Latest advisory
ASD Essentials Explained: What Changes After the Essential Eight
ASD Essentials is the Australian Signals Directorate’s successor to the Essential Eight. It replaces eight mitigation strategies and their maturity levels with principles, actions and eight domains, worked through in priority phases and rated by how effective each action is. Existing Essential Eight work carries forward, but it gets assessed again, domain by domain, and executive accountability for cyber security becomes part of the assessment.
In June we wrote about ASD’s plans to retire the Essential Eight, when the first chapter was still out for consultation. ASD has now released the series: overview guidance for executives, chapters for enterprise IT, cloud and operational technology, and supporting guides for transition, implementation planning and assessment.
This article explains what the series is, how it is structured, what is new compared with the Essential Eight and where to start. It is written for CEOs, CFOs, boards and IT leaders in mid-sized Australian organisations who have been using the Essential Eight as their yardstick and now need to know what replaces it.
Key takeaways
- ASD describes the Essentials series as “an evolution of the Essential Eight”. It builds on the work organisations have already done rather than starting again.
- Maturity levels are gone. Priority phases set the order of work, and ASD is explicit that they are not maturity or assurance ratings.
- Every action is rated not assessed, not effective, partially effective or fully effective, separately in each domain where it applies.
- A Governance and culture domain makes executive and board accountability, resourcing and supplier assurance part of the assessment. None of that was assessed under the Essential Eight maturity model.
- Evidence has to show that a control works over time. ASD’s assessment guide puts it in four words: “Deployment is not effectiveness.”
- The documents set no transition deadline, and existing regulatory obligations that refer to the Essential Eight still apply.
Summary table: the Essential Eight and ASD Essentials side by side
| Essential Eight | ASD Essentials (enterprise IT) | |
|---|---|---|
| Building blocks | Eight mitigation strategies | Principles supported by actions |
| Where controls apply | Across the whole environment | Eight domains of assets and functions that share similar risks |
| Progress measure | Maturity levels One to Three | Priority phases that sequence the work |
| How ratings work | Met or not met against maturity requirements | Four-tier effectiveness rating per action, per domain |
| Approach | Prescriptive and solution specific | Outcome-driven and technology agnostic |
| Governance | Not assessed | Assessed through the Governance and culture domain |
| Evidence | Implementation against requirements | Coverage, consistency, currency and evidence quality |
What is the ASD Essentials series?
The series is a set of publications from ASD’s Australian Cyber Security Centre, arranged in three layers.
The overview publications explain the framework and the case for change. They include a guide written specifically for senior executives and a short paper on how artificial intelligence fits across the series.
The chapters apply the framework to a particular technology environment. There are three so far:
- Enterprise IT, for organisations “whose scale, complexity, regulatory exposure or reliance on technology requires a structured and deliberate approach” to cyber security. This is the direct successor to the Essential Eight for most organisations.
- Cloud, for organisations whose technology environment “is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS)”. Each action is marked as a customer, supplied or provider responsibility, because the provider does part of the work.
- Operational technology, for organisations running industrial and control systems. It uses a different phase order and treats every device inside the OT system as privileged.
ASD’s reading guide notes that “further chapters may be added as the series covers additional environments”.
Supplemental publications support the work: a guide to transitioning from the Essential Eight, an implementation planning guide, an assessment process guide, asset scoping guides and an assessment evidence guide for enterprise IT. ASD also provides an assessment workbook for enterprise IT.
How do principles, actions and domains work?
Every chapter uses the same three-part model, and ASD frames each part as a question. A principle asks what outcome the organisation is trying to achieve. An action sets out what needs to be done to achieve it. A domain says where it applies.
The Essential Eight told organisations which controls to implement. The Essentials series describes outcomes. In ASD’s words, actions “describe what must be achieved without prescribing a particular vendor, product or architecture”. Organisations can choose controls that suit their environment, as long as the evidence shows the outcome is being achieved.
That flexibility cuts both ways. An organisation can no longer point to a product and say the requirement is met. It has to show that the action works across every asset in scope.
What are the eight domains?
