ASD Essentials replaces the Essential Eight: what it means for your business
ASD Essentials, released 15 Oct 2026, will replace the Essential Eight. What changes for Melbourne small businesses, what doesn't, and five steps to take now.
ASD Essentials, released by the Australian Signals Directorate on 15 October 2026, succeeds the Essential Eight. It replaces the single Maturity Level 0–3 score with outcomes, priority phases and evidence of effectiveness, starting with identity and internet-facing devices. For a Melbourne small business, nothing breaks today: the Essential Eight stays live through a transition of a year or two, and your existing work isn't wasted.
Status as of 15 October 2026: ASD released the framework today. This post draws on launch-day reporting of ASD's announcement, chiefly iTnews and Cyber Daily. ASD says a transition guide is being released alongside the framework; we'll update this post, with a new date, once we've worked through it.
What is ASD Essentials?
ASD Essentials is a principles-based cyber security framework from the Australian Signals Directorate, released on 15 October 2026 to succeed the Essential Eight. Its first release has three chapters: Essentials for enterprise IT, which evolves the Essential Eight directly, plus chapters for operational technology and cloud. Rather than a fixed checklist, it sets outcomes and lets each organisation choose how to reach them.
The launch also includes guidance for assessing AI-enabled systems. Stephanie Crowe, head of ASD's Australian Cyber Security Centre (ACSC), framed the launch as continuity rather than a clean break: "The Essentials series builds on the success of the Essential Eight."
One detail in the launch coverage matters more to a small business than any other: Essentials is aimed at government agencies, critical infrastructure operators and large organisations. A 12-person accounting practice in Melbourne's north isn't the reader ASD had in mind, so the rest of this post translates it. New to the Essential Eight itself? Start with our plain-English Essential Eight guide, and keep the Key IT cyber security glossary handy for the new terms.
Is the Essential Eight still current?
Yes. Both frameworks, with their implementation guidance, stay on cyber.gov.au through the transition, and government agencies will be assessed against both next year. ASD's message to everyone else is to keep doing what you're already obliged to do: organisations "should continue meeting their existing regulatory obligations until relevant regulators communicate any formal changes", as OpenGov Asia reported.
The same goes for paperwork. A tender asking for Maturity Level 1, a client contract naming the Essential Eight or an insurer questionnaire built around its controls doesn't rewrite itself because ASD published something new. Until the issuers change them, our posts on who is now asking for Essential Eight evidence and the controls insurers want before they pay out still apply.
What actually changes: maturity levels vs priority phases
The biggest change is how you're measured. The Essential Eight hands you one number; Essentials builds a picture, area by area, backed by evidence. ASD is explicit that its priority phases are not maturity ratings: a phase describes "implementation scope, not how secure the organisation is". For government agencies, the Canberra Times reports, that means effectiveness ratings in place of self-assessed checklists, plus "explicit executive-level accountability for cyber risks".
| Question | Essential Eight | ASD Essentials |
|---|---|---|
| How are you rated? | One Maturity Level, from Zero to Three | No single score; you report area by area, such as identity services or internet-facing systems |
| What do the steps mean? | The level is your security rating | Priority phases set the order of work, not how secure you are |
| What does ASD prescribe? | Eight named mitigation strategies | Outcomes, with your choice of method; examples stay specific, such as phishing-resistant MFA |
| How do you prove it? | Often a self-assessment | Effectiveness ratings backed by evidence such as independent testing and simulated exercises |
| Where do you start? | Eight strategies, assessed side by side | Identity services and internet-facing edge devices, ahead of business systems and staff laptops |
| Who is accountable? | Not one of the eight strategies | Organisations formally define executive and board-level accountability for cyber security |
Where each Essential Eight control is likely to land (Key IT's reading, pending ASD's transition guide)
This is our working view, based on the priority order ASD has described. Use it to plan, not to report.
| Essential Eight control | Likely priority in Essentials | Why we think so |
|---|---|---|
| Multi-factor authentication | Early: identity | Identity comes first, and ASD's examples include phishing-resistant MFA |
| Restrict administrative privileges | Early: identity | Admin accounts are the identities attackers want most |
| Patching firewalls, VPNs and remote access | Early: edge devices | Crowe says ASD has warned about edge device attacks for three or four years |
| Patching staff laptops and business systems | Later | ASD places these after identity and edge devices |
| Application control, Office macros, user application hardening | Later | These mostly protect staff computers |
| Regular backups | Not clear yet | Launch coverage doesn't say; keep testing restores regardless |
Does our Essential Eight work carry over?
Mostly, yes, but check it rather than assume it. In June, Chris Horlyck, head of cyber security resilience at the ACSC, told iTnews: "The investment you've made under the Essential Eight will still be relevant under the Essentials." In iTnews's launch coverage, Crowe said there was "no wasted investment" for organisations aligned with the Essential Eight.
ASD's guidance, as iTnews describes it, adds a caution: check your controls against Essentials "rather than assume they are equivalent". Gaps usually hide where a control was switched on once and never tested:
MFA that can still be phished.
SMS codes and simple push approvals tick a box, but a framework that names phishing-resistant MFA as its example is unlikely to treat them as finished.
