ASD Essentials replaces the Essential Eight's single maturity score

ASD Essentials replaces the Essential Eight's single maturity score

15 October 2026: The Australian Signals Directorate has launched ASD Essentials, which it calls an evolution of the Essential Eight, the mitigation framework that Australian agencies and many large companies have been measured against for nearly a decade. Instead of one maturity rating from zero to three, organisations report their security area by area, with an overall posture shown through effectiveness ratings backed by evidence such as independent testing and simulated exercises.

Not yet independently verified. The area-by-area reporting, the priority phases and the quotes from Stephanie Crowe come from iTnews; ASD's announcement confirms the launch, the three chapters and the transition arrangement, but the framework documents and transition guide were not read in full. We will update this when it can be confirmed, and remove this note.

How the new reporting works

ASD Essentials has come out of consultation with government, industry and regulators and now moves into implementation. Australian Cyber Security Centre head Stephanie Crowe told iTnews that the response to consultation was overwhelmingly positive. The framework sets priority phases for implementation, but ASD says they are not maturity ratings: reaching a phase "describes implementation scope, not how secure the organisation is".

The framework also stops prescribing specific controls. It sets out security outcomes and leaves organisations to choose how to meet them, although ASD's examples stay specific, such as phishing-resistant multi-factor authentication. Executive and board-level accountability for cyber security must be formally defined.

Where to start

ASD tells organisations to begin with identity services and the edge devices that connect networks to the internet, ahead of business systems and staff laptops. Crowe said that if those devices are not secure, threat actors can enter the network easily, and that frontier AI is speeding up how quickly adversaries find and exploit them. The first version covers three environments, each in its own chapter: Essentials for enterprise IT, which ASD describes as the evolution of the Essential Eight; Essentials for operational technology, aimed at critical infrastructure operators; and Essentials for cloud, for organisations whose technology is delivered entirely as software or platform services. ASD says separate AI-focused guidance is available for organisations weighing AI-enabled systems within those environments.

Timing and the Essential Eight

When Essentials becomes mandatory is not settled. ASD's own announcement says that until regulators communicate the associated regulatory changes, organisations should keep meeting their current obligations. Crowe said ASD is working with policy agencies on a transition timeframe from a regulatory perspective over the next year or two. Until then the Essential Eight stays on ASD's website alongside the new framework, and government agencies will be assessed against both next year.

Crowe said there is "no wasted investment" for organisations that stay aligned with the Essential Eight, because existing control maturity counts towards the new framework. ASD's own guidance adds that controls should be checked against Essentials "rather than assume they are equivalent". A transition guide is being released with the framework, and ASD plans workshops for organisations working through the change.

Sources

• Australian Signals Directorate: ASD Essentials, evolving our approach to cyber security resilience, 15 October 2026
• iTnews: ASD's Essential Eight replacement moves away from maturity ladder, 14 October 2026