Domains group business functions and assets that share similar risks. Two are capability domains that run across everything; six are technical domains.
| Domain | What it covers | Why it matters |
|---|---|---|
| Governance and culture | Policies, risk management, roles and security culture | Unclear ownership leads to inconsistent decisions and controls that degrade over time |
| Visibility and response | Detecting, analysing and responding to cyber security events | Limited visibility delays detection and containment of intrusions |
| Boundary services | Internet-facing services and edge devices | These are routinely scanned and exploited for initial access |
| Identity services | Directories, authentication, authorisation and credential stores | Compromise can give an adversary persistent or privileged access |
| Critical processes and services | The core services the organisation exists to deliver | Loss can stop critical services and may affect health and safety |
| Privileged environments | Administrative and management systems | Compromise gives extensive control over systems and security controls |
| Business systems | Supporting enterprise functions | Compromise disrupts operations and opens paths to more sensitive systems |
| User devices | Desktops and laptops issued to staff | Common entry points because of their number and exposure |
Assets that support more than one domain are considered in each of them. A directory server, for example, may sit in Identity services and in Privileged environments.
What are priority phases, and why are they not maturity levels?
Priority phases set the order in which ASD recommends the domains are addressed, based on where effort reduces risk fastest. For enterprise IT:
- Phase 1 covers Boundary services and Identity services, and establishes Governance and culture and Visibility and response.
- Phase 2 moves to Critical processes and services, and Privileged environments.
- Phase 3 completes the set with Business systems and User devices.
The two capability domains continue across all three phases and grow as more technical domains come into scope.
This is the change most likely to be misread in boardrooms. Under the Essential Eight, “we are at Maturity Level Two” was a statement about how well protected the organisation was. A priority phase says nothing of the kind. ASD’s guidance for senior executives is direct: a statement such as “we have reached priority phase 2” describes implementation scope, “not how secure the organisation is”. Security posture is expressed through the effectiveness ratings.
Organisations also no longer pick a target level and stop there. ASD’s implementation planning guide describes the phases as “interim stages of progression, not levels at which an organisation should remain indefinitely”, and says ASD does “not recommend skipping domains or deferring priority phases indefinitely”.
How is security posture rated?
Each action is assessed against the assets in each domain where it applies, and given one of four ratings:
| Rating | What it means |
|---|---|
| Not assessed | Not yet assessed, or not enough evidence to decide. ASD calls this “a neutral rating”, and it must stay distinct from not effective |
| Not effective | The action is absent, or present in a form that delivers no meaningful security benefit |
| Partially effective | The action works in part, but gaps in coverage, consistency or enforcement limit it |
| Fully effective | The action demonstrably achieves its outcome across the domain and is backed by sufficient evidence |
The partially effective rating is not a reward for effort. ASD says “partial activity alone, such as work commencing or a plan existing, is not partial effectiveness”.
Action ratings roll up to principles using a weakest link rule: a principle takes the lowest rating of its actions in that domain. Each domain then gets a percentage, with fully effective principles scored 1, partially effective 0.5 and not effective 0. ASD’s worked example has five principles fully effective, four partially effective and one not effective in a domain, which gives 70%.
Reports must include a summary view showing progress across domains and a detailed view showing the principles and actions behind each rating. ASD warns that “the summary view alone may obscure outstanding risk”.
What is new compared with the Essential Eight?
Every Essential Eight mitigation strategy maps to at least one principle in the new framework, so nothing already built is wasted. But the enterprise IT chapter also covers ground the Essential Eight never assessed.
Governance and culture
ASD lists principles covering executive cyber security accountability, cyber security resourcing, security risk management assurance, supplier cyber security assurance, artificial intelligence accountability and legacy system management. Many organisations already handle some of this through their risk or audit processes. Until now, none of it formed part of an Essential Eight assessment.
New protect principles
Content filtering, cyber security awareness training and cyber supply chain security have no direct Essential Eight equivalent.
Broader identity requirements
Multi-factor authentication becomes one part of a wider identity, credential and access management principle. It now sits alongside removing default and unused accounts, storing secrets in approved repositories, scanning for exposed credentials, retiring legacy authentication protocols and keeping credentials unique per system.
Asset identification
Organisations need to “continuously identify and document infrastructure, operating systems, applications, identities, credentials and data as distinct assets”. Most existing inventories cover a subset of that list.
Visibility and response as its own domain
Logging, detection and incident response were scattered across individual Essential Eight strategies. They now form a domain with dedicated principles, including detection efficacy and post-incident insights.
Evidence of effectiveness
Configuration records and policies still count, but they show a control was deployed. Assessors now look for proof that it keeps working, such as validation results, monitoring records, restoration tests and exercises.
Where does artificial intelligence fit?
AI is not a separate chapter. ASD says the framework “applies regardless of whether an organisation consumes, develops or deploys artificial intelligence (AI)”, and a supporting paper explains how AI considerations run through each chapter.
