Essential Eight to ASD Essentials: What It Means for Your Organisation

For years, the Essential Eight gave Australian boards a simple way to talk about cyber security. Pick a maturity level, work towards it and report the number. In October 2026 the Australian Signals Directorate (ASD) replaced it with ASD Essentials, and that number no longer works the way it used to.

Why ASD moved from the Essential Eight to ASD Essentials

The Essential Eight was published in 2017, when most organisations still ran their systems on their own premises. Since then, cloud, SaaS and remote work have changed where data lives and how people log in, and attackers have adapted with them. The Essential Eight asked whether you had deployed a set of controls. ASD Essentials asks whether those controls are protecting you, in every part of the business that matters.

This article focuses on the enterprise IT chapter. Alongside it, ASD has published separate chapters for cloud and operational technology (OT).

Does ASD Essentials apply to your organisation?

ASD has written the series primarily for Commonwealth entities, critical infrastructure operators and large organisations. Mid-market organisations will still feel the change. If your board, regulator, insurer or major customers ask for your Essential Eight maturity level, expect that question to change. Government and critical infrastructure suppliers will likely see it arrive through contracts first.

Your past investment still counts

ASD says every Essential Eight strategy maps across to the new framework. As Chris Horlyck, Head of Cyber Security Resilience at the ACSC, put it in June: “The investment you’ve made under the Essential Eight will still be relevant under the Essentials.”

The rating is a different story. ASD states that previous maturity levels “do not automatically translate” into ratings under the new framework, for three practical reasons.

• Some controls now cover more ground. Blocking risky Office macros, for example, is now one part of a broader requirement to control what software can run across the business.
• Each part of the business is checked separately. A control that works well on staff laptops may still fall short on your internet-facing systems.
• Proof matters more. Assessors want evidence a control keeps working over time, and ASD is blunt about it: “deployment alone does not demonstrate effectiveness.”

ASD even lists “claiming equivalence instead of assessing” as a common mistake to avoid.

What changes for board reporting

Instead of one maturity level, ASD Essentials rates each requirement in each part of the business as not assessed, not effective, partially effective or fully effective. Boards get a more honest picture, though the first report will look less tidy than a single number. ASD treats “not assessed” as a neutral rating, which is worth explaining to the board early.

Why AI is part of the story

ASD’s case for change points to artificial intelligence as “a clear example” of why a fixed checklist struggles to keep up. Many mid-market organisations are now rolling out Copilot, AI agents and new SaaS integrations, and each one brings new accounts, new connections and new places for passwords and access keys to sit.

ASD Essentials brings that into scope, and ASD has published a dedicated paper on AI considerations within the Essentials. The new framework asks who in your organisation is accountable for AI, how your suppliers’ security is checked, whether passwords and keys are left exposed in code and shared drives, and whether accounts used by software have only the access they need. None of this was assessed under the Essential Eight maturity model. These are the exact areas where access is quietly expanding.

Where to start

ASD recommends a staged approach, so you can build on what you already have:

1. Take stock. Gather your latest Essential Eight assessment, known exceptions and any planned security work.
2. Focus on the first four priority areas. These are governance and culture, visibility and response (detecting and handling incidents), boundary services (your internet-facing systems) and identity services (how people and systems log in).
3. Run a gap analysis. Work out which requirements you already meet, partly meet or don’t yet meet.

Phase 2 then covers core services and admin tools, and phase 3 covers everyday business systems and staff devices.

When will the Essential Eight be retired?

ASD has not set a formal retirement date. When it announced the change in June, ASD said the Essential Eight would be retired within two years, and both frameworks remain available during the transition. If a regulator or contract still asks for your Essential Eight maturity level, keep reporting it until they say otherwise.

The organisations that handle this well will treat their Essential Eight work as a head start and test it properly against the new framework. If you’d like a second view on where you stand, the Northbridge team is happy to talk it through.