasn't published anything about how insurers will treat the change, and we haven't found an official statement from insurers either. So the safe approach is simple: if a contract, tender, client questionnaire or insurance proposal asks about the Essential Eight, answer the Essential Eight question, accurately, and ask the client, broker or insurer whether they plan to move to ASD Essentials. Our guide to cyber insurance requirements in Australia maps common questionnaire items to Essential Eight controls and lists the evidence to keep behind each answer.

Evidence is where ASD Essentials will raise the bar. The transition guidance says assessors consider "coverage, consistency, currency and evidence quality", and that where evidence "demonstrates deployment but not sustained effectiveness", organisations may need testing, exercise results or monitoring records. Good evidence today answers both frameworks.

How CSG fixes this: we give you clear reports you can hand to a client, insurer or auditor: MFA coverage, patch status, privileged accounts and dated restore tests through our backup and disaster recovery service. When a contract or tender names a framework, we help you answer it against that framework and flag anything you can't yet show.

What small and medium businesses should do now

ASD's FAQ says organisations can prepare by "establishing a transition baseline", recording their posture "informed by their Essential Eight maturity, existing controls, risk assessment results and key business functions", then scoping the priority phase 1 domains: boundary services, identity services, governance and culture, and visibility and response. Scaled to a smaller business, that is a short, practical list.

If you hold health information, the same baseline supports your Privacy Act obligations: our guide to data breaches in general practice explains the 30 day assessment rule and what a response plan should cover.

How CSG fixes this: we work through this checklist with you as a project, then keep it current through our managed IT service with periodic security reviews, summary findings and IT planning sessions to keep your roadmap current. When ASD publishes its transition expectations, we will tell you what they mean for your business and update your roadmap.

How CSG helps with the Essential Eight and ASD Essentials

We are a Gold Coast based team, supporting organisations across the Gold Coast, Brisbane, Tweed Heads and South East Queensland since 1999. We are ISO/IEC 27001:2022 certified and audited annually, and we work to ASD's Essential Eight, with an eye on ASD's new Essentials series.

In practice that means four things: Essential Eight assessment and uplift that keeps moving, a map of your current controls against the ASD Essentials domains using ASD's own transition guidance, evidence and reports you can show clients and insurers, and a plain explanation from us when ASD sets out the transition. Progress you can show, not progress you assume. Talk to our team or call us on (07) 5551 2333.