by The Computing Australia Group | 
For almost a decade, the Essential Eight has been the go-to cyber security baseline for Australian organisations. It gave businesses a clear list of eight strategies and a simple way to measure progress.
In October 2026, however, the Australian Signals Directorate (ASD) published ASD Essentials as its successor. This guide explains the Essential Eight in plain English, what has changed, what still applies and how to plan your move to the new framework without wasting the work you’ve already done.
Updated 4 November 2026
What’s changed since this guide was first published
- ASD Essentials has launched. Published on 15 October 2026, it evolves the Essential Eight into a broader, principles-based framework with chapters for enterprise IT, cloud and operational technology.
- Maturity levels are gone. The new framework uses priority phases to order the work and rates how well each action works, instead of a single maturity level.
- Your Essential Eight work still counts. Existing controls and evidence carry forward, although maturity ratings don’t convert automatically.
- Threats keep rising. ASD responded to over 1,500 cyber security incidents in 2025–26, up 20% on the year before.
What is the Essential Eight?
The Essential Eight is a set of eight prioritised mitigation strategies published by ASD’s Australian Cyber Security Centre. Together, they make it much harder for attackers to get into your systems, spread through them and cause lasting damage. The strategies were designed mainly for internet-connected Windows networks, which is one reason ASD has now broadened its approach.
The eight strategies in plain English
- Application control. Only approved software is allowed to run, so malicious programs can’t start.
- Patch applications. Update browsers, Office, PDF readers and other software quickly, especially when flaws are being exploited.
- Configure Microsoft Office macros. Block macros from the internet and allow only trusted ones, closing a common route for malware.
- User application hardening. Turn off risky features in browsers and apps that attackers often abuse.
- Restrict administrative privileges. Limit who has admin access, and use separate accounts for admin tasks.
- Patch operating systems. Keep Windows, macOS and servers updated, and replace systems that no longer get updates.
- Multi-factor authentication. Require a second check, ideally phishing-resistant, when people sign in.
- Regular backups. Back up important data, protect the backups from tampering and test that you can restore them.
How Essential Eight maturity levels worked
Progress was measured using maturity levels from zero to three. Each level required stronger controls to defend against more capable attackers. Many organisations set Maturity Level Two as their target, and some contracts, insurers and government requirements referred to a specific level.
What is ASD Essentials?
It’s ASD’s new framework and the successor to the original eight strategies. Rather than a fixed list of technical controls, it focuses on whether security outcomes are actually being achieved. It’s built from three layers:
Principles
The security outcomes you need, drawn from ASD’s Information Security Manual.
Actions and domains
Practical actions, applied to groups of systems and business functions that share similar risks.
Effectiveness ratings
Evidence-based ratings for how well each action works in each domain.
The framework has separate chapters for enterprise IT, cloud and operational technology. The enterprise IT chapter, the direct successor to the Essential Eight, groups work into eight domains. Instead of choosing a maturity level, you work through the domains in three priority phases. ASD is clear that these phases set the order of work and are not a measure of how secure you are.
In addition, it covers areas the original framework never assessed. Examples include content filtering, cyber security awareness training and supply chain security.
Essential Eight vs ASD Essentials at a glance
Built around
Before: eight technical strategies. Now: principles and actions applied across domains.
How progress is shown
Before: one maturity level. Now: effectiveness ratings for each action in each domain.
Order of work
Before: climb the maturity levels. Now: follow three priority phases.
Scope
Before: mainly Windows networks. Now: enterprise IT, cloud and operational technology.
People and suppliers
Before: largely technical. Now: adds governance, training and supply chain security.
Evidence
Before: whether controls are in place. Now: whether they actually work, backed by evidence.
Does the Essential Eight still apply?
Yes, for now. The Essential Eight remains on ASD’s website during the transition, and any contract, insurer or regulation that names an Essential Eight maturity level still applies until the relevant authority says otherwise. For example, government agencies are expected to be assessed against both frameworks next year.
Importantly, ASD advises organisations to continue their current security uplift while checking alignment with the new framework. At the same time, it says not to start new work solely to reach a superseded Essential Eight target unless something still requires it.
