Short answer: On 15 October 2026 the Australian Signals Directorate (ASD) launched ASD Essentials, the successor to the Essential Eight. It replaces maturity levels with eight domains, three priority phases and an outcome-based rating for every action (not assessed, not effective, partially effective, fully effective). Your Essential Eight controls and evidence still count, but your maturity level does not convert automatically. Until your regulator says otherwise, keep meeting any existing Essential Eight obligations.
What is ASD Essentials?
ASD Essentials is a principles-based cyber security framework published on cyber.gov.au. Instead of one list of eight technical strategies, it is organised into environment-specific chapters that share the same model of principles (the security outcome), actions (what you must do) and domains (groups of systems that share risk).
The first three chapters are:
- Essentials for enterprise IT – the direct evolution of the Essential Eight.
- Essentials for operational technology (OT) – for critical infrastructure operators protecting OT environments.
- Essentials for cloud – for organisations whose technology is delivered entirely through SaaS and PaaS.
ASD will keep both the Essential Eight and the Essentials on cyber.gov.au during the transition period.
Essential Eight vs ASD Essentials at a glance
| Essential Eight | ASD Essentials (enterprise IT) | What changes in practice |
|---|---|---|
| Eight mitigation strategies with requirements | Principles supported by actions | One old strategy can contribute to several principles and actions. |
| Maturity levels (ML1–ML3) | Priority phases | Phases set the order of work. They are not maturity or assurance ratings. |
| Whole-of-environment implementation | Eight domains | Each action is applied and assessed per domain, so coverage can differ between domains. |
| Choose a target maturity level | Threat-informed sequencing | You no longer pick a maturity target; the phases give the recommended order. |
| Pass/fail against specific requirements | Four-tier outcome rating | Not assessed, not effective, partially effective or fully effective. |
The eight domains and three priority phases
The domains group assets and functions with similar risk. Two are capability domains that run through every phase; the other six are technical domains tackled in order:
| Phase | Domains |
|---|---|
| All phases (capability domains) | Governance and culture; Visibility and response |
| Priority phase 1 | Boundary services; Identity services |
| Priority phase 2 | Critical processes and services; Privileged environments |
| Priority phase 3 | Business systems; User devices |
The practical message is to start where attackers start: internet-facing boundary services and identity. A control that is fully effective on user laptops can still be only partially effective on your boundary services if its coverage isn't proportionate to that domain's risk.
How each Essential Eight strategy maps across
ASD's transition guidance confirms that every Essential Eight strategy maps to at least one Essentials principle:
| Essential Eight strategy | Mapped Essentials principles |
|---|---|
| Application control | Trustworthy software; Secure configuration management |
| Patch applications | Vulnerability management; Asset identification; Legacy system management |
| Patch operating systems | Vulnerability management; Asset identification; Legacy system management |
| Multi-factor authentication | Identity, credential and access management |
| Restrict administrative privileges | Identity, credential and access management; Least privilege access; Secure administration; Network segmentation and segregation |
| Restrict Microsoft Office macros | Trustworthy software; Secure configuration management |
| User application hardening | Secure configuration management |
| Regular backups | Regular and proven backups; Least privilege access |
What's genuinely new
Some requirements have no direct Essential Eight equivalent and will need fresh planning and budget:
- Governance and culture – executive cyber accountability, cyber security resourcing, risk management assurance, supplier assurance, AI accountability and legacy system management.
- Asset and risk identification – continuously documenting infrastructure, operating systems, applications, identities, credentials and data, plus threat-informed risk assessment.
- New protect principles – content filtering, cyber security awareness training and cyber supply chain security.
- Visibility and response – event logging, detection, incident identification, detection efficacy, incident coordination, incident response and post-incident insights, brought together in one domain.
- Broader identity requirements – MFA is now one part of a principle that also covers accounts, credentials, authentication protocols and credential storage.
We're at Maturity Level 2. Where does that leave us?
In a good position, but not finished. ASD notes that ML2 organisations can expect many controls to contribute to the early priority phases, including phishing-resistant MFA, patching internet-facing services, privileged access, application control and centralised logging. The usual gaps are:
- extending controls to assets or domains you didn't previously cover;
- addressing the Governance and culture principles;
- producing evidence of sustained effectiveness, not just deployment records.
ML3 organisations can reuse more, but still face requirements with no Essential Eight equivalent, such as credential exposure and supply chain security. ML1 organisations follow the same path with more implementation work.
A practical transition plan
ASD recommends this sequence, which is also how we run transition engagements:
- Establish a transition baseline. Record your latest assessment results, existing controls, exception and risk registers, remediation plans and committed uplift work.
- Scope the phase 1 domains. Identify assets and functions in Governance and culture, Visibility and response, Boundary services and Identity services, reusing existing inventories and architecture documents.
- Run a gap analysis. Classify each action as already effectively addressed, partially addressed or not addressed.
- Plan implementation. Fix domain-specific gaps in place; design shared capabilities once and roll them out in phase order.
- Deliver and measure. For every action and domain, check coverage, consistency, currency and evidence quality.
- Progress through phases 2 and 3, with a regular reassessment cadence.
Five pitfalls to avoid
- Treating priority phases as if they were the new maturity levels.
- Claiming equivalence (“we were ML2, so we're compliant”) instead of assessing.
- Assessing the whole enterprise at once instead of each domain.
- Deferring Governance and culture or Visibility and response until the technical work is done.
- Reusing stale evidence that no longer reflects your environment.
Should we stop our Essential Eight uplift project?
No. ASD explicitly advises organisations not to slow or stop approved uplift programs. Keep going, but map planned work to the Essentials before deciding whether it continues unchanged, and don't start new work purely to hit a superseded Essential Eight target unless a regulator, contract or material risk still requires it.
What does an assessment cost in Australia?
Published Essential Eight assessment prices from Australian providers in 2026 range from about A$5,950 to A$25,000 ex GST for a single organisation, with uplift programs commonly starting around A$22,000–A$40,000 and larger estates exceeding A$120,000. Expect Essentials gap analyses to price similarly, because the scope is driven by environment size, the number of domains and how much evidence already exists.
Get a fixed-price Essentials transition baseline
Kodeclust maps your current Essential Eight controls and evidence to ASD Essentials for enterprise IT, scopes the phase 1 domains, and delivers a prioritised, costed gap analysis your board can act on. See our cyber security and compliance services.