The Australian Signals Directorate (ASD) published ASD Essentials on 15 October 2026, a cyber security framework built to evolve the decade-old Essential Eight. Rather than summing up a business's security in one maturity score, organisations will now report their posture area by area, starting with three chapters: enterprise IT, operational technology and cloud. Both frameworks stay live on cyber.gov.au while the transition is worked out, so no business has a new legal obligation today, but the direction ASD wants organisations to move in has changed.
What happened
ASD's announcement on cyber.gov.au describes ASD Essentials as an evolution of the Essential Eight that gives Commonwealth entities, critical infrastructure operators and large organisations practical, threat-informed and prioritised measures to protect their critical business functions and systems. The page lists small and medium business, large organisations and critical infrastructure, and government among its intended audience.
The series launches with three chapters. Essentials for enterprise IT is the direct evolution of the Essential Eight (see our earlier guide, the Essential Eight explained for small business, for what the eight strategies cover). Essentials for operational technology (OT) supports Australian critical infrastructure operators protecting their plant and equipment from cyber threats. Essentials for cloud is aimed at organisations whose technology runs entirely on software-as-a-service or platform-as-a-service. ASD says the series also carries AI-focused guidance, so organisations can weigh up AI-enabled systems within the rest of their technology environment, and that industry consultation shaped the guidance so it stays practical for Australian organisations at different levels of cyber security maturity.
The change had been flagged for months: iTnews reported in June that ASD planned to retire the Essential Eight in favour of a framework with a principles-based approach. Launching the Essentials on 15 October 2026 moves that plan from consultation into implementation and adoption, Australian Cyber Security Centre head Stephanie Crowe told iTnews, adding that "the overwhelming response from the consultation process was positive."
Key details
| Essential Eight | ASD Essentials |
|---|---|
| One maturity score, Level Zero to Level Three | A separate, evidence-backed rating for each security area |
| Eight prescribed strategies, mainly workstations and servers | Three chapters at launch: enterprise IT, operational technology, cloud |
| Specific controls to implement | Security outcomes to reach, with ASD's own worked examples |
| No set starting point among the eight strategies | Identity services and internet-facing edge devices come first |
| Stays live on cyber.gov.au during the transition | Published 15 October 2026, also on cyber.gov.au |
Why it matters
The Essential Eight's single Maturity Level Zero-to-Three rating (see our guide to Essential Eight Maturity Level One) let a business sum up roughly how exposed it was in one number. ASD Essentials drops that single score for a set of area-by-area ratings backed by evidence, such as independent testing and simulated exercises, which gives a more detailed picture but also means there is more than one rating to track and explain to a board or a client.
ASD has also set a starting point. Crowe told iTnews that identity services and internet-facing edge devices, such as firewalls, routers and VPN gateways, come before business systems and staff laptops, because "if those devices aren't secure, you're allowing threat actors into the network quite easily." She said ASD has been warning about attacks on edge devices for three or four years, and that frontier AI is now speeding up how quickly adversaries can find and exploit them, concluding that every organisation connected to the internet is at risk, not only large ones.
None of this is compulsory yet. ASD says organisations should keep meeting their current regulatory obligations until regulators communicate any changes, and that the Essential Eight stays on cyber.gov.au alongside the Essentials during the transition. Crowe told iTnews that settling an appropriate regulatory transition timeframe is still being worked through with policy agencies, and is likely to take a year or two; government agencies will be assessed against both frameworks next year.
What this means for businesses
A small or medium business does not need to act today, but the launch is a reasonable prompt to check where your own cyber security effort is going:
- Keep meeting whatever regulatory or client obligations already name the Essential Eight; nothing in those obligations changes until a regulator says so.
- Ask whoever manages your cyber security, in house or through a managed IT support provider, to read the enterprise IT chapter and say how your current setup compares, area by area, rather than by a single maturity level.
- If you run equipment connected to the internet beyond laptops and servers, such as building, refrigeration or production control systems, ask the same question about the operational technology chapter.
- If your whole technology environment runs on software-as-a-service or platform-as-a-service, read the cloud chapter first.
- Check identity services (how sign-ins are protected) and every internet-facing device before moving on to business systems and staff laptops, matching ASD's own priority order.
- Name one executive or board member as formally accountable for cyber security, which the Essentials asks for directly rather than leaving it with IT alone.
If you want a second opinion on how your current measures line up against the Essentials, ask us for a free first consultation; we give a written quote before any work starts.
Frequently asked questions
What is ASD Essentials?
ASD Essentials is the Australian Signals Directorate's new cyber security framework, launched on 15 October 2026 to evolve the Essential Eight. Instead of one maturity score, it rates an organisation's security area by area, starting with chapters for enterprise IT, operational technology and cloud.
Does the Essential Eight disappear now?
No. ASD says it will keep both the Essential Eight and the Essentials on cyber.gov.au during the transition, and organisations should keep meeting their current regulatory obligations until regulators communicate any changes.
When will ASD Essentials become compulsory?
That is not settled yet. Stephanie Crowe told iTnews that ASD is working with policy agencies on an appropriate transition timeframe, likely to run over the next year or two, and government agencies will be assessed against both frameworks next year.
Will our existing Essential Eight work count for anything?
Crowe said there is "no wasted investment" because existing control maturity counts towards the new framework, though ASD's own guidance says to check those controls against the Essentials rather than assume they are equivalent.
Where should a small business start?
ASD's priority order puts identity services and internet-facing edge devices first, ahead of business systems and staff laptops, because insecure edge devices let attackers into the network quite easily.
Does ASD Essentials cover AI?
Yes. ASD says AI-focused guidance is included so organisations can consider AI-enabled systems within their technology environment, which matters given frontier AI is making it faster for attackers to find and exploit weak edge devices.
Key takeaways
- ASD launched ASD Essentials on 15 October 2026 to evolve the Essential Eight, rating security area by area instead of with a single maturity score.
- The first three chapters cover enterprise IT, operational technology and cloud, and the series also includes AI-focused guidance.
- Both frameworks stay live on cyber.gov.au during a transition ASD expects to take a year or two to settle.
- Existing Essential Eight work is not wasted, but check it against the new Essentials rather than assume it already meets the bar.
- Start where ASD starts: identity services and internet-facing edge devices, ahead of business systems and staff laptops.