Your existing maturity level won’t convert into a rating under the new framework. However, the controls you’ve built and the evidence you’ve gathered can be reused where they’re still current.
How to move from the Essential Eight to ASD Essentials
You don’t need to start again. Instead, use your existing work as the foundation and follow these steps.
Record a baseline
Document your Essential Eight maturity, current controls, risk assessments and critical business functions.
Check your obligations
List any contracts, insurers or regulators that still name an Essential Eight level.
Map your controls
Match each existing control to the ASD Essentials principles it supports.
Scope phase one
Start with the first priority domains: boundary services, identity services, governance and culture, and visibility and response.
Fill the new gaps
Add areas the Essential Eight didn’t cover, such as awareness training, content filtering and supplier security.
Gather evidence
Show that controls actually work, for example through testing and simulated exercises.
Quick wins that help under both frameworks
Whatever your starting point, these improvements strengthen your security under both frameworks:
- Phishing-resistant multi-factor authentication for email, remote access, cloud services and admin accounts.
- Fast patching for anything facing the internet, such as firewalls, VPNs and websites.
- Backups attackers can’t reach, with regular restore tests.
- Separate, limited admin accounts that are monitored closely.
- Security awareness training with realistic phishing simulations.
- A review of key suppliers and the access they have to your systems.
These controls also matter for cyber insurance, because insurers increasingly ask detailed questions about them. For a practical look at why they matter, read our ransomware attack guide.
How CAG helps with the Essential Eight and ASD Essentials
Our Perth team in Belmont has 21 years of IT experience helping local businesses strengthen their security. We assess where you stand against the Essential Eight, map your existing controls to the new framework, then help you close the gaps.
Assessments
Essential Eight assessments and security audits, with a prioritised plan in plain English.
Transition planning
Mapping your current controls and evidence to the new framework, so your past work keeps counting.
Implementation
Multi-factor authentication, patching, endpoint detection and response, 24/7 monitoring, tested backups, penetration testing and awareness training.
Learn more about our cyber security audits and cyber security services.
Essential Eight and ASD Essentials
Find out where you stand today
We’ll review your current controls against the Essential Eight and show you how they map to the new framework, in plain language.
Essential Eight FAQs
The frameworks
Is the Essential Eight still relevant?
Yes. Its strategies remain a strong foundation, and they all map to principles in the new framework. It also still applies wherever a contract, insurer or regulator requires a specific maturity level.
Is the Essential Eight mandatory for private businesses?
Generally, no. Commonwealth government entities must implement it, but for private businesses it’s voluntary unless a contract, insurer or regulator requires it.
Does our Essential Eight maturity level carry over?
Not automatically. ASD says maturity ratings don’t convert into the new ratings. However, your existing controls and current evidence can be reused.
Planning your transition
What are priority phases?
They are ASD’s recommended order for working through the domains. They describe what to tackle first, not how secure you are.
Should we keep working towards an Essential Eight level?
Continue your current work, but check it against the new framework as well. ASD advises against starting new work only to reach an Essential Eight target unless something still requires it.
Can CAG help with the Essential Eight and ASD Essentials?
Yes. We run Essential Eight assessments, map your controls to ASD Essentials and help implement the improvements. Talk to our team to get started.
Sources and further reading
- Australian Signals Directorate — Transitioning from the Essential Eight
- Australian Signals Directorate — ASD Essentials announcement
- Australian Signals Directorate — ASD Essentials overview: frequently asked questions
- Australian Signals Directorate — Essential Eight
- iTnews — ASD’s Essential Eight replacement moves away from maturity ladder
- business.gov.au — Annual Cyber Threat Report 2025–26
This guide is general information. Check ASD’s current guidance and any obligations that apply to your organisation. Last reviewed 4 November 2026.
About the author
Gordon Murdoch
Director (Policy, Compliance and Training), The Computing Australia Group
Gordon leads CAG’s policy, compliance and training work. He helps organisations turn security requirements into practical policies their teams can actually follow, and drives projects that use AI and other tools to lift efficiency and service quality. His view is simple: compliance should make a business stronger, not just tick a box.
