ASD launches ASD Essentials to replace Essential Eight

The Australian Signals Directorate (ASD) has launched ASD Essentials, a principles-based cyber security framework which will replace the Essential Eight and is designed to cover enterprise, cloud and operational technology environments.

ASD said the change reflects an evolved threat landscape documented in its Annual Cyber Threat Report 2024–2025, with Australian organisations facing increasingly sophisticated attacks across more complex, hybrid-cloud environments.

Rather than the Essential Eight's prescriptive list of mitigation strategies and maturity levels, the ASD Essentials introduces three core concepts:

• principles that describe the cyber security outcomes an organisation should achieve
• actions that describe what needs to be done to achieve those outcomes
• and domains that define the business functions and assets to which actions apply.

Priority phases replace maturity levels, sequencing effort toward the highest-risk assets first.

ASD recommends organisations begin scoping work in phase one domains - boundary services, identity services, governance and culture, and visibility and response.

Effectiveness is rated per action and domain, with ratings ”not effective”, “partially effective” or “fully effective”. A principle's overall rating is determined by its lowest-rated applicable action.

For organisations already invested in the Essential Eight, ASD said existing work remains relevant.

Every Essential Eight mitigation strategy maps to at least one principle in the new series, and most controls will directly satisfy or substantially contribute to a corresponding action.

ASD does not recommend slowing or stopping existing uplift programmes, and has published transition, implementation and assessment guidance for major multi-year investments.

However, existing Essential Eight maturity ratings do not automatically convert into Essentials effectiveness ratings, as the two models measure different things - implementation of specific controls versus outcome-based effectiveness across domains.

During a transition period, ASD will continue to maintain both the Essential Eight and Essentials frameworks on cyber.gov.au, along with supporting resources and implementation guidance.

It will publish a strategy document outlining the roadmap for future Essentials development, along with AI-specific considerations to assist organisations in the current environment.

The launch of ASD Essentials follows a public consultation period that ran from 15 June to 12 July 2026 and drew feedback from a broad range of organisations.