Three points stand out for executives. First, ASD’s view is that AI “has made existing attacks faster, cheaper and available to more people”, including synthetic voice and video aimed at staff who approve payments or reset access. Second, AI tools can hold identities and permissions of their own, and ASD says to “identify and govern these in the same way as other identities and access pathways”. Third, the board or executive committee is accountable for ensuring “AI is secure, controllable, human-supervised and used in an ethical and accountable manner”.
Is ASD Essentials mandatory, and is there a deadline?
The published documents set no transition deadline. ASD’s implementation planning guide says “the framework does not prescribe implementation timeframes”.
Existing obligations stay in place. Maturity Level Two of the Essential Eight was the required baseline for Commonwealth entities and many critical infrastructure operators. ASD’s transition guide says organisations whose reporting still requires Essential Eight terminology should “continue to meet those obligations as directed by the relevant authority”.
For most private organisations the series is guidance rather than a mandate. Where a customer contract, insurer questionnaire or tender asks for Essential Eight evidence today, check what that party will accept during the transition rather than assume either framework is enough.
Where should an organisation start?
Organisations that have never implemented the Essential Eight can go straight to the enterprise IT chapter. Those with an Essential Eight programme should follow ASD’s transition guidance, which we cover step by step in a companion article. In short:
- Record the current Essential Eight position: latest assessment results, controls, exception and risk registers, and planned uplift work.
- Scope the priority phase 1 domains and identify the assets in each.
- Run a gap analysis that classifies each action as already effectively addressed, partially addressed or not addressed.
- Plan the implementation around the gaps.
- Deliver and measure, collecting evidence as controls are built rather than afterwards.
- Move through the remaining priority phases, with a set reassessment cadence.
ASD’s guidance for senior executives makes the point that matters most at the start: “The introduction of the Essential series does not mean organisations are expected to start again.”
Read the rest of the series
This article is the overview. Three companion pieces go deeper:
- Moving from the Essential Eight to ASD Essentials: why a maturity level doesn’t carry over, and how to reuse the evidence you already hold.
- Budgeting for ASD Essentials: what to fund, what to pause and what carries forward.
- ASD Essentials for boards: the ten questions ASD says senior executives should ask before they approve the plan.
How Beyond Technology can help
Beyond Technology is an independent technology advisory firm. We don’t sell technology, software, hosting or support, and we take no referral fees, so our gap analysis is not a prelude to a quote for the tools that close the gaps.
Building on our Essential Eight audit, we can map your existing controls and evidence to the ASD Essentials principles, domain by domain, and give you a current-state baseline and a phased plan you can take to the board. If you need a wider view of your security position first, start with our cyber security audit.
FAQs
What is ASD Essentials?
ASD Essentials is a cyber security framework from the Australian Signals Directorate that succeeds the Essential Eight. It organises security outcomes into principles and actions, applies them across eight domains of assets that share similar risks, and rates each action as not assessed, not effective, partially effective or fully effective.
Does ASD Essentials replace the Essential Eight?
ASD describes the series as an evolution of the Essential Eight that builds on it rather than discarding it. Every Essential Eight mitigation strategy maps to at least one principle in the new framework, so existing controls and evidence can be reused where they remain current and relevant.
Does our Maturity Level Two rating carry over?
Not automatically. ASD says previous Essential Eight maturity level ratings “do not automatically translate” into effectiveness ratings, because the two approaches assess different things. A Maturity Level Two result is a useful starting point for a gap analysis, and many of its controls will contribute to the early priority phases.
What are the eight domains in ASD Essentials for enterprise IT?
Governance and culture, Visibility and response, Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems and User devices. The first two are capability domains that apply across all priority phases.
Do we need an independent assessor or independent advice?
ASD does not require one, and leaves each organisation to judge what is proportionate and affordable. Its implementation planning guide notes that independent assessors “bring a fresh perspective and judgement, helping to identify gaps and weaknesses that may have become accepted through familiarity”. Independent advice however can be critical to help planning an effective implementation strategy that focuses on your best interests rather than a vendors sales goals.
References
- Australian Signals Directorate, ASD Essentials overview: The Essentials for senior executives (2026)
- Australian Signals Directorate, ASD Essentials series reading guide (2026)
- Australian Signals Directorate, ASD Essentials for enterprise IT (2026)
- Australian Signals Directorate, ASD Essentials for cloud (2026)
- Australian Signals Directorate, ASD Essentials for OT (2026)
- Australian Signals Directorate, AI considerations within the Essentials (2026)
- Australian Signals Directorate, Transitioning from the Essential Eight (2026)
- Australian Signals Directorate, Implementation planning guide (2026)
- Australian Signals Directorate, Assessment process guide (2026)
- Australian Cyber Security Centre, Essential Eight
