The Essential Eight has a successor. Here’s what changes.

On 15 October 2026 the Australian Signals Directorate launched ASD Essentials, the evolution of the Essential Eight. If you are midway through an Essential Eight program, the short answer is: keep going. The work you have done carries forward, and nothing published against the Essential Eight becomes wrong overnight. What changes is how you describe and prove your posture from here.

What ASD released

ASD Essentials opens with three chapters. ASD Essentials for enterprise IT is the evolution of the Essential Eight and the one most organisations will work against. ASD Essentials for operational technology (OT) is written for critical infrastructure operators. ASD Essentials for cloud covers organisations whose technology environment is delivered entirely through SaaS and PaaS. ASD also publishes AI considerations for the series. The enterprise IT chapter was consulted on from 15 June to 12 July 2026.

Every chapter uses the same three layers. Principles describe the security outcomes you are trying to achieve. Actions are the work that achieves each principle. Domains are where the actions apply. In the enterprise IT chapter there are six technical domains across three priority phases, plus two capability domains that apply across all of them. Boundary services and Identity services sit in priority phase 1. Critical processes and services and Privileged environments sit in phase 2. Business systems and User devices sit in phase 3. Governance and culture, and Visibility and response, run across every phase. One point of clarity on those phases: they are a sequencing mechanism, not a rating. They set the order in which ASD recommends the domains be addressed.

What has not changed

The Essential Eight remains current during the transition. ASD maintains both frameworks on cyber.gov.au, and its guidance to Commonwealth entities is to continue implementing the Essential Eight to at least Maturity Level 2. Existing regulatory obligations stand until the relevant regulators announce changes; nothing in the launch moves a PSPF, DISP or APRA obligation by itself. Every Essential Eight mitigation strategy maps to at least one principle in the enterprise IT chapter, so the substance of your program has a home in the new framework.

What does change

Maturity levels give way to domains, priority phases and per-action effectiveness ratings. Each action is rated on a four-tier scale: not assessed, not effective, partially effective, fully effective. Assessors consider coverage, consistency, currency and evidence quality. An action is rated at the lowest level it reaches: if any not-effective statement is true, it is not effective, and it is fully effective only when every applicable fully-effective statement is true. Everything else is partially effective.

Two consequences are worth sitting with. First, maturity level ratings do not translate automatically into effectiveness ratings. A control that met an Essential Eight requirement may need more work under ASD Essentials. Second, effectiveness is judged per domain. A control that is effective in one domain is not automatically effective in another, so your server patch story and your user-device patch story are now separate conversations. Posture is reported by domain, not as a single maturity level. Each principle takes the rating of its weakest action, and each domain is scored as a percentage of its applicable principles. There is no single enterprise-wide number, so anyone offering you one is ahead of the guidance.

The enterprise IT chapter also contains principles with no direct Essential Eight equivalent, so there will be gaps to close as well as carry-over.

What it means for your evidence

This is the part that should have your attention. ASD rates actions on coverage, consistency, currency and evidence quality, and that criterion is close to the argument we made in The Essential Eight Journey: the value of a control is what you can prove about it. System-generated and tool-derived evidence with provenance is what holds up. Configuration exports and screenshots tied to a system and a date are better than nothing but weaker. Documented process plus samples of it operating sits below that. Attestation and verbal confirmation sit at the bottom, and under an effectiveness rating they will not carry an action to fully effective.

If your current ML2 or ML3 evidence pack is mostly screenshots and signed statements, expect it to rate lower under ASD Essentials than the maturity number suggests. If it is mostly telemetry, export records and dated configuration evidence, the transition is largely re-mapping rather than rebuilding, with new work only where the new principles reach.

The timeline

ASD’s launch notice gives no dates. The indicative timeline comes from an ACSC official’s comments reported by iTnews on 24 June 2026: deprecation of the Essential Eight would begin within approximately 12 months, with retirement to follow at approximately 24 months. Treat those as signals, not commitments, and hold your planning to what ASD has actually published: both frameworks stay on cyber.gov.au during the transition, and your obligations stand until your regulators say otherwise.

What to do this quarter

• Keep your Essential Eight uplift and your current obligations on track. The launch changes the destination, not the road you are on.
• Read ASD’s Transitioning from the Essential Eight guidance, and check each of your eight strategies against the enterprise IT principles it maps to.
• Start scoping your assets into the enterprise IT domains. Per-domain effectiveness is where the new model lives or dies, and most organisations find they have never described their estate that way.

Our full transition guide, From the Essential Eight to ASD Essentials, is now available. It covers the mapping, the ratings, the evidence bar and a three-horizon transition plan.

In this series

1. The Essential Eight Journey
2. Reaching Essential Eight Maturity Level 1
3. Reaching Essential Eight Maturity Level 2
4. Reaching Essential Eight Maturity Level 3
5. The Essential Eight has a successor. Here’s what changes.
6. Selecting an Essential Eight Implementor
7. From the Essential Eight to ASD Essentials: a practical transition guide

Get the complete Essential Eight whitepaper series

Fill in the form below and we will send through the full six-paper set: the Journey, Maturity Levels 1, 2 and 3, Selecting an Implementor, and the Transition Guide.

Sources: ASD’s launch notice and Transitioning from the Essential Eight.