For years, Australian businesses have described their cyber security in a single line: “We’re Essential Eight Maturity Level Two.” That shorthand is on its way out.

In October 2026, the Australian Signals Directorate (ASD) released ASD Essentials, an evolution of the Essential Eight. It keeps the fundamentals that worked, adds what was missing, and changes how security is measured and reported. This guide explains what has changed, who it applies to, and what you can do about it now.

If you want a quick sense-check of where your security stands today, Is Your Business Secure? A Cybersecurity Checklist is still a solid place to start.

What is ASD Essentials?

ASD Essentials is a series of chapters. Each one applies the same framework to a different technology environment. Two matter most to Australian businesses right now:

• Essentials for enterprise IT is the direct successor to the Essential Eight. It is aimed at organisations whose size, complexity, regulatory exposure or reliance on technology means cyber security needs a structured, deliberate approach.
• Essentials for cloud applies to environments delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS).

A chapter for operational technology (OT) has also been published, for organisations running industrial or physical systems.

Every chapter is built on the same three layers:

• Principles: the security outcome you are trying to achieve
• Actions: what needs to be done to achieve it
• Domains: where that work applies

The actions are deliberately technology-agnostic. ASD does not tell you which vendor or product to use. It tells you what result you need and leaves the how to you. That is more flexible, and it is also more demanding. You can no longer point at a tool and call the job done.

The Eight Domains

The Essential Eight was eight controls applied across the whole environment. ASD Essentials organises security around eight domains instead.

Two capability domains run through everything:

• Governance and culture: how cyber security is led, owned and resourced
• Visibility and response: whether you can see what is happening and act on it

Six technical domains group your assets by the risk they carry:

• Boundary services: internet-facing services and edge devices that connect your environment to the outside world
• Identity services: directories, authentication, access management and credential stores
• Critical processes and services: the systems you need to deliver your core outcomes
• Privileged environments: where administrative access lives
• Business systems: the supporting functions that keep the organisation running
• User devices: the laptops, desktops and mobiles your people use every day

ASD has an interactive explorer that walks through each domain for enterprise IT.

Where to Start: Priority Phases

ASD sets out a recommended order of work in three priority phases:

1. Phase 1: Boundary services and Identity services
2. Phase 2: Critical processes and services, and Privileged environments
3. Phase 3: Business systems and User devices

Governance and culture, and Visibility and response, apply across all three phases.

This is a real shift. Plenty of Essential Eight programs started with staff laptops and patching. ASD now says to start with identity and internet-facing systems, because that is where attackers most often get in, and weaknesses there undermine everything else.

Priority phases are a sequence, not a score. Being “in Phase 2” says nothing about how well your controls actually work.

What Has Changed From the Essential Eight

• No single maturity number. Security is rated domain by domain, based on evidence that controls are working.
• Maturity levels do not carry over automatically. A Maturity Level Two today does not translate into an equivalent rating under the new framework. ASD’s transition guidance explains how each Essential Eight strategy maps across.
• The mapping is not one-to-one. A single Essential Eight strategy can contribute to several principles and actions, and some principles are entirely new.
• Executives are explicitly accountable. The framework puts formal responsibility on senior leaders and boards, not just the IT team. ASD has published guidance specifically for senior executives.
• Effectiveness over deployment. Assessments look at whether a control works in practice, not whether it has been switched on.

What Has Not Changed

• The fundamentals still matter. Patching, MFA, restricting admin access, application control, hardening and backups all remain part of the foundation.
• Your Essential Eight work still counts. Existing controls, configurations, scan results and patch records can all serve as evidence under the new framework.
• Both frameworks run side by side for now. ASD is maintaining the Essential Eight and the Essentials during the transition. If you have a regulatory or contractual obligation tied to the Essential Eight, it still applies until your regulator says otherwise.

Is ASD Essentials Mandatory?

Not yet, and nobody can tell you exactly when it will be.

ASD has not set a date for when the Essentials becomes a mandatory requirement for regulated entities, and industry reporting suggests it will likely take a year or two to become the new standard. For most private businesses, the pressure will be indirect, just as it was with the Essential Eight:

• Customer and supplier due diligence
• Contractual security requirements
• Cyber insurance expectations
• Sector-specific obligations
• Board accountability for cyber oversight

Expect customers, insurers and tender documents to start asking about the Essentials well before any regulator does.

