Essential Eight replacement tracker: the move to ASD Essentials
The ASD published ASD Essentials on 15 October 2026, the framework that replaces the Essential Eight. This page tracks the transition: what has been published, what is still open, and what Australian businesses should do at each stage. We update it as the ASD moves.
Last updated: 15 October 2026. Corrected 22 October 2026. Current status: ASD Essentials is published, with chapters for enterprise IT, cloud and operational technology, and supporting guides on transitioning from the Essential Eight, implementation planning, assessment and cloud asset scoping. The Essential Eight stays on cyber.gov.au during the transition. No mandatory changeover date has been set, and the ASD says to keep meeting existing regulatory obligations until regulators announce changes.
15 Oct 2026
ASD Essentials published, after consultation closed on 12 July
3 Chapters
Enterprise IT, cloud and operational technology, with room for more
8 Domains
Six technical domains and two capability domains in the enterprise IT chapter
58 Actions
Across 28 principles in Essentials for enterprise IT, each traced to an ISM principle
What is replacing the Essential Eight?
The short answer: ASD Essentials, and specifically its enterprise IT chapter.
ASD Essentials is a series of environment-specific chapters. The first release covers enterprise IT, cloud and operational technology. The ASD describes Essentials for enterprise IT as the evolution of the Essential Eight, so that is the chapter most of our clients will transition to. Organisations that run entirely on software-as-a-service or platform-as-a-service are pointed to the cloud chapter instead, and many will need both over time.
Every chapter uses the same three layers. Principles describe the security outcome, drawn from the cyber security principles in the Information Security Manual. Actions describe what has to be done to achieve it, written in technology-agnostic terms. Domains describe where the actions apply: groups of business functions and assets that share a similar risk. Instead of eight strategies applied across the whole environment, the enterprise IT chapter has 58 actions mapped to the domains where they matter.
The ACSC has been consistent that Essential Eight work is not wasted, and the published guidance backs that up: every Essential Eight strategy maps to at least one Essentials principle. What changes is the scope controls need to cover, the broader outcomes some controls now contribute to, and the evidence needed to show a control works. Our analysis of the original retirement announcement covers why the ASD made the change.
How Essentials for enterprise IT is organised
Eight domains, grouped into three priority phases. The two capability domains run across every phase.
| Domain | What it covers | Priority phase |
|---|---|---|
| Governance and culture | Executive accountability, resourcing, risk management, supplier assurance, AI accountability, legacy systems and awareness training | All phases |
| Visibility and response | Asset discovery, logging, detection, incident response and post-incident review | All phases |
| Boundary services | Internet-facing services and edge devices that broker connectivity between environments | Phase 1 |
| Identity services | Directories, authentication and authorisation services, and credential stores | Phase 1 |
| Critical processes and services | The processes and services that deliver your primary organisational outcomes | Phase 2 |
| Privileged environments | Systems that support administration, management services and high-impact control | Phase 2 |
| Business systems | Supporting systems that keep day-to-day operations running | Phase 3 |
| User devices | Desktops, laptops and other endpoints issued to staff | Phase 3 |
Priority phases are a sequence, not a rating. The ASD is explicit that reaching a phase says nothing about how secure an organisation is. Phase 1 targets boundary and identity services because they are the most common routes to initial access, which matches what we see in incident response work. Organisations can change the order for documented, risk-based reasons, but later domains still have to be done. The cloud chapter uses the same order; the OT chapter does not (see Chapter watch below).
How assessment works now
Maturity levels are gone. Each action is rated in each domain where it applies.
Four-tier action ratings
Every action is rated not assessed, not effective, partially effective or fully effective for the assets in that domain. Assessors judge coverage, consistency, currency and evidence quality. Partial activity, such as a plan or a half-finished rollout, does not count as partially effective.
Weakest link, by domain
A principle takes the rating of its weakest action in that domain. Results are reported by priority phase and domain, with a percentage for each domain: fully effective principles score 1, partially effective 0.5 and not effective 0. The same control can rate differently in two domains.
Evidence of effect, not deployment
A screenshot of a policy shows deployment. The new model wants proof the outcome holds: drift reports, restore tests, validation testing, monitoring records. Existing Essential Eight evidence can be reused where it is current and reliable.
Not assessed is neutral
A domain you have not reached yet is reported as not assessed, which ASD requires to stay distinct from not effective. That lets an organisation working through phase 1 report honestly without looking like it has failed phases 2 and 3.
Where each Essential Eight strategy lands
From the ASD’s transition guide. Our control-by-control mapping covers what carries forward and what needs new work for each one.
| Essential Eight strategy | ASD Essentials principles |
|---|---|
| Application control | Trustworthy software; Secure configuration management |
| Patch applications | Vulnerability management; Asset identification; Legacy system management |
| Patch operating systems | Vulnerability management; Asset identification; Legacy system management |
| Multi-factor authentication | Identity, credential and access management |
| Restrict administrative privileges | Identity, credential and access management; Least privilege access; Secure administration; Network segmentation and segregation |
| Restrict Microsoft Office macros | Trustworthy software; Secure configuration management |
| User application hardening | Secure configuration management; Content filtering |
| Regular backups | Regular and proven backups; Least privilege access |
The Further Five controls (backup validation, security event monitoring, vulnerability scanning, incident response planning and network segmentation) are also core actions in ASD Essentials, so work done on them carries across.
