ASD Essentials

What it is. The Australian Signals Directorate launched ASD Essentials on 15 October 2026, a principles-based cyber security framework that will replace the Essential Eight and is designed to cover enterprise, cloud and operational technology environments, techpartner.news reported. iTnews reported it will likely be a year or two before it becomes the new standard.

Three core concepts

According to techpartner.news, ASD Essentials introduces three core concepts: principles that describe the cyber security outcomes an organisation should achieve, actions that describe what needs to be done to achieve those outcomes, and domains that define the business functions and assets to which actions apply. iTnews reports that the framework stops prescribing specific controls: it sets out the security outcomes to achieve and leaves organisations to choose how, though ASD's examples are still specific, such as requiring phishing-resistant multi-factor authentication.

Priority phases and ratings

Priority phases replace maturity levels, sequencing effort toward the highest-risk assets first, and ASD recommends organisations begin scoping work in the phase one domains: boundary services, identity services, governance and culture, and visibility and response (techpartner.news). ASD said priority phases are not maturity ratings, and that reaching a phase 'describes implementation scope, not how secure the organisation is', according to iTnews. Instead of a single maturity rating, organisations report their security area by area, such as identity services or internet-facing systems, with overall posture expressed through effectiveness ratings backed by evidence such as independent testing and simulated exercises (iTnews). Effectiveness is rated per action and domain as 'not effective', 'partially effective' or 'fully effective', and a principle's overall rating is determined by its lowest-rated applicable action (techpartner.news).

Chapters

In its initial version the Essentials covers cloud and operational technology as well as enterprise IT (iTnews). CyberStack has pages for all three chapters: enterprise IT, cloud and OT.

Relationship to the Essential Eight

Every Essential Eight mitigation strategy maps to at least one principle in the new series, and existing Essential Eight maturity ratings do not automatically convert into Essentials effectiveness ratings, according to techpartner.news. ACSC head Stephanie Crowe told iTnews there was 'no wasted investment' for organisations aligned with the Essential Eight; iTnews adds that ASD's own guidance says organisations should check those controls against the Essentials 'rather than assume they are equivalent'. During a transition period ASD will maintain both frameworks (techpartner.news), and government agencies will be assessed against both next year (iTnews). See Transitioning from the Essential Eight.