ASD Essentials: what replaces the Essential Eight

On 15 October 2026 the Australian Signals Directorate published the ASD Essentials, a new cyber security framework that replaces the Essential Eight. The Essential Eight stays online while organisations move across, and the ASD says anyone obliged to meet it should keep doing so until their regulator says otherwise. But the direction is set, and the shape of the new framework tells you what the ASD now thinks matters.

What the Essential Eight asked

The Essential Eight was a fixed list: patch applications, patch operating systems, use multi-factor authentication, restrict administrative privileges, control which applications can run, restrict Office macros, harden user applications, and keep regular backups. Each was graded from Maturity Level Zero to Three. It was prescriptive on purpose, and that was its strength. A 20-person business could read the list and know what to do on Monday.

The ASD's reasons for retiring it are in its own words: a fixed set of controls does not translate well across on-premises, cloud and operational technology, and it does not keep pace as threats and technologies change. AI is the example it gives.

What the Essentials asks instead

The Essentials is organised in three layers. Principles describe the security outcome to achieve. Actions describe what has to be done to get there. Domains describe which systems and business functions the actions apply to. It is published in chapters for enterprise IT, cloud and operational technology, and the enterprise IT chapter is the direct successor to the Essential Eight.

Maturity levels are gone. In their place are priority phases: a recommended order for working through the domains, starting where the ASD's incident data says attackers get in. Phase one is boundary services (anything internet-facing), identity services (directories, logins, credentials), plus two capability domains that run through everything: governance and culture, and visibility and response. Later phases cover critical processes, privileged environments, business systems and user devices.

Two practical points from the ASD's transition guidance. Every Essential Eight strategy maps to at least one Essentials principle, so work already done is not wasted. And an Essential Eight maturity rating does not convert into an Essentials result; the new framework measures whether an action is effective for the assets in a domain, not whether a control is installed.

Who it is written for

The ASD is explicit that the Essentials is written for Commonwealth entities, critical infrastructure and large organisations. Smaller businesses can use it where it is relevant, and the ASD keeps separate guidance for small business. So if you run a 20-person company you are not expected to adopt the enterprise IT chapter wholesale. You will, however, meet it second-hand: client security questionnaires, insurer forms and tender requirements will start to use its language within a year or two.

What we take from it

The framework now says in a structured way what we have built our hosting around for some time. Internet-facing services and identity come first, because that is where automated attacks arrive. A web application firewall in front of every property, continuous scanning, multi-factor authentication on every account that can reach a server, and log monitoring that a person actually reads are phase-one work by the ASD's own sequencing. Backups held in the same country, with restores tested, cover the visibility-and-response domain's recovery side.

If a client or insurer asks where you stand, the useful answer is now a short list by domain: what is in front of your systems, who can log in and how, what is watched, and what happens when something is found. If you would like that list written for your business, with the gaps ranked, that is what our security assessment produces.