The Australian Signals Directorate launched ASD Essentials on 15 October 2026, a principles-based cyber security framework that will replace the Essential Eight and is designed to cover enterprise, cloud and operational technology environments, techpartner.news reported. It introduces three core concepts: principles that describe the cyber security outcomes an organisation should achieve, actions that describe what needs to be done to achieve them, and domains that define the business functions and assets the actions apply to.

Priority phases replace maturity levels, and ASD recommends organisations begin scoping work in the phase one domains: boundary services, identity services, governance and culture, and visibility and response (techpartner.news).

ASD said priority phases are not maturity ratings and that reaching a phase 'describes implementation scope, not how secure the organisation is', according to iTnews. Effectiveness is rated per action and domain as 'not effective', 'partially effective' or 'fully effective', and a principle's overall rating is set by its lowest-rated applicable action; every Essential Eight mitigation strategy maps to at least one principle, and Essential Eight maturity ratings do not automatically convert into Essentials effectiveness ratings (techpartner.news). iTnews reports the framework stops prescribing specific controls, setting out outcomes and leaving organisations to choose how to reach them, and puts identity services and internet-facing edge devices first, ahead of business systems and staff laptops.

Practitioner pages: /knowledge/asd-essentials, /knowledge/asd-essentials-enterprise-it, /knowledge/transitioning-from-essential-eight.

UPDATE 15 October (iTnews): ACSC head Stephanie Crowe told iTnews that when ASD Essentials becomes mandatory is not yet settled; ASD is working with policy agencies on a regulatory transition timeframe that will run over the next year or two. In the meantime the Essential Eight stays on ASD's website alongside the new framework, and government agencies will be assessed against both next year.

Crowe said there is 'no wasted investment' for organisations already aligned with the Essential Eight, though ASD's guidance says existing controls should be checked against the Essentials rather than assumed equivalent. ASD plans workshops for organisations working through the change, and the Essentials also asks organisations to formally define executive and board-level accountability for cyber security. Wire: iTnews.

Correction (23 Oct 2026): re-sourced to iTnews and techpartner.news; removed details that rested only on ASD pages we cannot recheck.