ASD has replaced the Essential Eight with ASD Essentials. Your existing security work still counts, there’s no deadline yet, and the new model rewards proof that your controls keep working.
Topic Security
Published 25 October 2026
Updated 25 October 2026
The short version
If your business has worked towards the Essential Eight, or answered questions about it in a tender or cyber insurance form, this change affects you. On 15 October 2026, the Australian Signals Directorate (ASD) released ASD Essentials, a new framework that takes over from the Essential Eight.
ASD Essentials replaces the Essential Eight as ASD’s baseline cyber security guidance.
Maturity Levels One to Three no longer apply. Each control is now rated on how well it works.
The security work you’ve already done still counts.
There’s no mandatory changeover date yet, so you have time to plan properly.
Why the change?
ASD introduced the Essential Eight in 2017. Since then, most organisations have moved to a blend of cloud services, on-premises systems and remote work, and attackers have adapted just as quickly.
A fixed list of eight technical controls can’t fit every environment well. ASD Essentials changes the question from “is this control switched on?” to “does this control protect us, and can we show it?”
What’s different?
Here’s how the two frameworks compare on the points that matter most to a business:
| What changes | Essential Eight | ASD Essentials |
|---|---|---|
| How progress is measured | One maturity level, from Zero to Three | A rating for each control: not assessed, not effective, partially effective or fully effective |
| What counts as done | The control is in place | Evidence the control keeps working over time |
| Where to start | All eight strategies, one maturity level at a time | Highest-risk areas first, worked through in priority phases |
| Technology | Some technology-specific requirements | Technology-neutral, with no required products or vendors |
| What’s in scope | Eight technical mitigation strategies | Technical controls plus leadership accountability, supplier risk and staff awareness |
The biggest shift is evidence. Under the old model, many businesses switched on multi-factor authentication (MFA) and moved on. Under ASD Essentials, you need to show that MFA covers every account and every sign-in path, and that it stays that way.
The eight focus areas
ASD Essentials for enterprise IT groups its guidance into eight areas. In plain terms:
Identity services: how people sign in, and what each account can reach.
Boundary services: internet-facing systems such as firewalls, VPNs and remote access.
Critical processes and services: the systems your business can’t operate without.
Privileged environments: administrator accounts and the systems used to manage everything else.
Business systems: the applications and data your team relies on every day.
User devices: laptops, desktops, tablets and phones.
Governance and culture: leaders owning cyber risk, managing suppliers and building staff awareness.
Visibility and response: spotting problems early and acting quickly when they happen.
Start with sign-ins and internet-facing systems. They’re the most common way attackers get in, and ASD puts them in the first priority phase.
Does my Essential Eight work still count?
Yes. ASD’s transition guidance maps every Essential Eight strategy to at least one part of ASD Essentials. Patching, backups, MFA, application control and admin restrictions all stay relevant.
There’s a catch. Your current maturity level won’t translate directly into a new rating. You’ll need to reassess your existing controls against the new framework to confirm what carries over and where the gaps are.
Do I need to act now?
Not urgently. ASD hasn’t set a mandatory changeover date, and both frameworks stay on cyber.gov.au during the transition. Keep meeting your current obligations until your regulator tells you otherwise. See Transitioning from the Essential Eight for ASD’s advice.
Starting early still pays off. Cyber insurers and tender panels regularly ask for proof of controls like MFA, backups, patching and admin access, and gaps can mean higher premiums, exclusions or lost bids. Expect those questions to follow ASD Essentials over time. Better evidence now means stronger answers later.
What’s in it for your business?
Better use of your budget. You fix your biggest risks first, so money goes where it reduces the most exposure.
Works with the tools you have. ASD Essentials doesn’t mandate products. If you use Microsoft 365, many of the controls you need may already be in your licences.
Clearer reporting for leadership. Ratings for each area show where you’re strong and where you’re exposed.
Stronger insurance and tender responses. You can point to evidence instead of a single maturity number.
Quick self-check: where do you stand?
Answer yes or no to each question. It’s a rough guide to help you plan, not an official ASD rating.
How we help
At Hivemind Solutions, we help Australian organisations move from the Essential Eight to ASD Essentials without starting again.
Review what you have. We start with your current security settings and the evidence you already hold.
Map it to the new framework. We line up your controls against each of the eight focus areas.
Check it works. We test coverage, consistency and evidence using reporting already available in Microsoft 365, Intune, Entra ID and Defender.
Give you a clear plan. You get a prioritised roadmap and a plain-English summary for leadership.
Frequently asked questions
Is the Essential Eight gone?
Not yet. ASD keeps it available during the transition, and current obligations still apply until regulators update them.
Is ASD Essentials only for government?
ASD wrote it with government, critical infrastructure and larger organisations in mind. Attackers don’t check company size, though, so smaller businesses benefit from the same approach.
We’re at Maturity Level Two. What are we now?
There’s no direct conversion. A gap assessment shows how each of your controls rates under the new model.
Do we need new software?
Not necessarily. ASD Essentials is technology-neutral, so most businesses can get more from the tools they already pay for.
We’re fully cloud-based. Which guidance applies to us?
ASD publishes separate chapters for enterprise IT, cloud and operational technology. Many businesses run a mix and need more than one chapter.
Where do we start?
With sign-ins and internet-facing systems. That’s where ASD points first, because they’re the most common way in.
Further reading
ASD Essentials for enterprise ITㅤ❯
Transitioning from the Essential Eightㅤ❯
Related services
Ready to see where you stand?
Book a free conversation with our team. We’ll walk through your current setup and show you what the move to ASD Essentials looks like for your business.