Essential Eight Changes 2026: What ASD Essentials Means for Australian Businesses

The big Essential Eight change is that ASD has replaced it with ASD Essentials. The Essentials series launched on 15 October 2026. Its enterprise IT chapter is the official evolution of the Essential Eight, and it swaps Maturity Levels One to Three for principles, actions, eight domains, priority phases and a four-tier effectiveness rating. Your Essential Eight maturity level doesn't carry over automatically. ASD says your existing controls and evidence still count towards the new framework, and both frameworks will stay live on cyber.gov.au during a transition period with no end date set yet. Until your regulator, insurer or customer changes its wording, keep meeting the Essential Eight obligations you already have. Then use your current maturity as the starting point for a gap analysis against the new model.

We've already covered the basics in Essential Eight compliance for Australian SMBs, Maturity Level 1 vs Level 2 and whether Essential Eight is mandatory. In September we also covered the Essentials consultation, while the framework was still a draft. This guide covers what ASD actually published in October 2026, what changed and what to do about it.

What changed with the Essential Eight in October 2026?

On 15 October 2026, ASD launched the ASD Essentials, which it calls "an evolution of Australia's widely adopted Essential Eight framework". It's a series of focused chapters, not a single list of eight strategies.

The first three chapters

▸Essentials for enterprise IT: the direct evolution of the Essential Eight
▸Essentials for operational technology (OT): for critical infrastructure operators protecting OT environments
▸Essentials for cloud: for organisations whose technology is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS)

ASD has also published AI considerations, so AI-enabled systems can be scoped within the framework. The ASD FAQ says AI is treated as "another asset" that must be included when you scope domains.

What ASD published alongside it

ASD published the framework with a supporting set of documents: an overview FAQ, a Transitioning from the Essential Eight guide, an Implementation planning guide, an Assessment process guide, an Assessment evidence guide for enterprise IT with mappings to other frameworks, and an assessment workbook. The FAQ also says ASD will develop a training course for assessors.

How it got here

The consultation paper was open for feedback from 15 June to 12 July 2026. After it closed, ASD clarified terminology, added overview publications for newcomers, expanded the guidance on scoping systems to domains and added guidance on AI. The last change to the Essential Eight maturity model itself was the November 2023 update. That update brought in phishing-resistant MFA at Maturity Level Two, moved event log retention to centralised logging and adopted wording from mapped Information Security Manual (ISM) controls.

Is the Essential Eight being retired?

Not yet. ASD says it "will continue to maintain both the Essential Eight and Essentials frameworks on cyber.gov.au" during the transition, and organisations should keep meeting current regulatory obligations until regulators announce changes. ASD hasn't published a retirement date.

The ASD FAQ says ASD has been talking to regulators about expected timeframes and "will advise on expectations for transitioning to the new framework in due course". Speaking to iTnews on launch day, ACSC head Stephanie Crowe said the regulatory transition timeframe is being worked through with policy agencies over "the next year or two". She also said government agencies will be assessed against both frameworks next year.

In practice:

▸Commonwealth entities and critical infrastructure should watch for direction from their regulator or policy owner. Until it arrives, existing Essential Eight reporting continues.
▸Defence suppliers, insurers and tender panels still use Essential Eight language in their questionnaires. Expect that to change gradually, not overnight.
▸Everyone else can start mapping now, and shouldn't drop the Essential Eight controls they already rely on.

What's actually different in ASD Essentials for enterprise IT?

The Essentials stop prescribing specific controls and grading you on one maturity ladder. Instead they describe security outcomes, then assess whether each outcome is actually achieved for the assets in each domain. ASD's transition guide maps the concepts like this:

▸Mitigation strategies → principles supported by actions. Principles describe the outcome; actions describe what you must do to achieve it. One Essential Eight strategy can feed several principles.
▸Maturity levels → priority phases. Phases set the order you work through the domains. ASD is explicit that they are "not maturity or assurance ratings".
▸Whole-of-environment implementation → eight domains. Actions are applied and assessed per domain, and an asset that supports more than one domain is considered in each.
▸Choosing a target maturity level → threat-informed implementation. You no longer pick ML1, ML2 or ML3.
▸Assessment against specific requirements → four-tier, outcome-based assessment.

The eight domains and three priority phases

The framework has six technical domains and two capability domains. ASD recommends this order:

Priority phase 1: Boundary services and Identity services
Priority phase 2: Critical processes and services, and Privileged environments
Priority phase 3: Business systems and User devices

The two capability domains, Governance and culture and Visibility and response, apply across all three phases and grow as you go. Crowe's explanation to iTnews was blunt: identity services and the internet-facing edge devices come first because if they aren't secure, "you're allowing threat actors into the network quite easily".

