ASD Essentials, released by the Australian Signals Directorate on 15 October 2026, succeeds the Essential Eight. It replaces the single Maturity Level 0–3 score with outcomes, priority phases and evidence of effectiveness, starting with identity and internet-facing devices. For a Melbourne small business, nothing breaks today: the Essential Eight stays live through a transition expected to take a year or two, and your existing work isn't wasted.
Status as of 22 October 2026: ASD released the framework on 15 October. This post first drew on launch-day reporting of ASD's announcement, chiefly iTnews and Cyber Daily. ASD published its Essentials FAQ and Transitioning from the Essential Eight guidance alongside the framework, and the sections below now follow ASD's own mapping and audience statements.
What is ASD Essentials?
ASD Essentials is a principles-based cyber security framework from the Australian Signals Directorate, released on 15 October 2026 to succeed the Essential Eight. Its first release has three chapters: Essentials for enterprise IT, which evolves the Essential Eight directly, plus chapters for operational technology and cloud. Rather than a fixed checklist, it sets outcomes and lets each organisation choose how to reach them.
The launch also includes guidance for assessing AI-enabled systems. Stephanie Crowe, head of ASD's Australian Cyber Security Centre (ACSC), framed the launch as continuity rather than a clean break: "The Essentials series builds on the success of the Essential Eight."
One detail matters more to a small business than any other. ASD's FAQ says Essentials is "written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations", and that small and medium businesses "can still use this guidance where relevant". A 12-person accounting practice in Melbourne's north isn't the reader ASD had in mind, so the rest of this post translates it. New to the Essential Eight itself? Start with our plain-English Essential Eight guide, and keep the Key IT cyber security glossary handy for the new terms.
Is the Essential Eight still current?
Yes. Both frameworks, with their implementation guidance, stay on cyber.gov.au through the transition, and government agencies will be assessed against both next year. ASD's message to everyone else is to keep doing what you're already obliged to do: organisations "should continue meeting their existing regulatory obligations until relevant regulators communicate any formal changes", as OpenGov Asia reported.
The same goes for paperwork. A tender asking for Maturity Level 1, a client contract naming the Essential Eight or an insurer questionnaire built around its controls doesn't rewrite itself because ASD published something new. Until the issuers change them, our posts on who is now asking for Essential Eight evidence and the controls insurers want before they pay out still apply.
What actually changes: maturity levels vs priority phases
The biggest change is how you're measured. The Essential Eight hands you one number; Essentials builds a picture, area by area, backed by evidence. ASD is explicit that its priority phases are not maturity ratings: a phase describes "implementation scope, not how secure the organisation is". For government agencies, the Canberra Times reports, that means effectiveness ratings in place of self-assessed checklists, plus "explicit executive-level accountability for cyber risks".
| Question | Essential Eight | ASD Essentials |
|---|---|---|
| How are you rated? | One Maturity Level, from Zero to Three | No single score; you report area by area, such as identity services or internet-facing systems |
| What do the steps mean? | The level is your security rating | Priority phases set the order of work, not how secure you are |
| What does ASD prescribe? | Eight named mitigation strategies | Outcomes, with your choice of method; examples stay specific, such as phishing-resistant MFA |
| How do you prove it? | Often a self-assessment | Effectiveness ratings backed by evidence such as independent testing and simulated exercises |
| Where do you start? | Eight strategies, assessed side by side | Identity services and internet-facing edge devices, ahead of business systems and staff laptops |
| Who is accountable? | Not one of the eight strategies | Organisations formally define executive and board-level accountability for cyber security |
Where each Essential Eight control lands (ASD's mapping, with Key IT's view)
ASD's FAQ says "every Essential Eight mitigation strategy maps to at least one principle" in Essentials, and that in most cases controls built under the Essential Eight directly satisfy, or substantially contribute to, a matching Essentials action. It also says Essential Eight maturity level ratings "do not automatically convert" into Essentials effectiveness ratings. ASD names four priority phase one domains: boundary services, identity services, governance and culture, and visibility and response. The table below is Key IT's view of where each control falls in that order; ASD's Transitioning from the Essential Eight guidance has the official strategy-by-strategy mapping. Use our table to plan, not to report.
| Essential Eight control | Likely priority in Essentials | Why we think so |
|---|---|---|
| Multi-factor authentication | Early: identity | Identity comes first, and ASD's examples include phishing-resistant MFA |
| Restrict administrative privileges | Early: identity | Admin accounts are the identities attackers want most |
| Patching firewalls, VPNs and remote access | Early: edge devices | Crowe says ASD has warned about edge device attacks for three or four years |
| Patching staff laptops and business systems | Later | ASD places these after identity and edge devices |
| Application control, Office macros, user application hardening | Later | These mostly protect staff computers |
| Regular backups | Not clear yet | Check ASD's transition guidance for where it maps; keep testing restores regardless |
Does our Essential Eight work carry over?
Mostly, yes, but check it rather than assume it. In June, Chris Horlyck, head of cyber security resilience at the ACSC, told iTnews: "The investment you've made under the Essential Eight will still be relevant under the Essentials." In iTnews's launch coverage, Crowe said there was "no wasted investment" for organisations aligned with the Essential Eight.
