On 15 October 2026 the Australian Signals Directorate (ASD) launched ASD Essentials, a new cyber security framework that will replace the Essential Eight. Cyber Security Minister Tony Burke announced it, and ACSC head Stephanie Crowe described the guidance as "practical, prioritised guidance that Australian organisations can use to reduce risk."

The Essential Eight has been the default yardstick for Australian organisations since 2017. If you have a Maturity Level 2 target in a contract, a tender response or an insurance renewal, this change touches you. It is not a reason to stop what you are doing, but it is a reason to understand where the framework is heading.

What Actually Changed

The Essential Eight told you which eight mitigation strategies to implement and rated you from Maturity Level 0 to 3. ASD Essentials is built differently, in three layers:

Principles describe the security outcomes an organisation should achieve.
Actions are the work needed to reach those outcomes. Many are mapped to MITRE ATT&CK techniques.
Domains group the business functions and assets the actions apply to, so effort goes where it reduces the most risk.

Maturity levels are replaced by priority phases and effectiveness ratings. Each action and domain is rated "not effective", "partially effective" or "fully effective", and a principle takes the rating of its lowest-rated applicable action. The first guidance covers enterprise IT, operational technology and cloud.

The question moves from "did you tick the box" to "does the control actually work."

What Does Not Change Overnight

Three points from ASD's own transition guidance are worth underlining:

ASD says it does not recommend slowing or stopping existing uplift programs.
Both the Essential Eight and ASD Essentials remain on cyber.gov.au during the transition.
Every Essential Eight mitigation strategy maps to at least one Essentials principle, and most controls directly satisfy or substantially contribute to a corresponding action. The work you have done is not wasted.

One caveat matters for anyone holding a report: existing Essential Eight maturity ratings do not automatically convert into Essentials effectiveness ratings. A Maturity Level 2 result is evidence of controls, not a ready-made Essentials score.

We did not find a firm date for retiring the Essential Eight in the coverage we reviewed. Reporting differs on timing, with some outlets suggesting it will take effect over the next year or two. Treat any specific end date as unconfirmed until ASD publishes one.

Why This Is Not Simply a Relabel

The Essential Eight was prescriptive. That made it easy to audit and easy to game. ASD's own reporting found that 78 per cent of Commonwealth agencies failed to meet the mandatory Maturity Level 2 baseline, in place under the Protective Security Policy Framework since July 2022. Burke also pointed to the shrinking window between a vulnerability being found and exploited, which he put at about 10 hours.

ASD Essentials leans on professional judgement. That has a cost. The Australian Computer Society called the guidance "overdue" but warned that its success depends on the people assessing it, and cautioned that boards could end up with reports full of "fully effective" ratings that nobody can stand behind. It also noted that the Infosec Registered Assessors Program has more than 400 assessors, mostly serving governments and large businesses, which leaves smaller companies with few options.

Where Small and Mid-Sized Businesses Stand

ASD Essentials is aimed at government, critical infrastructure and large businesses. Coverage notes it offers limited direction for small and medium businesses. ASD has separately published a Small Business Cyber Security Handbook, which prioritises multi-factor authentication, rapid updates, regular backups and staff training, and Home Affairs is developing a CyberSmart program that includes a certification scheme and a Cyber Trust Mark.

If you are an SME responding to a tender or a vendor portal, expect your customers to keep asking for Essential Eight evidence for some time. Expect them to start asking about Essentials outcomes later.

What To Do This Quarter

Keep your uplift program running. ASD itself says not to pause it.
Record your current Essential Eight position with evidence. Evidence is what carries across to any framework. Ratings do not.
Map your controls to Essentials principles. Start with identity services, boundary services, governance and culture, and visibility and response, which ASD recommends as the first domains to scope.
Ask your customers and regulators what they will accept. Contractual language still names the Essential Eight. Do not assume it has changed.
Plan for independent testing. Effectiveness ratings are about whether a control works. That is a question for penetration testing and verification, not self-attestation.

How We Can Help

Our Essential Eight Pilot gives you an evidence-backed baseline that holds up under either framework. If you need to know where your controls sit against ASD Essentials principles, or what your next tender will accept, talk to us. We scope it before we start, and we tell you plainly when something is not yet settled.

Sources

This article summarises public reporting as at 20 October 2026. Check cyber.gov.au for the current ASD text before making compliance decisions.

ASD Essentials Is Replacing the Essential Eight: What Australian Organisations Should Do Now