That's a real change in emphasis. Instead of rolling every control out across the whole environment at once, the Essentials ask you to secure the edge and identity layer before business systems and the staff laptop fleet.

The new rating scale

Each action is rated per domain as not assessed, not effective, partially effective or fully effective. "Not assessed" is neutral and must not be read as a failure. A principle's rating within a domain is the lowest rating among its applicable actions, so one weak action pulls the whole principle down. For boards, ASD describes a weighted calculation that produces a percentage score showing progress towards full effectiveness in each domain.

Does my Essential Eight maturity level carry over?

No. ASD states plainly that Essential Eight maturity level ratings "do not automatically convert" into Essentials effectiveness ratings, because the two models measure different things. The Essential Eight measured whether you implemented specific controls. The Essentials measure whether outcome-based actions are effective for the assets in each domain.

What ASD does say about your starting point:

If you're at Maturity Level Two

Expect many controls to contribute to early-phase actions, including phishing-resistant MFA, patching internet-facing services, privileged access, application control and centralised logging. The common gaps ASD expects are extending controls to new assets or domains, governance, visibility and response, and evidence of sustained effectiveness.

If you're at Maturity Level Three

You'll likely reuse more controls and evidence, but ML3 "does not automatically produce fully effective ratings". Some actions have no Essential Eight equivalent at all, such as credential exposure and supply chain security.

If you're at Maturity Level One or part-way through an uplift

The same transition approach applies, but expect a larger share of actions to need more work. ASD says not to throw away work in progress: map it to the new actions and keep going where it's still relevant.

Which Essential Eight controls need strengthening?

Every Essential Eight strategy maps to at least one Essentials principle, but most principles ask for more than the original control did. These are the changes from ASD's strategy-by-strategy mapping most likely to affect Australian organisations:

Multi-factor authentication

MFA now sits under a broader Identity, credential and access management principle. On top of phishing-resistant MFA, actions include:

▸Finding and disabling default and unused accounts regularly
▸Storing keys, secrets and tokens in approved secure repositories protected by MFA
▸Scanning codebases, configuration files, file shares and collaboration platforms for exposed credentials
▸Disabling legacy authentication protocols, or restricting and monitoring them with a time-bound decommissioning plan
▸Unique credentials for user, machine, system and service accounts

Restrict administrative privileges

The Essentials require administration from dedicated, hardened environments, time-bound privilege grants and explicit session controls, and logging of admin actions with the user, timestamp and target. Least privilege now explicitly covers non-person and service accounts. Network segmentation is also in scope, to limit lateral movement to approved pathways.

Patching applications and operating systems

These map to Vulnerability management, Asset identification and Legacy system management. Patch timeframes become risk-based, weighing exploitation, exposure, criticality, impact and compensating controls, and you need to verify that treatment worked. ISM, regulatory and other mandatory timeframes still apply. Asset inventories must now cover identities, credentials and data as distinct assets, not just devices and software.

Regular backups

Backups need secure, resilient storage protected by encryption and immutable, offline, logically isolated or equivalent controls. Repositories must be isolated from production and user environments. Restore tests must show you can meet defined recovery time and recovery point objectives.

Application control, macros and user application hardening

These now contribute to Trustworthy software and Secure configuration management. That brings in control of admin tooling, minimised and time-bound exceptions, approved configuration baselines and detecting configuration drift. User application hardening also maps to a new Content filtering principle covering outbound connections to malicious destinations.

What's completely new compared with the Essential Eight?

ASD Essentials for enterprise IT adds outcomes the Essential Eight never assessed, most notably governance, supply chain and dedicated detection and response. According to the transition guide, these include:

▸Governance and culture: executive cyber security accountability, resourcing, security risk management, assurance, supplier cyber security assurance, AI accountability and legacy system management
▸Threat-informed risk assessment and broader asset identification
▸New protect principles: content filtering, cyber security awareness training and cyber supply chain security
▸Visibility and response: event logging, detection, incident identification, detection efficacy, incident coordination, incident response and post-incident insights

How should you evidence the Essentials?

Deployment isn't enough. ASD says assessors consider coverage, consistency, currency and evidence quality, and look for proof that a control keeps working over time. Config exports and policies still count, but where evidence shows a control was deployed rather than that it's sustained, ASD suggests adding control validation, testing, exercise results, monitoring records, drift reports and restore tests. iTnews also noted that effectiveness ratings are backed by evidence "such as independent testing and simulated exercises".

