Transitioning from the Essential Eight to ASD Essentials

Purpose. ASD says it has evolved the Essential Eight into ASD Essentials for enterprise IT to address contemporary cyber threats and modern enterprise environments. Its transition guide, published 15 October 2026, is for organisations that have implemented, or are implementing, the Essential Eight. Organisations that have not can implement the enterprise IT chapter directly. The enterprise IT chapter is one of three current chapters, alongside cloud and operational technology (OT).

The transition principle

Existing investment carries forward, but it is assessed differently. ASD says every Essential Eight mitigation strategy maps to at least one principle in the enterprise IT chapter, and existing controls will often directly satisfy, or contribute to, one or more actions. The main differences are the scope controls need to cover, the broader outcomes some controls now contribute to, and the evidence needed to show an action is effective. ASD describes the Essential Eight as an important foundation for many of the controls the chapter requires.

Strategy to principle mapping (as published)

Application control: Trustworthy software; Secure configuration management.

Patch applications and patch operating systems (mapped together): Vulnerability management; Asset identification; Legacy system management.

Multi-factor authentication: Identity, credential and access management.

Restrict administrative privileges: Identity, credential and access management; Least privilege access; Secure administration; Network segmentation and segregation.

Restrict Microsoft Office macros: Trustworthy software; Secure configuration management.

User application hardening: Secure configuration management; Content filtering.

Regular backups: Regular and proven backups; Least privilege access.

These are the key mapped principles ASD lists for each strategy. Its guide also maps each one to specific actions and domains, and assumes the Essential Eight requirements were implemented and sustained.

Concepts translated

Mitigation strategies with requirements become principles supported by actions. Maturity levels become priority phases, which sequence the technical domains and are not maturity or assurance ratings. Whole-of-environment implementation becomes eight domains, where actions are applied and assessed in the domains they map to. Organisations no longer select a target maturity level. Assessment against specific requirements becomes a four-tier, outcome-based assessment: not assessed, not effective, partially effective and fully effective.

Maturity levels do not convert

Essential Eight maturity level ratings do not automatically convert into ratings under the enterprise IT chapter, because the two approaches assess different things. Use existing implementation and assessment evidence as the starting point for a gap analysis. ASD says Maturity Level Two organisations can expect many controls to contribute to actions in the early priority phases, and Maturity Level Three organisations are likely to reuse a broader range of controls and evidence, but neither produces fully effective ratings automatically. Not assessed is a neutral rating and must stay distinct from not effective.

What is new

The Governance and culture domain covers areas the Essential Eight maturity model did not assess, such as executive accountability, resourcing, security risk management assurance, supplier assurance, AI accountability and legacy system management. Asset identification extends to infrastructure, operating systems, applications, identities, credentials and data. New protect principles include Content filtering, Cyber security awareness training and Cyber supply chain security. Logging, monitoring and response are brought together in the Visibility and response domain.

ASD's recommended pathway

1. Establish the transition baseline: record recent assessment results, existing controls, exception and risk registers, and planned uplift. Don't start work only to hit a superseded Essential Eight target unless a regulator or other obligation still requires it, or it still addresses material risk. 2. Scope the priority phase 1 domains (Governance and culture, Visibility and response, Boundary services, Identity services). 3. Run a gap analysis that classifies each action as already effectively addressed, partially addressed or not addressed. These are gap findings, not formal ratings. 4. Plan implementation. 5. Deliver and measure against coverage, consistency, currency and evidence quality. 6. Progress through priority phases 2 and 3, and set a reassessment cadence.

Pitfalls ASD names include treating priority phases as maturity levels and claiming equivalence instead of assessing. Organisations with obligations that still require Essential Eight terminology or reporting should keep meeting them as the relevant authority directs.