Confirmed vs not yet confirmed
Where things sit as of 15 October 2026.
Confirmed by the ASD
ASD Essentials is published, with enterprise IT, cloud and operational technology chapters and supporting guides for transition, implementation planning, assessment and cloud asset scoping.
Maturity levels are replaced by priority phases for sequencing and four-tier effectiveness ratings for assessment. Essential Eight maturity ratings do not convert automatically into Essentials ratings.
Every Essential Eight strategy maps to at least one principle, and existing controls and evidence can be reused where they are current.
The Essential Eight stays available during the transition, and organisations should keep meeting existing obligations until regulators announce changes.
Not yet confirmed
When Essentials becomes mandatory for government. ACSC head Stephanie Crowe told iTnews the regulatory timeframe is being worked out with policy agencies over the next year or two, and that agencies will be assessed against both frameworks next year.
Formal deprecation and retirement dates for the Essential Eight. The mid-2027 and mid-2028 dates quoted since June came from a public interview, and the published guidance does not repeat them.
How the PSPF, DISP, cyber insurers and government contracts will re-reference their Essential Eight requirements. Until they do, existing obligations stand as written.
Guidance on using Essentials to assess suppliers, which the ASD says will come later.
The transition timeline
- 15 June 2026: consultation opens. The ASD announces the evolution of the Essential Eight and opens consultation on Essentials for enterprise IT through its Partnership Program portal.
- 24 June 2026: timeline given publicly. The ACSC’s head of cyber security resilience sets out a staged timeline in a public interview: deprecation from roughly 12 months, retirement at roughly 24 months. These dates came from an interview and are not in ASD’s published guidance.
- 12 July 2026: consultation closes. Feedback from government, industry, regulators and Essential Eight users goes into the final guidance.
- 15 October 2026: ASD Essentials published. Three chapters plus the transition, implementation planning, assessment and cloud asset scoping guides. Both frameworks are now live side by side.
- 2027: dual assessment for government. Government agencies are assessed against both frameworks, according to the ACSC’s head in an iTnews interview; this is not yet in published guidance. This is the window for everyone else to run a gap analysis and move evidence across.
- To be confirmed: mandatory changeover. Regulators and policy agencies set when Essentials replaces Essential Eight references in their requirements. Contracts, questionnaires and policies that name the Essential Eight will need updating before then.
Chapter watch
The series is built so more chapters can be added. Here is where each stands.
Essentials for enterprise IT
Published 15 October 2026. The direct successor to the Essential Eight: 28 principles and 58 actions across eight domains, with MITRE ATT&CK techniques mapped to the technical actions. The ASD wrote it for organisations whose scale and complexity need a structured approach, and says smaller businesses can still use it where relevant, with more of the work sitting with their service providers. Our control-by-control mapping covers it.
Essentials for cloud
Published 15 October 2026, with an Asset scoping guide for cloud. Written for organisations whose technology is delivered entirely through SaaS and PaaS. Every action carries a marker showing whether the customer, the provider, or the customer configuring a provider-supplied capability is responsible, and adopting high-risk SaaS or PaaS services needs executive approval. Priority phases follow the enterprise IT order. Read our ASD Essentials for cloud analysis.
Essentials for operational technology
Published 15 October 2026. Built around “vital OT” and the ability to isolate it and keep operating safely. The priority order changes: boundary services and critical processes first, then privileged environments and identity, then business systems. No actions are mapped to user devices, because every device in OT is treated as privileged. Remote access must terminate in an OT DMZ, with no permanent connections. Read our ASD Essentials for OT analysis.
Artificial intelligence
There is no AI chapter. AI is handled inside the existing chapters: each has an executive AI accountability principle in its Governance and culture domain, and the ASD has published separate AI considerations for the series. The September 2026 ISM controls for AI agents still apply through the ISM. Our AI agent security risks post maps them against a real incident, and our AI governance service covers the accountability side.
What your business should do now
- Keep meeting the obligations you have. The PSPF, DISP, government contracts and cyber insurers still reference the Essential Eight. The ASD says to keep meeting those requirements until the relevant authority changes them.
- Pick your chapter. On-premises, hybrid or infrastructure-as-a-service points to enterprise IT; SaaS and PaaS only points to cloud; site control systems point to OT. Many organisations need more than one.
- Map planned Essential Eight work before you spend on it. The ASD’s transition guide advises against starting work solely to reach a superseded Essential Eight target, unless an obligation still requires it or it still addresses material risk. Work already in flight usually does both. Run new projects through a gap analysis first.
