Essential Eight to ASD Essentials: a transition tracker

This page tracks one question about the Essential Eight: what ASD's Essentials series changes, and when.

The short version

ASD has published the replacement. On 15 October 2026 ASD published ASD Essentials: chapters for enterprise IT, operational technology and cloud, plus transition, implementation planning and assessment guides. ASD's transition guide says:

The Australian Signals Directorate (ASD) has evolved the Essential Eight into the ASD Essentials for enterprise IT to address contemporary cyber threats and modern enterprise environments.

ASD's FAQ is blunter. Its heading reads "Why is ASD replacing the Essential Eight?"

The Essential Eight has not been retired. ASD has published no deprecation or retirement date. The Essential Eight Maturity Model of November 2023 is still on cyber.gov.au, unchanged, and every obligation (PSPF, DISP, SOCI, the state policies) still points at it. On timing, ASD says only that it "will advise on expectations for transitioning to the new framework in due course".

So, in practice: keep meeting your Essential Eight obligations, keep your uplift program running, and start mapping your existing controls to ASD Essentials so that you are ready when the regulators set dates.

What ASD published on 15 October 2026

All of the following are on cyber.gov.au/essentials, each stamped "Published 15 Oct 2026":

• Three chapters: ASD Essentials for enterprise IT, ASD Essentials for operational technology and ASD Essentials for cloud.
• Overview publications, including What is the Essentials?, The case for change, a reading guide, guidance for senior executives, AI considerations and an FAQ.
• Supporting guides: Transitioning from the Essential Eight, an implementation planning guide, an assessment process guide and a glossary.

How it differs from the Essential Eight

ASD's What is the Essentials? describes three layers, used the same way in every chapter:

• Principles "describe the cyber security outcomes an organisation should achieve". They are "drawn from the cyber security principles in ASD's Information security manual (ISM)".
• Actions "describe what needs to be done to achieve those outcomes".
• Domains "describe the business functions and assets to which the actions apply". There are six technical domains and two capability domains (Governance and culture, and Visibility and response).

The other changes, in ASD's words from the transition guide:

• Maturity levels are gone. "Organisations no longer select a target maturity level." Instead, priority phases set the recommended order for the technical domains. In the enterprise IT chapter, phase 1 is Boundary services and Identity services, phase 2 is Critical processes and services and Privileged environments, and phase 3 is Business systems and User devices. ASD says priority phases "are not maturity or assurance ratings".
• Assessment rates outcomes, not requirements. Each action is rated not assessed, not effective, partially effective or fully effective, for the assets in each domain. ASD's FAQ says a principle takes the rating of its lowest applicable action.
• Old ratings do not convert. "Previous Essential Eight maturity level ratings do not automatically translate into effectiveness ratings under the ASD Essentials for enterprise IT. The two approaches assess different things."
• Existing work still counts. "Every Essential Eight mitigation strategy maps to at least one principle in the ASD Essentials for enterprise IT. Existing controls will often directly satisfy, or contribute to, one or more actions."
• There is more to cover. The enterprise IT chapter adds outcomes the Essential Eight did not assess, including governance and risk management, supplier assurance, broader asset identification, content filtering, awareness training and a dedicated Visibility and response domain.

What ASD has not published

• A retirement or deprecation date for the Essential Eight. On transition timing, the FAQ says: "ASD has been communicating with regulatory bodies around the impact and expected timeframes of transitioning to the new framework and will advise on expectations for transitioning to the new framework in due course."
• Any change to the Essential Eight Maturity Model. The maturity model still reads "Last reviewed 27 Nov 2023", with no notice that it has been superseded.
• Any change to the obligations. We found no published change to PSPF, DISP, SOCI or the WA and NSW policies. ASD's transition guide says organisations "should also continue to meet any regulatory, contractual or other obligations that require Essential Eight implementation or reporting".

What has only been reported

On launch day (15 October 2026), iTnews reported comments from Stephanie Crowe, head of the Australian Cyber Security Centre:

What we are working on now with policy agencies in government is an appropriate timeframe for transition from a regulatory perspective.

iTnews reports that she said this work would run "over the next year or two", that the Essential Eight "will stay on ASD's website alongside the new framework", and that government agencies "will be assessed against both next year". None of those timings appear in an ASD publication.

Earlier, on 24 June 2026, iTnews reported comments from Chris Horlyck, Head of Cyber Security Resilience at ASD's ACSC:

Then we will look to, probably in 12 months, start to deprecate the Essential Eight, and then in 24 months we'll retire the Essential Eight as a whole.

These are senior officials describing intent, and they are worth planning around. They are not publications, they carry no commencement instrument, and the difference matters if you are writing a date into a risk register, a board paper or a tender response.

Vendor commentary since the launch mostly says the Essential Eight is "retired" or "dead". ASD's own pages say it is being replaced, and that the obligations stand until ASD advises otherwise. If you are reading one of those posts, check what it cites.

Why the change was coming

Two things in ASD's earlier output pointed the same way.

The Essential Eight was never designed for the environment most organisations now run. ASD says so directly in the maturity model: the Essential Eight "has been designed to protect organisations' internet-connected information technology networks", and while its principles may be applied to enterprise mobility and operational technology, "it was not designed for such purposes". ASD Essentials has separate chapters for operational technology and cloud.

ASD had already published the layer above it. The Foundations for modern defensible architecture, last reviewed October 2025, describe themselves as "a structural framework upon which to implement ASD's ISM and ASD's Essential Eight Maturity Model". ASD says the Essentials principles "align with ASD's Modern defensible architecture".

The November 2023 update had already "adopted language from mapped controls within the Information security manual (ISM)". The move to ISM-grounded principles started there.

What to do now

Keep going with the Essential Eight. ASD's FAQ: "ASD does not recommend slowing or stopping the roll-out of pre-approved cyber security initiatives that will uplift an organisations security posture. Organisations should continue their current uplift programs, while assessing alignment with the new framework."

Keep meeting your obligations. Nothing that requires the Essential Eight has changed yet. If a contract, a directive or a regulator asks for an Essential Eight maturity level, that is still what you report.

Start the gap analysis. ASD suggests establishing a "transition baseline" from your Essential Eight maturity, existing controls, risk assessment results and key business functions, then scoping the priority phase one domains. Use your existing Essential Eight evidence as the starting point, and expect to add evidence that controls stay effective, not only that they were deployed.

Do not write a retirement date into anything binding. If a document needs one, say that ASD has published none, and attribute any timeline to the interview it came from.

If you build software, the ISM matters more than before, because ASD Essentials principles are drawn from it. The ISM has always carried the requirements the Essential Eight does not.

Changelog

We check this page against cyber.gov.au and update the date at the top whether or not anything has changed, so an old date means we have stopped looking rather than that nothing has happened.