ASD Essentials explained: what replaces the Essential Eight
The Essential Eight
has evolved.
On 15 October 2026 the Australian Signals Directorate published ASD Essentials, the successor to the Essential Eight. Here's what changed, what it means for the Essential Eight work you've already done, and where to start.
Updated 29 October 2026 · Based on ASD's published Essentials series
What ASD
published.
Essential Eight vs
ASD Essentials.
| Topic | Essential Eight | ASD Essentials |
|---|---|---|
| Built around | Eight mitigation strategies, mostly technology-specific | Principles and actions applied across eight domains of your environment |
| How progress is measured | Maturity Levels Zero to Three | An effectiveness rating for each action in each domain |
| What's assessed | Whether specific controls are implemented | Whether each action actually achieves its outcome, with evidence |
| Where to start | Pick a target maturity level | Work through three priority phases |
| Coverage | Technical controls | Adds governance, visibility and response, and areas such as supplier assurance and AI accountability |
Where the
work applies.
The enterprise IT chapter groups your environment into six technical domains and two capability domains. These summaries are ours, in plain terms; ASD's chapter defines each domain precisely.
Boundary services
Internet-facing services at the edge of your environment, such as email, websites and remote access.
Identity services
Directories and authentication: how people and admins prove who they are before they get access.
Critical processes and services
The systems and processes the business can't run without, and how they're protected and recovered.
Privileged environments
Administrator accounts and the tools and workstations used to manage everything else.
Business systems
Line-of-business applications and the data in them, from finance and CRM to file storage.
User devices
The laptops, desktops and phones your people use every day.
Governance and culture
Leadership, policies, risk decisions and how security is built into the way people work.
Visibility and response
Logging, monitoring, detection and how you respond when something goes wrong.
Effectiveness,
not checkboxes.
Each action is rated separately in every domain it applies to: not assessed, not effective, partially effective or fully effective. A principle takes the lowest rating of its actions in that domain, so one weak link pulls the whole principle down.
The bar is outcomes. Deploying a tool doesn't by itself show it's effective, and starting work or having a plan doesn't count as partially effective. You need evidence that the action achieves what it's meant to, consistently and currently.
The priority phases set the order of work, not a score: Phase 1 covers boundary and identity services, Phase 2 critical processes and privileged environments, and Phase 3 business systems and user devices. Governance and culture, and visibility and response, run through all three.
Your next
five steps.
Keep going
Don't pause Essential Eight work. Existing obligations, including Maturity Level Two for Commonwealth entities under the PSPF, still apply until regulators say otherwise.
Baseline
Map your current controls, evidence and risk decisions to the eight domains to see what carries over and what's genuinely new.
Start with Phase 1
Scope boundary and identity services first, together with governance and visibility.
Test the evidence
Check coverage and currency, and whether evidence comes from your systems or from someone's say-so.
05 · Brief leadership. Explain what your Essential Eight investment already delivers under the new framework, and what work is new.
From maturity levels
to proven outcomes.
Transition assessment
We map your Essential Eight controls and evidence to the eight domains, rate each action's effectiveness and show you the gaps that matter.
Phase 1 uplift in Microsoft 365
For most SMBs, boundary and identity services live in Exchange Online, Entra ID and Conditional Access. Our engineers make the fixes themselves.
Evidence you can show
An evidence pack and effectiveness ratings your board, clients, insurers and auditors can follow, reviewed as your environment changes.
ASD Essentials
FAQs.
Does our Essential Eight maturity level carry over?
Do we have to switch to ASD Essentials now?
Is ASD Essentials mandatory?
We never implemented the Essential Eight. Where do we start?
How long does a transition assessment take?
Sources: Australian Signals Directorate, Essentials for enterprise IT and Transitioning from the Essential Eight. This guide summarises ASD's material and isn't a substitute for it.
Plan your
transition.
Fast response. No bots. Just real solutions from a senior engineer, the same business day.