On 15 October 2026 the Australian Signals Directorate launched ASD Essentials, the framework meant to succeed the Essential Eight. It is not an overnight switch. Both frameworks will run side by side for the next year or two, there is no fixed changeover date yet, and the Essential Eight work you have already done still counts. If you are partway through an Essential Eight assessment, keep going.
This post covers what ASD Essentials is, what has actually changed, when the Essential Eight is likely to retire, and what a business should do now.
ASD Essentials is a new cyber security framework from the Australian Signals Directorate, released after a public consultation that ran through the middle of 2026. ASD describes it as an evolution of the Essential Eight rather than a clean break.
The first release is organised into three areas: enterprise IT, which is the direct successor to the Essential Eight and covers standard corporate environments; operational technology, aimed at critical infrastructure; and cloud, for organisations running on software-as-a-service and platform-as-a-service. It also adds guidance on AI-enabled systems and asks organisations to define cyber security accountability at the executive and board level. More chapters are expected over time.
The biggest change is how you measure and report your position. Under the Essential Eight, an organisation is rated on a single ladder from Maturity Level Zero to Three. ASD Essentials drops that single score. Instead you report area by area, for example identity services or internet-facing systems, with your posture shown as effectiveness ratings backed by evidence such as independent testing.
Two other shifts matter. The first is outcomes, not prescribed controls: the Essential Eight lists specific mitigations, while ASD Essentials sets out the security outcome to achieve and leaves you to decide how, though its examples are still concrete, such as phishing-resistant multi-factor authentication. The second is a clear order of priority: ASD tells organisations to secure identity services and the internet-facing edge devices that connect networks to the internet first, ahead of business systems and staff laptops. The reasoning is simple. If those are weak, an attacker is inside before the rest matters.
There is no fixed date, and this is the part worth being clear about. ASD has said the timeframe for any regulatory transition is still being worked out with government policy agencies, over the next year or two. In the meantime the Essential Eight stays published alongside ASD Essentials, and government agencies will be assessed against both next year. Industry commentary points to the Essential Eight beginning to wind down around mid-2027 and being retired around a year after that, but ASD treats those as targets, not commitments.
For a business, the practical position today is straightforward: keep meeting your existing obligations. Nothing forces you to reassess under ASD Essentials yet, and no customer or regulator has a basis to demand it while the transition timeframe is unsettled.
Yes. ASD has said there is no wasted investment for organisations aligned with the Essential Eight, because existing control maturity carries across to the new framework. One caveat from ASD's own guidance: check your controls against ASD Essentials rather than assume they are equivalent. The control you implemented to reach a maturity level is a good starting point, but the new framework asks a slightly different question, about the outcome and the evidence, so some mapping work is sensible.
For most Australian organisations, the sensible steps are the same ones that were worth doing anyway. Keep your Essential Eight work on track, because it remains the live standard and it carries over. Put identity and edge devices first, which is where ASD now says to start and where most real attacks begin. Read the transition guide ASD released alongside the framework, and take up the workshops it is running. And decide who owns cyber security at the top, since ASD Essentials expects defined executive and board accountability.
If you would like a current read on where you stand, an Essential Eight assessment gives you a control-by-control picture and a costed plan, and we map the result so it carries cleanly into ASD Essentials as the transition lands. For a quick self-check first, the free Essential Eight quick check takes a few minutes.
No. ASD launched it on 15 October 2026, but the regulatory transition timeframe is still being decided. Keep meeting your existing obligations until your regulator says otherwise.
Eventually, but not yet. The Essential Eight stays published alongside ASD Essentials during the transition, which ASD expects to run over the next year or two. Government agencies will be assessed against both next year.
Yes. The single Maturity Level Zero to Three rating is gone. ASD Essentials has you report area by area, with posture shown as evidence-backed effectiveness ratings rather than one number.
Not right now. Existing Essential Eight work carries over to ASD Essentials. ASD does recommend checking your controls against the new framework rather than assuming they are equivalent, which is a mapping exercise, not a fresh start.
Secure identity services and internet-facing edge devices. That is where ASD now tells organisations to start, and where most attacks begin.
Ben Jones is Cyber Security Practice Lead at Coder Trove. Our cyber security practice runs Essential Eight assessments, penetration testing and virtual CISO engagements for Australian organisations. An overview is on the cyber security practice page.