The Essential Eight evolution. What ASD Essentials changes, and what it doesn't
On 15 October 2026, the Australian Signals Directorate published ASD Essentials, the evolution of the Essential Eight. If your organisation has spent the last few years working towards a maturity level, your first question is probably a reasonable one: does all that work still count?
Short answer: yes. The longer answer is where it gets interesting.
What ASD Essentials is
Essentials is a series of chapters, each written for a different kind of environment. Essentials for enterprise IT is the direct successor to the Essential Eight. There are also chapters for cloud and operational technology.
Instead of eight mitigation strategies, each chapter is built from principles (the outcomes you need), actions (the work that gets you there) and domains (the parts of the business they apply to, such as identity, user devices, business systems and privileged environments).
The big change: no more maturity levels
Under the Essential Eight, you chose a target maturity level and worked towards it. Under Essentials, you don’t select a level at all.
Instead, each action is rated on how effectively it works in each domain it applies to: not effective, partially effective or fully effective. ASD also sets out priority phases, but they tell you what order to do things in. They aren’t a score.
Two details matter more than they look:
- A plan doesn’t count. Work in progress isn’t rated as partially effective.
- Switched on isn’t the same as working. A tool that’s deployed but not configured, or doesn’t cover all your assets, isn’t rated as effective.
In other words, Essentials asks for evidence that controls are working everywhere they should be, and that they stay that way.
What hasn’t changed
- The Essential Eight hasn’t been switched off. ASD is keeping both frameworks on cyber.gov.au during the transition, and hasn’t set an end date.
- Your obligations stand. ASD’s guidance is to keep meeting your current regulatory obligations until your regulator communicates changes. For local government and other organisations reporting against the Essential Eight, that means carrying on.
- Your work carries over. Every Essential Eight strategy maps to at least one Essentials principle. But maturity ratings don’t convert automatically, so you’ll need to check existing controls against the new actions rather than assume they’re equivalent.
- The scope got wider. Essentials covers ground the Essential Eight didn’t, including executive accountability for cyber risk, supplier assurance, and logging and incident response.
What to do this quarter
- Don’t pause your Essential Eight program. It still applies, and nearly all of it feeds into Essentials.
- Read ASD’s transition guidance. Map where each of your Essential Eight controls lands in Essentials for enterprise IT or book a session with our Essentials Audit team to talk it through.
- Look at your evidence, not your score. Ask whether you could show each control working across every system it should cover, today. If you can’t, check out Constant.
- Find your new gaps. Governance, supplier risk and detection are the areas most likely to be thin.
- Talk to your regulator, auditor or the Constant audit team. Ask how and when they expect to move, before they ask you.
Our take
We think this is a good change. A single maturity number made it easy to treat compliance as a destination: get to Level One, file the report, relax until next year. Essentials makes that harder. Effectiveness has to be shown, domain by domain, and kept current.
That’s the problem Constant was built for. Compliance obligations are ongoing, so the visibility should be too: a live view of controls, evidence and outstanding actions, reviewed by certified assessors as the work happens rather than reconstructed before an audit.
The framework has changed its name. The goal hasn’t: progress you can prove, whenever someone asks.
Want to see where your Essential Eight work stands today? Book a demo of Constant today.