Enterprise IT or Cloud: Which Chapter Applies to You?

This is where many businesses will get it wrong.

The cloud chapter is only for environments delivered entirely through SaaS and PaaS. If you run Microsoft 365 alongside a firewall, on-premises or hosted servers, and laptops on a corporate network, you are an enterprise IT environment, and parts of your environment may sit under both chapters.

The cloud chapter also makes shared responsibility explicit. Your provider handles some of the work, but identity, configuration, access and monitoring of your cloud services remain yours. “It’s in the cloud” is not a security strategy.

What “Effective” Actually Looks Like

Under ASD Essentials, assessors rate each action within each domain it applies to, following ASD’s assessment process guide. The question is not “do you have it?” but “does it work?”

In practical terms, that means:

Is the action applied consistently?

• Across every asset in the domain
• Across every user group and location

Is it configured properly?

• With sensible policies
• With exceptions documented and kept under control

Is there evidence?

• Configurations, asset coverage, review records, testing outputs, remediation actions

Does it hold up over time?

• When staff join and leave
• When systems are replaced
• When an incident puts pressure on the environment

Because ratings are given per domain, the results translate naturally into a view your board can read: where you are strong, where you are exposed, and whether things are improving over time.

What to Do Now

1. Don’t stop. Continue your current uplift program. But don’t start new work purely to reach a superseded Essential Eight target.
2. Record a baseline. Capture your current Essential Eight position, controls and known risks before you begin transitioning.
3. Work out which chapter applies. Enterprise IT, cloud, or both.
4. Map what you already have. Match existing controls and evidence to the new principles and actions using ASD’s transition guidance, so you know what carries over and where the gaps are.
5. Scope Phase 1 first. Boundary services, identity services, governance and culture, and visibility and response.
6. Brief your executives. Accountability now sits with them. ASD’s senior executive guidance is a good starting point for that conversation.
7. Build for assessment from day one. Set up ongoing monitoring and documentation as you implement, so you can prove controls keep working. ASD’s implementation planning guide covers this in detail.

How Blackbird IT Can Help

• Readiness. We map your current Essential Eight controls and evidence against ASD Essentials, confirm which chapters apply to your environment, and give you a clear starting baseline. Our IT Consulting Services connect those decisions to your business priorities.
• Gaps. We assess each domain independently using ASD’s assessment approach, so you see where controls are not effective, not just where a box has been ticked. Our Cyber Security Services are built to support operations as well as protection.
• Getting covered. We turn the gaps into a prioritised roadmap that follows ASD’s priority phases, then help deliver the remediation through our cyber and IT Support teams.
• Staying covered. Controls degrade without ongoing attention. Our Managed IT Services and Compliance Management service keep frameworks like ASD Essentials, ISO 27001 and DISP part of how your business runs day-to-day, not just how it gets audited.

Frequently Asked Questions

Is the Essential Eight being replaced?
It is evolving into ASD Essentials. Both are maintained during the transition, and Essential Eight obligations still apply where they exist today.

Is my Essential Eight investment wasted?
No. Existing controls and evidence carry forward. What doesn’t carry forward is the maturity rating itself.

Does my Maturity Level convert to an Essentials rating?
No. Ratings under ASD Essentials are given per domain and need to be assessed fresh.

Is ASD Essentials mandatory?
No mandatory date has been set. Continue meeting your current obligations and plan your transition now.

Where should we start?
Identity services and internet-facing systems, plus governance and visibility. That is ASD’s Phase 1.

We’re fully in Microsoft 365. Are we “cloud”?
Only if your entire environment is SaaS and PaaS. If you also have on-premises servers, network equipment or managed laptops, the enterprise IT chapter is likely to apply too.

Sources

• Australian Signals Directorate, The Essentials for senior executives
• Australian Signals Directorate, Essentials for enterprise IT
• Australian Signals Directorate, Essentials for cloud
• Australian Signals Directorate, Essentials for OT
• Australian Signals Directorate, Transitioning from the Essential Eight
• Australian Signals Directorate, Assessment process guide
• Australian Signals Directorate, Implementation planning guide
• iTnews, ASD’s Essential Eight replacement moves away from maturity ladder

‍