That's where independent work earns its keep:

▸A penetration test shows whether boundary services, identity and privileged pathways actually resist an attacker, which is direct evidence for the phase 1 and phase 2 domains. See also Active Directory penetration testing and cloud penetration testing.
▸A current Essential Eight assessment gives you the dated baseline ASD tells you to record before you start mapping.
▸Stale evidence won't do. ASD warns against relying on expired exceptions, weakened compensating controls or out-of-date risk acceptances.

What should Australian businesses do now?

Record where you are, scope the phase 1 domains, run a gap analysis and keep your current uplift work going. ASD says it "does not recommend slowing or stopping" approved uplift programs. Here's its recommended transition pathway in practical terms:

Set a transition baseline. Record your latest Essential Eight assessment results, controls, exception and risk registers, and remediation plans.
Scope priority phase 1. Identify the assets and functions in Governance and culture, Visibility and response, Boundary services and Identity services.
Run a gap analysis. Classify each action as already effectively addressed, partially addressed or not addressed. These are gap findings, not formal ratings.
Plan implementation. Build each shared capability once, then roll it out in priority phase order.
Deliver and measure. Collect evidence on coverage, consistency and currency as each control lands.
Move through phases 2 and 3, and set a reassessment cadence.

Pitfalls ASD calls out

▸Treating priority phases as maturity levels
▸Claiming equivalence instead of assessing
▸Assessing the whole enterprise instead of each domain
▸Leaving governance and visibility until last
▸Trying to transition every domain at once

What this means for SMBs

ASD wrote the Essentials primarily for Commonwealth entities, critical infrastructure and large organisations. Its FAQ says smaller businesses can still use the guidance where relevant, and that the outcomes are "equally important for smaller organisations". For most SMBs, the Essential Eight questions in insurance, tender and supply chain forms aren't going away this year. The sensible move is to keep your Essential Eight controls working, put phishing-resistant MFA and edge-device patching at the top of the list, and start keeping evidence that shows controls operate, not just that they exist.

What does an Essential Eight assessment cost now?

Aussie Pentest's Essential Eight assessment is $4,950 + GST, fixed fee, for environments up to 50 seats. Larger environments are quoted on scope. It includes your choice of ML1 or ML2 as the target maturity, full technical testing across all eight controls, a maturity score with evidence documentation, a prioritised remediation roadmap, a board-ready executive summary and a 60-minute debrief, with the report delivered within 10 business days. In the transition, that gives you the documented baseline ASD's pathway starts from. More detail is in Essential Eight assessment cost in Australia.

Human-led penetration tests start from $5,000 + GST. A vCISO retainer ($2,500 to $6,500 a month) can cover the governance side, including the risk register, board reporting and tracking framework changes. All prices are on our pricing page. To work out where you stand, book a 1-on-1 call.

Frequently asked questions

Do I need to stop my Essential Eight project?

No. ASD recommends continuing current uplift programs while you assess how they align with the Essentials. Map planned work to the new actions before deciding whether it continues unchanged. Don't start new work purely to hit a superseded Essential Eight target unless an obligation or material risk still requires it.

Is ML2 still the target for government and defence suppliers?

Existing obligations stand until the relevant authority changes them. ASD says organisations should keep meeting regulatory, contractual and other obligations that require Essential Eight implementation or reporting.

Can I say I'm "Essentials compliant" yet?

Be careful. The Essentials rate each action per domain as not assessed, not effective, partially effective or fully effective. There's no single compliance level, and phases aren't maturity ratings. Report what you've actually assessed.

Does the Essentials cover Microsoft 365 and SaaS?

Yes. Essentials for cloud is a dedicated chapter for organisations whose environment is delivered entirely through SaaS and PaaS.

Bottom line

The Essential Eight has been replaced as ASD's flagship guidance, but it hasn't been switched off. ASD Essentials for enterprise IT keeps most of the same controls, broadens what they must achieve and grades outcomes per domain instead of awarding one maturity level. Identity and internet-facing systems come first, and evidence of sustained effectiveness matters more than ever. Keep your Essential Eight obligations met, record a dated baseline, map it to the new actions and fix the edge and identity layer first. If you'd like an independent baseline or testing evidence, book a 1-on-1 call or see our Essential Eight assessment.

Sources

This article is general information only, not legal, regulatory or compliance advice. ASD Essentials guidance, transition timeframes and regulator expectations may change, so always check cyber.gov.au and confirm your obligations with your regulator, contract owner or a qualified adviser. Aussie Pentest is not affiliated with or endorsed by ASD. Prices are current as of October 2026, and sources were checked on 19 October 2026.