ASD launches the ASD Essentials series (15 Oct): Essential Eight evolves into ASD Essentials for enterprise IT, with principles, actions and domains, three priority phases, and chapters for enterprise IT, cloud and OT
On 15 October 2026 the Australian Signals Directorate published the ASD Essentials series, a framework meant to give organisations a consistent approach to cyber security across technology environments. Current chapters cover enterprise IT, cloud and operational technology, and each uses the same three layers: principles (outcomes, drawn from the ISM's cyber security principles), actions (what to do, mapped to MITRE ATT&CK where appropriate) and domains (groupings of business functions and assets with similar risk). ASD says it has evolved the Essential Eight into ASD Essentials for enterprise IT. That chapter has six technical domains in three priority phases: identity services and boundary services first; critical processes and services and privileged environments second; business systems and user devices third. Two capability domains, Governance and culture and Visibility and response, run across all phases. ASD says priority phases are a sequencing mechanism, not a rating or maturity model. Its transition guide says every Essential Eight strategy maps to at least one principle and existing investment carries forward but is assessed differently. Essential Eight maturity levels do not automatically convert; actions are rated not assessed, not effective, partially effective or fully effective. Organisations with obligations that still require Essential Eight reporting should keep meeting them. Practitioner pages: /knowledge/asd-essentials, /knowledge/asd-essentials-enterprise-it, /knowledge/transitioning-from-essential-eight. UPDATE 15 October (iTnews): ACSC head Stephanie Crowe told iTnews that when ASD Essentials becomes mandatory is not yet settled; ASD is working with policy agencies on a regulatory transition timeframe that will run over the next year or two. In the meantime the Essential Eight stays on ASD's website alongside the new framework, and government agencies will be assessed against both next year. Crowe said there is 'no wasted investment' for organisations already aligned with the Essential Eight, though ASD's guidance says existing controls should be checked against the Essentials rather than assumed equivalent. ASD plans workshops for organisations working through the change, and the Essentials also asks organisations to formally define executive and board-level accountability for cyber security. Wire: iTnews.
- Product
- n/a (ASD framework publication — ASD Essentials series)
- Versions
- n/a
- Exploited in Australia?
- unknown
- Patch to
- If you run an Essential Eight program, read ASD's transition guide and Implementation planning guide, record your current Essential Eight baseline, scope the priority phase 1 domains, and run a gap analysis. Don't treat a priority phase as a maturity or compliance level, and don't assume a past maturity level converts to a rating.
Primary: ASD — What is the Essentials? (published 15 Oct 2026) · Vendor: ASD — ASD Essentials for enterprise IT (domains and priority phases) · ASD — Transitioning from the Essential Eight (published 15 Oct 2026)