ASD Framework Update · Thought Leadership · Published 1 July 2026 · Updated 15 October 2026
ASD has published the Essentials. Here's what it means for your Essential Eight work.
On 15 October 2026 ASD published the Essentials, the successor to the Essential Eight. It is a set of chapters for different environments, starting with enterprise IT, cloud and operational technology, and it replaces the single maturity level with area-by-area reporting. Until regulators announce changes, existing Essential Eight obligations still apply. This page covers what changed, what stays the same, the transition, and what to do now.
- Verified facts only
- Updated 15 October 2026
- Covers transition timeline
- Practitioner-focused
Essentials mapping alert
Get one email when we complete the Essential Eight to Essentials mapping
ASD published the Essentials on 15 October 2026. Our provisional mapping is out; we'll email you once when we add ASD's chapter references to it. One email, not a newsletter.
Section 1
What has been published
On 15 October 2026 ASD (Australian Signals Directorate) published the Essentials, the successor to the Essential Eight that it announced in June 2026. This is not a minor update: it changes how ASD's baseline is organised and how organisations report against it.
The Essentials is a series of environment-specific chapters. The current chapters cover enterprise IT, cloud and operational technology, and ASD says more chapters can be added as needed. Every chapter uses the same three layers:
- Principles: the cyber security outcomes an organisation should reach
- Actions: the work needed to reach those outcomes
- Domains: the business functions and assets the actions apply to
The biggest practical change is assessment. The Essential Eight rated an organisation from Maturity Level Zero to Three. Under the Essentials, organisations report area by area (for example identity services or internet-facing systems) with effectiveness ratings backed by evidence. ASD says the implementation phases in the Essentials are not maturity ratings.
On existing work, the ACSC's head has said Essential Eight maturity work still counts toward the new framework, while ASD's guidance asks organisations to check those controls against the Essentials rather than assume a one-for-one match. When the Essentials becomes mandatory has not been settled: organisations should keep meeting their existing regulatory obligations until regulators announce formal changes.
Sources
ASD, the Essentials; ASD, What is the Essentials? (published 15 October 2026); iTnews, ASD's Essential Eight replacement moves away from maturity ladder; OpenGov Asia, Australia expands cyber resilience guidance with ASD Essentials; ASD, Consultation on evolution of Essential Eight (June 2026); iTnews, ASD to retire Essential Eight within next two years (June 2026). Last reviewed 15 October 2026.
This page states what ASD has published and what has been reported about it. Where something comes from news coverage rather than ASD itself, we say so. Our chapter-by-chapter mapping from the Essential Eight will follow once we have worked through each chapter in full.
Section 2
The Essentials series explained
The Essentials is a multi-chapter framework. Rather than one set of eight strategies, it organises guidance into chapters for different technology environments, each built from the same principles, actions and domains. ASD published the first three chapters together on 15 October 2026.
Essentials for enterprise IT
This is the closest equivalent to the Essential Eight and the chapter that went through public consultation (closed 12 July 2026). It covers enterprise IT: the corporate workstations, servers and identity infrastructure the Essential Eight was designed to protect.
The key shift: the chapter sets out the outcomes to reach and the actions that get you there, rather than one maturity ladder, and you report how effective each area is. This suits organisations running non-Microsoft endpoint management, Linux fleets or mixed environments, where Microsoft-specific Essential Eight guidance was a poor fit.
Operational technology (OT)
The Essential Eight was never designed for operational technology environments — SCADA systems, industrial control systems, building management systems, and the operational infrastructure that underpins Australian critical infrastructure. The Essentials now has its own chapter for OT environments, recognising that the threats and the controls available are different from enterprise IT.
For SOCI Act operators and critical infrastructure providers who have struggled to apply Essential Eight controls to OT, this matters: patching SCADA systems on a 14-day cycle, or applying application control to industrial controllers, is often operationally impossible. Read the OT chapter itself before changing your programme.
Cloud environments
Cloud-native environments — workloads running in AWS, Azure, GCP, and SaaS platforms — have a different security model from traditional enterprise IT. The Essential Eight's controls were largely written for on-premises or hybrid Microsoft environments. The cloud chapter addresses the security outcomes ASD considers essential where significant workloads run on cloud platforms.