Patching without proof.
A dated report showing which devices installed updates, firewall included, is what an evidence-based rating wants.
Backups nobody has restored.
When effectiveness is judged by testing, an untested backup is a claim, not a control.
What we know and what we don't yet
Launch coverage blends ASD's publication, interview comments and guesswork. Here they are pulled apart.
| Date | What | Status |
|---|---|---|
| June 2026 | ASD consulted on Essentials for enterprise IT until 12 July 2026 (techpartner.news) | Known |
| June 2026 | Horlyck told iTnews ASD would "probably" start deprecating the Essential Eight in about 12 months and retire it after 24 | Interview comment, not a published date |
| 15 October 2026 | Essentials released with enterprise IT, operational technology and cloud chapters; Essential Eight stays online; transition guide and workshops announced | Known: ASD, as reported |
| 2027 | Government agencies assessed against both frameworks | Known: reported by iTnews |
| Not set | When Essentials becomes mandatory | Unknown: ASD is working with policy agencies on a timeframe |
| Not set | Whether insurers move their questionnaires to Essentials | Unknown: no insurer change announced that we've seen |
| Not set | Guidance written for small businesses | Unknown: launch material targets government, critical infrastructure and large organisations |
What should a Melbourne small business do this quarter?
Don't wait for a mandate. These five steps pay off under either framework and follow ASD's priority order.
Keep your Essential Eight evidence, and date it.
Save your MFA coverage report, patch reports, admin account list and last backup restore test, each dated. When someone asks how your controls map to Essentials, dated evidence holds up.
Put identity first.
Move administrators and email onto phishing-resistant sign-in such as passkeys in Microsoft 365, separate admin accounts from everyday ones, and close the accounts of people who've left.
Patch the edge.
"So if those devices aren't secure, you're allowing threat actors into the network quite easily," Crowe said, as quoted by iTnews. Our write-up on Akira ransomware getting in through SonicWall VPNs shows how that plays out, and vulnerability scanning, from $149 a month, shows which firewalls and VPNs are behind.
Find every document that names the Essential Eight.
Check client contracts, tender responses, insurer questionnaires and supplier forms, and flag any that name a maturity level; those commitments still stand. Our guide to what security questionnaires are really asking helps with the wording.
Name an accountable owner.
Choose the director who owns cyber risk, agree how much risk you'll carry, and set a regular report. A virtual CIO can prepare it if nobody in-house has the time.
Where does SMB1001 fit?
SMB1001 comes from a different direction. It's a certification standard published by Dynamic Standards International, a not-for-profit, and designed specifically for small and medium-sized businesses. The edition DSI lists today, SMB1001:2026, came out on 1 September 2025 and has five levels, and DSI updates the standard every year. DSI writes it; CyberCert currently issues the certifications. Where ASD Essentials is written for government and large organisations, SMB1001 gives a small business something to certify against and show clients. We compare all three in SMB1001 vs the Essential Eight.
Frequently asked questions
Is the Essential Eight being retired, and when?
Yes, gradually, but there's no official date. ASD Essentials arrived on 15 October 2026, and the transition is expected to take a year or two. In June an ACSC official said deprecation would probably start in about 12 months, with retirement at 24, but that was an interview comment. Government agencies will be assessed against both frameworks in 2027.
Will insurers stop asking for the Essential Eight?
Not yet, as far as we can see. No insurer has announced a switch to ASD Essentials, and each insurer writes its own questionnaire, so any change will arrive insurer by insurer. Expect Essential Eight questions at your next renewal, keep dated evidence for each control, and watch for new wording about Essentials or priority phases.
Do small businesses have to adopt ASD Essentials?
No. No date has been set for Essentials to become mandatory for anyone, and the launch material is aimed at government agencies, critical infrastructure operators and large organisations. A small business only needs to follow it if a contract, regulator or insurer requires it. Its starting point, identity and internet-facing devices first, is still sound advice for any business.
Is Maturity Level 2 still worth reaching?
Yes, if a client, tender or insurer asks for it. Federal agencies have had to meet Maturity Level 2 under the Protective Security Policy Framework since July 2022, and the Canberra Times reports that ASD's Commonwealth Cyber Security Posture in 2025 report found 78 per cent of agencies hadn't reached it across all eight strategies. The work carries into Essentials, which still names phishing-resistant MFA as an example.
Which ASD Essentials chapter applies to a small business?
Most likely Essentials for enterprise IT, the direct successor to the Essential Eight. A business with no servers, running entirely on Microsoft 365 and other cloud apps, may find the cloud chapter fits better, because it's written for organisations operating entirely through software-as-a-service and platform-as-a-service environments. That's Key IT's reading, pending ASD's transition guide.
More insights
The Essential Eight explained
The Essential Eight explained in plain English: what each of the 8 ACSC controls does, how maturity…
Read article →Essential 8SMB1001 vs Essential Eight
SMB1001 vs Essential Eight vs the new ASD Essentials: who publishes each, which you can certify…
Read article →Microsoft 365Secure Boot certificate expiry
Secure Boot certificate expiry 2026: Windows Production PCA 2011 lapses on 19 October. What it…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.