ASD's guidance, as iTnews describes it, adds a caution: check your controls against Essentials "rather than assume they are equivalent". Gaps usually hide where a control was switched on once and never tested:
MFA that can still be phished
SMS codes and simple push approvals tick a box, but a framework that names phishing-resistant MFA as its example is unlikely to treat them as finished.
Patching without proof
A dated report showing which devices installed updates, firewall included, is what an evidence-based rating wants.
Backups nobody has restored
When effectiveness is judged by testing, an untested backup is a claim, not a control.
What we know and what we don't yet
Launch coverage blends ASD's publication, interview comments and guesswork. Here they are pulled apart.
| Date | What | Status |
|---|---|---|
| June 2026 | ASD consulted on Essentials for enterprise IT until 12 July 2026 (techpartner.news) | Known |
| June 2026 | Horlyck told iTnews ASD would "probably" start deprecating the Essential Eight in about 12 months and retire it after 24 | Interview comment, not a published date |
| 15 October 2026 | Essentials released with enterprise IT, operational technology and cloud chapters; Essential Eight stays online; FAQ and transition guidance published | Known: ASD |
| 15 October 2026 | Who Essentials is for | Known: ASD says it is written primarily for Commonwealth entities, critical infrastructure and large organisations, and that small and medium businesses can still use it where relevant |
| 2027 | Government agencies assessed against both frameworks | Known: reported by iTnews |
| Not set | When Essentials becomes mandatory | Unknown: ASD says it will advise on expectations for the transition in due course |
| Not set | Whether insurers move their questionnaires to Essentials | Unknown: no insurer change announced that we've seen |
What should a Melbourne small business do this quarter?
Don't wait for a mandate. These five steps pay off under either framework and follow ASD's priority order.
Keep your Essential Eight evidence, and date it
Save your MFA coverage report, patch reports, admin account list and last backup restore test, each dated. When someone asks how your controls map to Essentials, dated evidence holds up.
Put identity first
Move administrators and email onto phishing-resistant sign-in such as passkeys in Microsoft 365, separate admin accounts from everyday ones, and close the accounts of people who've left.
Patch the edge
"So if those devices aren't secure, you're allowing threat actors into the network quite easily," Crowe said, as quoted by iTnews. Our write-up on Akira ransomware getting in through SonicWall VPNs shows how that plays out, and vulnerability scanning, from $149 a month, shows which firewalls and VPNs are behind.
Find every document that names the Essential Eight
Check client contracts, tender responses, insurer questionnaires and supplier forms, and flag any that name a maturity level; those commitments still stand. Our guide to what security questionnaires are really asking helps with the wording.
Name an accountable owner
Choose the director who owns cyber risk, agree how much risk you'll carry, and set a regular report. A virtual CIO can prepare it if nobody in-house has the time.
Where does SMB1001 fit?
SMB1001 comes from a different direction. It's a certification standard published by Dynamic Standards International, a not-for-profit, and designed specifically for small and medium-sized businesses. The edition DSI lists today, SMB1001:2026, came out on 1 September 2025 and has five levels, and DSI updates the standard every year. DSI writes it; CyberCert currently issues the certifications. Where ASD Essentials is written for government and large organisations, SMB1001 gives a small business something to certify against and show clients. We compare all three in SMB1001 vs the Essential Eight.
Frequently asked questions
Is the Essential Eight being retired, and when?
Yes, gradually, but there's no official date. ASD Essentials arrived on 15 October 2026, the transition is expected to take a year or two, and ASD says it will advise on transition expectations in due course. In June an ACSC official said deprecation would probably start in about 12 months, with retirement at 24, but that was an interview comment. Government agencies will be assessed against both frameworks in 2027.
Will insurers stop asking for the Essential Eight?
Not yet, as far as we can see. No insurer has announced a switch to ASD Essentials, and each insurer writes its own questionnaire, so any change will arrive insurer by insurer. Expect Essential Eight questions at your next renewal, keep dated evidence for each control, and watch for new wording about Essentials or priority phases.
Do small businesses have to adopt ASD Essentials?
No. No date has been set for Essentials to become mandatory for anyone, and ASD's FAQ says it is written primarily for Commonwealth entities, critical infrastructure and large organisations, though smaller businesses can still use it where relevant. A small business only needs to follow it if a contract, regulator or insurer requires it. Its starting point, identity and internet-facing devices first, is still sound advice for any business.
Is Maturity Level 2 still worth reaching?
Yes, if a client, tender or insurer asks for it. Federal agencies have had to meet Maturity Level 2 under the Protective Security Policy Framework since July 2022, and the Canberra Times reports that ASD's Commonwealth Cyber Security Posture in 2025 report found 78 per cent of agencies hadn't reached it across all eight strategies. The work carries into Essentials, which still names phishing-resistant MFA as an example.
Which ASD Essentials chapter applies to a small business?
Most likely Essentials for enterprise IT, the direct successor to the Essential Eight. A business with no servers, running entirely on Microsoft 365 and other cloud apps, may find the cloud chapter fits better, because it's written for organisations operating entirely through software-as-a-service and platform-as-a-service environments. That's Key IT's reading; ASD's Which chapter should I start with? guidance helps you decide.
Where do you stand on the Essential Eight? Tick the controls you have in place in a free 60-second self-check.
Take the Self-Check