Cloud environments have different patching models (provider-managed vs. customer-managed), different identity models (service accounts, workload identities, IAM roles), and different backup paradigms. Outcomes-based guidance suits this diversity better than the Essential Eight's prescriptive approach.
Agentic AI
When it consulted, ASD flagged agentic AI as a possible future chapter, and it says more chapters can be added as needed. As organisations deploy AI agents, LLM-powered systems, and automated decision-making tools in production, a new category of security outcomes will be needed. The modular chapter structure means ASD can publish AI-specific guidance without rearchitecting the entire framework.
No AI chapter was part of the 15 October 2026 release, and no timeline has been given.
ASD's four design attributes for the Essentials
When it opened consultation, ASD set out four design attributes that distinguish the Essentials from the Essential Eight.
1. Flexibility
The framework is outcomes-based and technology-agnostic. Organisations choose the tools and implementations that fit their environment, as long as they achieve the required security outcome. This removes the implicit Microsoft-only bias of the Essential Eight and accommodates the full diversity of Australian IT environments.
2. Threat-informed design
Like the Essential Eight before it, the Essentials series is grounded in the current Australian threat landscape and the ISM (Information Security Manual). Controls are not theoretical — they address the techniques that adversaries are actually using against Australian targets today.
3. Compatibility
Existing Essential Eight investments map across. This is ASD's direct commitment to organisations mid-programme: your work carries forward. The controls themselves are not being discarded — the way they are expressed and assessed is changing. Nothing is wasted.
4. Future-focused
The chapter structure lets ASD publish new guidance as technology evolves without rewriting the whole framework: OT and cloud arrived as their own chapters alongside enterprise IT. As new environments become security-critical, new chapters can be added. The framework grows with the threat landscape.
Section 3
The transition timeline
The Essentials is published; the Essential Eight has not yet been withdrawn. Both are live, and the dates beyond today are approximate, from ASD's comments to iTnews in June 2026 rather than a published ASD schedule.
Public consultation closed ✓
The consultation period for Essentials for enterprise IT (Chapter 1) closed as scheduled, having taken submissions via the ACSC Partner Portal at partners.cyber.gov.au.
The Essentials published ✓
ASD published the Essentials with chapters for enterprise IT, cloud and operational technology. Procurement panels, insurers and regulators now review their requirements; until they announce changes, existing Essential Eight obligations still apply. Both frameworks are live from this point.
Essential Eight deprecation begins (approximate)
ASD told iTnews in June 2026 that it expected the Essential Eight to begin deprecation about 12 months after the announcement. ASD has not published a fixed date. Procurement panels and regulators are expected to start updating their requirements during this window. Essential Eight references in contracts will need to be reviewed and updated over time.
Essential Eight fully retired (approximate)
ASD's June 2026 estimate was full retirement about 24 months after the announcement; when the Essentials becomes mandatory has not been settled. By this point, procurement panels and regulators should have updated their requirements to reference the Essentials series. Organisations will need Essentials series compliance documentation rather than Essential Eight evidence packs.
During the transition: both frameworks are live
Until regulators and panels change their requirements, organisations need to be aware of both the Essential Eight (still required by existing procurement contracts, PSPF obligations, and insurer requirements that reference it) and the Essentials (the published successor that new requirements will be written around). Compliance365 will maintain coverage of both frameworks during the transition and update client documentation accordingly.
Section 4
Essential Eight vs Essentials for IT — what changes
Understanding what actually changes — and what stays the same — is critical to planning your programme. The shift is more philosophical than technical, but the practical implications are real.
| Dimension | Essential Eight | The Essentials |
|---|---|---|
| Compliance model | Prescriptive — specific controls and specific behaviours required | Outcomes-based — principles (outcomes), actions (the work) and domains (what they apply to) |
| Technology scope | Primarily Windows / Microsoft 365-centric; other environments require interpretation | Technology-agnostic; outcomes achievable with any qualifying toolset |
| Maturity model | ML0–ML3 maturity levels with specific criteria at each level | No single maturity level: reported area by area (for example identity services or internet-facing systems) with evidence-backed effectiveness ratings; implementation phases are not maturity ratings |
| OT coverage | Not designed for OT; poor fit; organisations improvise | Its own chapter, published 15 October 2026 |
| Cloud coverage | Partially applicable; cloud-native environments require significant interpretation | Its own chapter, published 15 October 2026 |
| AI environments | Not addressed | Not in the first release; ASD says chapters can be added |
| Core controls | 8 specific strategies (app control, patching, macros, hardening, admin privileges, OS patching, MFA, backups) | Existing Essential Eight work counts; ASD asks organisations to check their controls against the new chapters |
| Procurement impact | Referenced in PSPF, state government panels, insurer requirements | Requirements update as regulators and panels announce changes; Essential Eight references stay active until then |
What does not change
The underlying security controls remain largely the same. MFA, patching, application control, privileged access management and backups are as relevant under the Essentials as under the Essential Eight. ASD is changing how controls are expressed and assessed — not discarding the security thinking that underpins them. The threat actors exploiting credential theft, unpatched software, and privilege escalation will not stop because the framework changed names.
