From the Essential Eight to ASD Essentials: The Transition Guide, Explained

If you are midway through an Essential Eight program, a framework change arriving underneath the project lands badly. Our new transition guide, From the Essential Eight to ASD Essentials, answers the question that change raises: what happens to the work you have already done. The short answer, from the guide’s executive summary: keep going. Your work carries forward, and what changes is how you describe and prove your posture from here.

The guide is free and available now. Request a copy via the form at the foot of this post.

Why a transition guide

On 15 October 2026 the Australian Signals Directorate launched ASD Essentials, and ASD Essentials for enterprise IT is the evolution of the Essential Eight. The Essential Eight was not withdrawn. ASD maintains both frameworks on cyber.gov.au during the transition period, and organisations should continue to meet existing regulatory obligations until the relevant regulators announce changes. So the practical problem for anyone running a program is a translation problem: what carries across, what needs more work, and what your assessor will eventually be reading from.

That is the gap this guide fills. It is the sixth paper in our Essential Eight series and the vendor-agnostic companion to the five that preceded it. Thirteen pages, one mapping table, three figures, and a plan built to keep every current obligation met while you move.

What the guide covers

ASD’s own mapping, transcribed. Section 05 reproduces the mapping from ASD’s Transitioning from the Essential Eight guidance, strategy by strategy, so you can see where each of your eight mitigation strategies lands in the new principles. Every Essential Eight mitigation strategy maps to at least one principle, and the chapter also contains principles with no Essential Eight equivalent. Those are the transition’s new surface area.

The new structure in plain terms. Principles state the outcome, actions are the work, domains are where the work applies. The enterprise IT chapter has six technical domains sequenced across three priority phases, plus two capability domains, Governance and culture and Visibility and response, that apply throughout. By our count of the chapter’s three matrices, it carries 28 principles and 58 actions. The phases sequence the work, they do not rate it, and treating them as maturity levels is the first of the pitfalls ASD names.

How ratings and reporting change. Maturity levels give way to per-action effectiveness ratings on a four-tier scale: not assessed, not effective, partially effective, fully effective. Each principle takes the rating of its weakest action, and each domain is scored across its applicable principles. There is no single enterprise-wide number, and a control that is effective in one domain proves nothing about another.

The evidence bar. This is the section that should have the attention of anyone with a board slide built on a maturity level. ASD rates actions on coverage, consistency, currency and evidence quality. If your current evidence pack is mostly screenshots and signed statements, expect it to rate lower under ASD Essentials than the maturity number suggests. If it is mostly system-generated records with provenance, the transition is largely re-mapping rather than rebuilding, plus live-environment validation for the actions that carry the most risk. The guide’s working conclusion: the evidence plan, not the deployment, is the transition deliverable.

A three-horizon playbook. Next 90 days: hold the line on your current obligations and get oriented, scope your assets into the domains and baseline priority phase 1. Next 12 months: assess by domain, upgrade evidence by domain, and move board reporting to the domain view. Through retirement: shift contracts, tenders and reporting language as the regulators move, not before and not long after. The horizons are built around ASD’s own six-step transition pathway, and the guide lists the seven pitfalls ASD names with a counter-move for each.

On the dates, honestly

ASD’s launch notice gives no deprecation or retirement dates. The indicative timeline in circulation, deprecation beginning around mid-2027 and retirement around mid-2028, comes from an ACSC official’s public comments reported by iTnews on 24 June 2026. That is a signal of intent reported in the trade press, not a published ASD commitment. The guide attributes it that way throughout, for the same reason we do: any plan that depends on a hard date is a plan that will need to move. Plan against the guidance.

Who it is for

Enterprise IT leaders with an Essential Eight program in flight, the teams preparing for assessment or renewal, and anyone about to answer a tender question that references either framework. If you have been running the program described in this series, you are closer than you think, and the gap is mostly in how the evidence is organised rather than whether it exists.

Get the guide

From the Essential Eight to ASD Essentials is free. Use the form at the foot of this post to request it, and we will send it to you, along with the rest of the Essential Eight series.

In this series

1. The Essential Eight Journey
2. Reaching Essential Eight Maturity Level 1
3. Reaching Essential Eight Maturity Level 2
4. Reaching Essential Eight Maturity Level 3
5. The Essential Eight has a successor. Here’s what changes.
6. Selecting an Essential Eight Implementor
7. From the Essential Eight to ASD Essentials: a practical transition guide

Sources: ASD’s launch notice, Transitioning from the Essential Eight, and ASD Essentials for enterprise IT as published on cyber.gov.au. ASD materials are used under CC BY 4.0.

Get the complete Essential Eight whitepaper series

Fill in the form below and we will send through the full six-paper set: the Journey, Maturity Levels 1, 2 and 3, Selecting an Implementor, and From the Essential Eight to ASD Essentials.