ASD Has Published the Essentials: What Changed from the Essential Eight

What ASD published

• Chapters for different environments. The Essentials is built from environment-specific chapters. The current chapters cover enterprise IT, cloud and operational technology, and ASD says more can be added as needed.
• One model in every chapter. Each chapter has three layers: principles (the security outcomes to reach), actions (the work to get there) and domains (the business functions and assets the actions apply to).
• No single maturity level. The Essential Eight rated an organisation from Maturity Level Zero to Three. Under the Essentials, organisations report area by area (for example identity services or internet-facing systems) with effectiveness ratings backed by evidence. ASD says the implementation phases are not maturity ratings.

What hasn’t changed

• Your current obligations. Organisations should keep meeting existing regulatory obligations until regulators announce formal changes. Contracts, panels, insurers and the PSPF that name the Essential Eight still mean the Essential Eight.
• The security work. Patching, application control, MFA, restricting admin privileges and backups are still the core. The ACSC’s head has said Essential Eight maturity work still counts toward the new framework.
• The dates. When the Essentials becomes mandatory has not been settled. In June ASD told iTnews it expected the Essential Eight to start deprecating about 12 months after the announcement and retire about 24 months after; those are estimates, not published dates.

What to do now

1. Keep your Essential Eight programme running. If a customer or insurer asks for ML2 today, that is still the requirement.
2. Check, don’t assume. ASD’s guidance asks organisations to check their existing controls against the new framework. Map each control to the chapter that fits your environment before changing anything.
3. Pick your chapters. Most organisations need the enterprise IT chapter. If you run significant cloud workloads or OT, read those chapters too: they may fit better than the Essential Eight ever did.
4. Organise evidence by area. Reporting is now area by area with evidence-backed effectiveness ratings, so group your evidence (identity, internet-facing systems and so on) and show the control works, not just that it is configured.
5. List who names the Essential Eight. Note which contracts, panels and insurers reference it, so you know who to talk to when they move.

Our provisional Essential Eight to Essentials mapping shows where each strategy is likely to land and the evidence that shows it working. Our guide, ASD has published the Essentials: what it means for your Essential Eight work, has the detail, and you can sign up there for one email when ASD’s chapter references are added to the mapping. For an assessment against the current Essential Eight, see our Essential Eight service.

Sources

• ASD, The Essentials
• ASD, What is the Essentials? (published 15 October 2026)
• iTnews, ASD’s Essential Eight replacement moves away from maturity ladder
• OpenGov Asia, Australia expands cyber resilience guidance with ASD Essentials
• iTnews, ASD to retire Essential Eight cyber security framework within next two years (June 2026)

Last reviewed 15 October 2026.