- MFA enforcement across all internet-facing services — still essential
- Patching within ASD-specified timeframes — still essential
- Application control to prevent malicious executables — still essential
- Privileged access management with time-limited elevation — still essential
- Tested, immutable backups — still essential
Section 5
If you're already on the Essential Eight
The short answer: continue your programme. Do not stop.
If you have a current Essential Eight ML2 assessment, are mid-programme toward ML2, or have compliance obligations that reference the Essential Eight — none of that changes today. The procurement panels, PSPF requirements, insurer conditions, and enterprise TPRM programmes that require Essential Eight compliance all continue to reference it until they are individually updated. That process will take time and will be communicated by the relevant bodies.
ASD's explicit design attribute of compatibility means your existing implementation maps across to the Essentials series. The controls you have implemented — Conditional Access policies, PIM configuration, application control, patch management, backups — all address the same security outcomes that the Essentials series will require. Now that the Essentials is published, your evidence pack will need re-mapping to its areas and effectiveness ratings, and ASD asks organisations to check their controls against the new chapters, but the underlying work is not undone.
Your current ML2 assessment documentation remains valid for any procurement or insurance requirement that references the Essential Eight. Maintain your evidence pack and your continuous monitoring. Do not let controls lapse in anticipation of the new framework — you will need them regardless.
Continue doing
- Your current Essential Eight uplift programme
- Maintaining existing ML2 controls and evidence
- Meeting current procurement and insurance requirements
- Quarterly evidence reviews and control monitoring
- Working toward ML2 if not yet achieved
Watch for
- ASD's chapter references added to our provisional mapping
- PSPF updates referencing the Essentials series
- Procurement panel requirement updates
- Insurer requirement updates
- Any ASD date for Essential Eight deprecation
Section 6
If you haven't started yet
This requires nuance. The answer depends on why you need to comply and how urgent your timeline is.
Start with Essential Eight now if:
- You have a government contract or procurement panel requirement referencing the Essential Eight
- You need cyber insurance and your insurer requires ML2 evidence
- You have a DISP or SOCI Act obligation to meet
- You have an enterprise customer running TPRM that references E8
- Your board or executive team is asking for a cyber security baseline today
In all of these cases, starting on the Essential Eight now is correct. The controls carry forward to the Essentials series. You will not redo the work. The uplift you do today addresses the same outcomes the new framework will require.
You might align straight to the Essentials if:
- You have no immediate procurement driver and a 12+ month runway
- You operate in a cloud-native or OT environment where E8 is a poor fit and the new cloud or OT chapter fits better
- You have already done significant security uplift and are assessing which framework to formally align to
Even then, the work is the same: MFA, patching discipline, privileged access management and backups, organised by the Essentials' principles and actions instead of Essential Eight maturity levels. That work counts under both frameworks.
Do not let the transition become a reason to delay security investment. The threat actors are not waiting for regulators to update their references.
Section 7
What Compliance365 is doing
We tracked the public consultation through its close on 12 July 2026 and reviewed the consultation draft against our work with Australian mid-market and government organisations. ASD published the Essentials on 15 October 2026, and we are now working through each chapter.
Now that it is published, we will:
- Complete our provisional Essential Eight → Essentials mapping with ASD's chapter references, and notes for the cloud and OT chapters
- Update our assessment templates and evidence pack formats to reflect the new framework
- Update guidance for Microsoft 365, Intune, and Entra ID implementations to reference the Essentials outcomes
- Notify existing clients and update their documentation as part of their ongoing support arrangement
Clients on ongoing support arrangements do not need to do anything differently right now. Their documentation will be updated as we complete the mapping. Clients who are mid-programme should continue — we will guide the transition when the time comes.
