CyberStack

Glossary / practitioner frameworks au-compliance hardening

ASD Essentials for enterprise IT

The enterprise IT chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight, according to iTnews and techpartner.news. Priority phases set an implementation order, not a rating (iTnews).

ASD Essentials for enterprise IT domains and priority phasesPhase 1: identity services and boundary services. Phase 2: critical processes and services, and privileged environments. Phase 3: business systems and user devices. Governance and culture, and visibility and response, apply across all phases.PHASE 1Identity servicesPHASE 1Boundary servicesPHASE 2Critical processesPHASE 2Privileged environmentsPHASE 3Business systemsPHASE 3User devicesALLGovernance and cultureALLVisibility and responseESSENTIALS FOR ENTERPRISE IT / ASDPriority phases are ASD's recommended implementation order, not a rating or maturity model.Capability domains apply across all phases and expand as implementation progresses.

Scope. ASD launched ASD Essentials on 15 October 2026 as a principles-based framework that will replace the Essential Eight and is designed to cover enterprise, cloud and operational technology environments, techpartner.news reported. In its initial version the Essentials covers cloud and operational technology as well as enterprise IT (iTnews). This page covers the enterprise IT chapter.

Principles, actions and domains

The series introduces three core concepts: principles that describe the cyber security outcomes an organisation should achieve, actions that describe what needs to be done to achieve those outcomes, and domains that define the business functions and assets to which actions apply (techpartner.news). Effectiveness is rated per action and domain as 'not effective', 'partially effective' or 'fully effective', and a principle's overall rating is determined by its lowest-rated applicable action (techpartner.news).

Priority phases are an order, not a score

Across the series, priority phases replace maturity levels, sequencing effort toward the highest-risk assets first, and ASD recommends organisations begin scoping work in the phase one domains: boundary services, identity services, governance and culture, and visibility and response (techpartner.news). ASD said priority phases are not maturity ratings, and that reaching a phase 'describes implementation scope, not how secure the organisation is', according to iTnews. iTnews reports that identity services and edge devices that connect networks to the internet come first, ahead of business systems and staff laptops, ACSC head Stephanie Crowe said.

Outcomes, not prescribed controls

iTnews reports the framework stops prescribing specific controls: it sets out the security outcomes to achieve and leaves organisations to choose how, though ASD's examples are still specific, such as requiring phishing-resistant multi-factor authentication. ASD Essentials also calls on organisations to formally define executive and board-level accountability for cyber security (iTnews).

Supporting material

ASD has published transition, implementation and assessment guidance (techpartner.news), and a transition guide was released alongside the framework (iTnews). See Transitioning from the Essential Eight.

Chapter detail

Neither iTnews nor techpartner.news reported this chapter's specific contents. For the chapter's domains, actions and wording, read the ASD publication listed under further reading; this page does not summarise it.

See also:

ASD EssentialsASD Essentials for cloudASD Essentials for OTTransitioning from the Essential Eight to ASD EssentialsEssential EightLeast privilegeMulti-factor authentication

Fact source: iTnews — ASD’s Essential Eight replacement moves away from maturity ladder (15 Oct 2026), techpartner.news — ASD launches ASD Essentials to replace Essential Eight (15 Oct 2026), Further reading: ASD — ASD Essentials for enterprise IT.