- Record your transition baseline. Latest assessment results, current controls, exception and risk registers, remediation plans and committed uplift work. A dated, evidenced baseline is the input to everything that follows. Our Essential 8 compliance guide covers the current framework.
- Scope priority phase 1 and run the gap analysis. Identify the assets in your chapter’s phase 1 domains, start Governance and culture and Visibility and response alongside them, and classify each applicable action as addressed, partially addressed or not addressed.
Update log
22 October 2026. Corrections. The 12 and 24 month deprecation and retirement timeline and the 2027 dual assessment are now marked as interview statements, not published guidance. SMB1001 is published by Dynamic Standards International, not CyberCert. We removed a statement that the cloud chapter requires executive approval before AI features are switched on, which we could not confirm against the published chapter.
15 October 2026 (afternoon). Published our analysis of the cloud chapter and the OT chapter, including the cloud chapter’s customer, supplied and provider responsibility markers, and the OT chapter’s different priority order and isolation requirements. Added the Asset scoping guide for cloud to the list of published guidance.
15 October 2026. The ASD published ASD Essentials: chapters for enterprise IT, cloud and operational technology, plus What is the Essentials?, Which chapter should I start with?, Transitioning from the Essential Eight, the Implementation planning guide and the Assessment process guide. We rewrote this tracker against the published documents and released our control-by-control mapping the same day, as promised. The biggest change to our earlier advice: we had told businesses mid-way through an Essential Eight uplift to finish it. The ASD now says to map planned work to Essentials before deciding whether to continue it, while still meeting any obligation that names the Essential Eight. We have updated this page, our retirement analysis and our maturity level guides to match. We also corrected our earlier expectation of a dedicated agentic AI chapter: AI is handled through an accountability principle and separate AI considerations instead.
14 September 2026. On 11 September the ASD published Agentic AI harnesses: the layer above the model, positioning the harness as the part of an agentic system an organisation can most directly govern. Its companion, the six-agency Careful adoption of agentic AI services, names accountability as one of five principal risk categories. Neither changed the Essential Eight.
10 September 2026. The September 2026 Information Security Manual added a control block (ISM-2124 to ISM-2167) that treats AI agents as principals in their own right. We also counted every control in the release: the Essential Eight draws on 126 of the ISM’s 1,143 controls.
15 August 2026. Tracker published. Added analysis connecting the ACSC’s updated AI cyber defence guidance to the direction of the new series.
12 July 2026. Consultation on Essentials for enterprise IT closed via the ASD Cyber Security Partnership Program portal.
24 June 2026. ACSC set out the staged retirement timeline publicly. Our analysis of the announcement.
18 June 2026. We published guidance on what the retirement means for DISP members.
15 June 2026. ASD opened consultation on the evolution of the Essential Eight into the Essentials series.
Sources: ASD Essentials publications on cyber.gov.au, including Transitioning from the Essential Eight and the Assessment process guide. © Commonwealth of Australia 2026, used under CC BY 4.0.
Want a plan for the transition?
We can help you work out which chapter applies, where your Essential Eight controls and evidence land, and what needs new work.
Frequently asked questions
What is replacing the Essential Eight?
ASD Essentials, published on 15 October 2026. Its enterprise IT chapter is the direct replacement for the Essential Eight, with 58 actions across 28 principles and eight domains. Chapters for cloud and operational technology were released at the same time. Both the Essential Eight and ASD Essentials stay on cyber.gov.au during the transition.
Should we stop working towards Essential Eight compliance?
Keep meeting any obligation that requires it, such as the PSPF, DISP, a contract or an insurer. For new Essential Eight work, the ASD advises mapping it to ASD Essentials first and only proceeding if an obligation requires it or it still addresses material risk. Our Essential Eight team can help you work out which side of that line your plans fall on.
What happens to my Maturity Level 2 rating?
It does not convert into an Essentials rating. ASD Essentials rates each action in each domain instead of giving one maturity level. An ML2 rating is still a strong starting point: the ASD expects many ML2 controls, such as phishing-resistant MFA, privileged access controls, application control and central logging, to contribute to the early priority phases.
Which ASD Essentials chapter should my business use?
It depends on what you operate. On-premises, hybrid or infrastructure-as-a-service environments start with enterprise IT. Organisations running entirely on SaaS and PaaS start with the cloud chapter. Operators of control systems use the OT chapter for those environments. Many organisations need more than one.
When does ASD Essentials become mandatory?
No date has been set. The ACSC says the regulatory timeframe is being worked out with policy agencies over the next year or two, and the ACSC’s head has said government agencies will be assessed against both frameworks in the meantime. Until a regulator or contract changes its requirement, the Essential Eight requirement stands.
Does ASD Essentials apply to small businesses, and is SMB1001 affected?
The chapters are written for organisations operating at enterprise or critical infrastructure scale. The ASD says smaller businesses can still use them where relevant, but more of the work will sit with their IT providers, and it publishes separate small business guidance. SMB1001 is published by Dynamic Standards International, not the ASD, and is unaffected. SMB1001 certification remains a practical option for smaller businesses.