If you have questions about how this affects your specific programme, book a call. We will give you a straight answer based on your environment and compliance drivers.
Free monthly digest
Get the monthly Australian compliance digest
Practical updates on ISO 27001, Essential Eight, Privacy Act and AI governance — delivered once a month. No spam, unsubscribe any time.
FAQ
Frequently asked questions
The questions we are most commonly asked about the Essential Eight retirement, the Essentials series transition, and what organisations should do now.
Should I stop my Essential Eight programme?
No. ASD has been explicit: Essential Eight investments carry across to the Essentials series. The underlying security controls remain largely the same. If you have procurement drivers, insurance requirements, or government contracts that reference the Essential Eight today, continue your programme — those requirements do not change until regulators and panels update their references, which will happen gradually over the transition period.
Will my Essential Eight evidence still count under the new framework?
Yes, with caveats. ASD has confirmed that existing Essential Eight investments and programmes map across to the Essentials series — the design attribute of 'compatibility' was explicitly included to ensure nothing is wasted. ASD published the Essentials on 15 October 2026, and its guidance asks organisations to check their existing controls against the new framework rather than assume a one-for-one match. The controls themselves carry across; the evidence is now organised by area and rated for effectiveness, so most evidence packs will need re-mapping rather than redoing.
What is the maturity model in the Essentials series?
There is no single maturity level. Instead of one ML0–ML3 rating, organisations report area by area (for example identity services or internet-facing systems) with effectiveness ratings backed by evidence. ASD says the implementation phases in the Essentials are not maturity ratings. Each chapter is built from principles (the outcomes to reach), actions (the work to get there) and domains (the business functions and assets the actions apply to).
When do procurement panels switch from Essential Eight to the Essentials series?
Not until regulators and panel administrators update their requirements — which will happen gradually. The PSPF, state government procurement panels, and enterprise TPRM programmes all reference the Essential Eight by name. These will be updated to reference the Essentials series over the transition period, but procurement panels move slowly. Do not expect an overnight switch. During the transition both frameworks will be live simultaneously, and Essential Eight requirements will remain active for existing procurement contracts.
What does "outcomes-based" compliance mean in practice?
Outcomes-based compliance means the framework specifies what security result you need to achieve — not the specific product or policy name you must use to achieve it. Instead of "restrict macros using Microsoft Office Group Policy setting X", the Essentials series would say something like "prevent execution of unauthorised macros". You can meet that outcome using Microsoft Group Policy, Intune ADMX templates, a third-party endpoint management tool, or any other mechanism that reliably achieves the result. This matters most for organisations running non-Microsoft environments or hybrid OT/IT infrastructure.
Does this affect PSPF obligations for government entities?
The PSPF currently mandates Essential Eight compliance for non-corporate Commonwealth entities. The Essentials was published on 15 October 2026, but when it becomes mandatory has not been settled, and PSPF updates follow their own process and timeline. Until a formal PSPF update is issued, Commonwealth entities remain obligated to the Essential Eight as written. State government agencies should monitor their own jurisdictional frameworks. We will publish guidance when PSPF changes are formally announced.
What happens to Essential Eight ML2 assessments I already have?
Your existing ML2 assessment documentation remains valid for any requirement that currently references the Essential Eight. As procurement panels and insurers update their requirements to reference the Essentials series, they will need to define how existing Essential Eight evidence is accepted during transition — this is something industry bodies and ASD will need to communicate clearly. For now, continue maintaining your ML2 evidence pack. Do not let it lapse in anticipation of the new framework.
When will Compliance365 publish updated guidance for the Essentials series?
ASD published the Essentials on 15 October 2026. Our provisional mapping of each Essential Eight strategy to the Essentials is published at compliance365.com.au/resources/essential-eight-to-essentials-mapping/; ASD's principle and action references will be added once checked against the enterprise IT chapter. Existing clients will receive updated assessment templates and evidence pack documentation as part of their ongoing support arrangements.
Not sure how the Essentials series transition affects your programme?
Book a 30-minute call and we will give you a straight answer based on your environment and compliance drivers — what to do now, what to watch for, and how your existing Essential Eight work maps to the new framework.
