Book a demo

ASD Essentials Transition Tracker

Last updated 23 September 2026. One page for what ASD has published on the Essentials series, and what Constant customers should keep doing with Essential Eight.

The published record

The ASD Essentials series is the evolution ASD has put out for consultation. Essential Eight is still the maturity model organisations are assessed against until ASD publishes a replacement.

This tracker is updated in place when ASD publishes something new. It separates what ASD has published from commentary reported elsewhere. It does not treat a 12-month or 24-month comment as a retirement date.

ASD Essentials is included

ASD Essentials is included in Essential Eight pricing on Constant. When you move from Essential Eight to ASD Essentials, that move is part of the Essential Eight subscription.

There is no extra cost.

What is known

Published by ASD

ASD announcements

On 15 June 2026 ASD published "Consultation on evolution of Essential Eight" on cyber.gov.au. The page was first published and last updated on that date. It says ASD is consulting on the evolution of the Essential Eight, and that the proposal introduces an Essentials series with greater flexibility and a path to strong cyber resilience. Source: https://www.cyber.gov.au/about-us/view-all-content/news/consultation-on-evolution-of-essential-eight

Published by ASD

Consultation milestones

The announcement says consultation on Essentials for enterprise IT was open through the ASD Cyber Security Partnership Program portal and ran until 12 July 2026. As of this tracker's last check on 23 September 2026, that official page still shows a last updated date of 15 June 2026. A consultation outcome is not recorded on that page.

Not yet published by ASD

Published drafts

The 15 June 2026 announcement invites feedback. It does not link a public draft of the Essentials text. This tracker will cite a draft here when ASD publishes one.

Published by ASD

Confirmed chapters

ASD states that the evolution of the current Essential Eight guidance will form the first chapter of the series, Essentials for enterprise IT, with additional chapters to follow. Further chapter names are not confirmed on the official announcement.

Published by ASD

Changes to Essential Eight

ASD says organisations already using the Essential Eight can expect strong alignment with existing controls and investments. The announcement does not publish a retirement date, and it does not say Essential Eight is withdrawn. Some public commentary has reported approximate 12-month and 24-month transition comments from an ACSC official. Those comments are not on the official announcement. Constant does not treat them as ASD policy, and does not state that ASD Essentials replaces Essential Eight in 2027 or any other year.

Not yet published by ASD

DISP implications

ASD has not published a mapping from the Essentials series to DISP. Defence suppliers should keep an Essential Eight evidence record, because ASD has said existing Essential Eight investment remains aligned. DISP obligations are a separate program. See Essential Eight for DISP on this site.

Not yet published by ASD

Assessment methodology changes

ASD has not published a new assessment method for the Essentials series. Until it does, assessment still means Essential Eight maturity, evidence, and review. Constant continues to pre-review evidence with AI and have a certified assessor review the result.

Not yet published by ASD

Maturity model changes

ASD has not published a replacement for Maturity Level 1, Maturity Level 2, and Maturity Level 3. Constant still tracks those three levels across the eight strategies.

Not yet published by ASD

New control mappings

ASD has not published new Essentials control mappings. Constant does not present unpublished controls as if they were mapped. When ASD publishes mappings, this section will say what they are and how an Essential Eight evidence record lines up.

Constant product support

Constant product support

Constant continues to assess the current Essential Eight maturity model. This page will be updated when ASD publishes requirements Constant can map and track. It does not claim support for controls ASD has not published.

How to use this page

Treat each section status as the point. "Published by ASD" is something you can cite. "Not yet published by ASD" means there is nothing official to implement yet. "Reported elsewhere, not ASD policy" is context, not a date to plan a cutover against.

Keep investing in Essential Eight evidence and assessor review. ASD has said that investment stays aligned. Pausing a maturity program to wait for an unpublished chapter does not create a record an assessor can review.

Essential Eight compliance software

Essential Eight for DISP

Tracker changelog

23 September 2026: checked the official ASD announcement, retained the consultation dates, and confirmed that the linked page does not publish a replacement maturity model, control mapping, or retirement date.

Future changes will be recorded on this URL with the official source and date, rather than split across speculative update articles.

Sources and further reading

Last reviewed 23 September 2026.

Related pages

Maturity assessment

Essential Eight maturity assessment software for ML1, ML2, and ML3.

Essential Eight for DISP

Essential Eight evidence for DISP and defence suppliers, hosted in Australia.

Assessor review

Automated evidence, AI pre-review, and a certified assessor behind the result.

Evidence collection

Automated Essential Eight evidence collection, plus upload where needed.

Questions answered

What is the ASD Essentials series?

On 15 June 2026 ASD opened consultation on an Essentials series as the evolution of the Essential Eight. The official announcement says the current Essential Eight guidance will form the first chapter, Essentials for enterprise IT, with further chapters to follow. Consultation on that chapter ran until 12 July 2026.

Does ASD Essentials replace Essential Eight in 2027?

No. ASD's official announcement does not publish a retirement date. Approximate 12-month and 24-month timelines have been reported from comments by an ACSC official elsewhere. They are not published ASD policy. Essential Eight remains the model Constant assesses.

Should we pause Essential Eight work until the Essentials series is final?

No. ASD has said organisations already using the Essential Eight can expect strong alignment with existing controls and investments. Keep collecting evidence and running assessor review. This tracker will record methodology, maturity, and mapping changes when ASD actually publishes them.

How often is this tracker updated?

This is the canonical page. It was last updated on 23 September 2026, when the official cyber.gov.au announcement was checked. The same URL will be revised when ASD publishes a draft, a chapter, a mapping, or a change to Essential Eight. Constant will not split those updates into separate articles.

Has ASD published a public draft of Essentials for enterprise IT?

Not on the 15 June 2026 announcement. That page invites feedback and does not link a public draft. This tracker will cite a draft when ASD publishes one.

Has ASD named chapters beyond Essentials for enterprise IT?

No. The official announcement names Essentials for enterprise IT as the first chapter and says additional chapters will follow. It does not confirm further chapter names.

Start your compliance journey today

Choose the right plan for your organisation. Scale seamlessly as your compliance needs evolve.

Ready to simplify your compliance process?

Book a demo and see constant in action.

Book a Demo Explore More

All Paid Plans Include

  • Unlimited human assessor reviews

  • Evidence collection

  • AI-assisted pre-reviews

  • Compliance dashboards

  • Australian business-hours support

  • On-demand reporting

  • Control owners and tasks

  • Evidence uploads

  • Maturity and gap tracking

  • Role-based access controls

  • Framework guidance

  • 5×5 Risk Matrix

  • Australian data residency