If your business has been working towards the Essential Eight, or a client has asked you to, ASD’s new framework raises a fair question: is the work wasted? It is not. This article sets out what the Australian Signals Directorate (ASD) published in October 2026, what changes, what carries over and what we recommend you do now.
The short answer
Yes, over time. On 15 October 2026 ASD published ASD Essentials, the framework that will replace the Essential Eight, with chapters for enterprise IT, cloud and operational technology. ASD will maintain both frameworks during the transition and has not set a retirement date. Contracts, insurers and tenders still ask for Essential Eight maturity levels today, and the controls you already have carry across.
What ASD published
ASD Essentials is a series of chapters, each written for one kind of technology environment. The first release has three:
- Essentials for enterprise IT, for the offices, devices, servers and cloud services most businesses run. ASD describes it as the evolution of the Essential Eight.
- Essentials for cloud, for organisations whose technology is delivered entirely as software or platforms from cloud providers.
- Essentials for operational technology, for the systems that run plant, equipment and industrial sites.
ASD has built the series so more chapters can be added, and artificial intelligence is addressed across the chapters rather than in a chapter of its own. You can read the chapters on cyber.gov.au.
What changes
The Essential Eight lists eight mitigation strategies, each with three maturity levels. ASD Essentials is built around principles, which describe the security outcome to aim for, and actions, which describe what to do. Actions are applied to domains: groups of systems and business functions that carry a similar level of risk. They are grouped into priority phases, so the most important work comes first.
Maturity levels are gone. Each action is rated in each domain as not assessed, not effective, partially effective or fully effective, and assessors look at how widely and consistently it is applied, how current it is and how good the evidence is.
ASD’s transition guidance says Essential Eight maturity ratings do not convert automatically into ASD Essentials ratings. A business at Maturity Level Two today should not assume it starts the new framework fully effective.
The timeline
ASD will keep the Essential Eight available on cyber.gov.au during the transition and has not set a date for retiring it. It says organisations should keep meeting their existing regulatory obligations until the relevant regulators announce changes.
Before the release, in June 2026, ASD’s head of cyber security resilience told iTnews that ASD expected to begin deprecating the Essential Eight in about 12 months and retire it in about 24 months. The published guidance does not set those dates, so treat them as a guide rather than a deadline.
| When | What happened, or is expected |
|---|---|
| November 2023 | ASD publishes the current Essential Eight maturity model |
| 15 June 2026 | ASD announces it will evolve the Essential Eight into a new Essentials series and opens consultation |
| 12 July 2026 | Consultation closes |
| 15 October 2026 | ASD publishes ASD Essentials, with chapters for enterprise IT, cloud and operational technology |
| During the transition | ASD maintains both frameworks and has not set a retirement date for the Essential Eight |
What carries over
ASD says the investment organisations have made in the Essential Eight remains valuable. The fundamentals are the same work:
- Patching applications and operating systems
- Multi factor authentication
- Restricting administrative privileges
- Application control
- Restricting Microsoft Office macros
- Hardening browsers and other applications
- Regular, protected and tested backups
The evidence you collect along the way, such as patch reports, access reviews and restore tests, matters even more under ASD Essentials, because each rating depends on it. ASD’s advice is to assess the controls you have against the new framework rather than assume they are equivalent.
What it means for your business
Nothing changes overnight. If a contract, tender or insurance policy names an Essential Eight maturity level, that is still the standard you are measured against until whoever set the requirement moves to ASD Essentials.
Pick the chapter that fits. Most small and medium businesses with offices, laptops and Microsoft 365 fit the enterprise IT chapter. A business that runs entirely on cloud services may fit the cloud chapter, and a business with plant or industrial control systems may need the operational technology chapter as well.
SMB1001 is a separate, independent certification standard. ASD’s change does not alter an SMB1001 certificate you already hold. See SMB1001 certification.
What to do now
- Keep meeting the obligations you have. Work towards the maturity level your contracts or insurer name, usually Maturity Level One or Two.
- Check your contracts, tender responses and insurance policy for Essential Eight wording, and note when each is due for renewal.
- Record where you stand today, with a date: your current assessment, controls, known gaps and remediation plan.
- Keep your evidence. Settings, reports and test records are what an assessor looks at under either framework.
- Work out which ASD Essentials chapter applies to you, and check planned Essential Eight work against it before you spend.
To see where you stand today, download our free Essential Eight checklist. It turns every Maturity Level One requirement into a plain English question. If you would rather have someone do the work, see Essential Eight assessment and uplift, or call us on 1300 787 429.
Essential Eight questions
Is the Essential Eight still valid?
Yes. ASD will maintain the Essential Eight alongside ASD Essentials during the transition, and contracts, insurers and tenders still ask for Essential Eight maturity levels. Keep meeting those requirements until whoever set them says otherwise.
When will the Essential Eight be retired?
ASD has not set a retirement date. In June 2026 ASD’s head of cyber security resilience suggested retirement in about two years, which would be around mid 2028, but the published guidance gives no date.
Should we stop working on the Essential Eight?
No. ASD says existing Essential Eight investment remains valuable, and the same controls are the starting point for the enterprise IT chapter. Stopping would leave you exposed and short of what your contracts may already require.
What is ASD Essentials?
It is ASD’s new cyber security framework, published on 15 October 2026, with chapters for enterprise IT, cloud and operational technology. Each chapter sets out principles and actions, and each action is rated for how effective it is rather than against a maturity level.
Will our Essential Eight assessment still count?
Yes, for now. An Essential Eight assessment is still the reference most contracts and insurers use. Maturity ratings do not convert automatically into ASD Essentials ratings, so expect a fresh assessment when the people who asked for yours move to the new framework.
Sources
- ASD, ASD Essentials: evolving our approach to cyber security resilience, 15 October 2026.
- ASD, What is the Essentials?, October 2026.
- ASD, Transitioning from the Essential Eight, October 2026.
- ASD, Essentials for enterprise IT, October 2026.
- ASD, Consultation on evolution of Essential Eight, first published 15 June 2026.
- iTnews, ASD to retire Essential Eight cyber security framework within next two years, 24 June 2026.
- ASD, Essential Eight maturity model, November 2023.
