ASD Essentials: straight answers for Australia and New Zealand

The Australian Signals Directorate launched ASD Essentials on 15 October 2026 as the evolution of the Essential Eight. The shift is from ticking a maturity box to showing evidence. Here is what has changed, what has not, and what to do next.

Published by Insicon Cyber. Last updated 16 October 2026.

In brief

• ASD Essentials launched on 15 October 2026 with three chapters: enterprise IT, OT and cloud.
• Maturity levels are replaced by a four-tier rating of each action: not assessed, not effective, partially effective, fully effective.
• The weakest link governs, and no evidence means not assessed. Assumption no longer counts.
• Keep your Essential Eight work going. No formal retirement date has been published.
• This is an Australian publication. New Zealand organisations should keep to NZISM and watch for NCSC guidance.

What is ASD Essentials?

ASD Essentials is the Australian Signals Directorate's new cyber security framework, launched on 15 October 2026 as the evolution of the Essential Eight. It organises cyber security into principles, actions and eight domains, and is published as chapters for enterprise IT, operational technology (OT) and cloud.

Principles carry identifiers from the Information Security Manual (for example GOV-01), each principle is delivered through actions, and each action sits in a domain. A set of supporting guides covers reading the framework, transitioning from the Essential Eight, implementation planning, assessment, evidence and asset scoping.

Does ASD Essentials replace the Essential Eight?

Over time, yes. ASD describes Essentials as the evolution of the Essential Eight. Secondary reporting says ASD expects to begin deprecating the Essential Eight about 12 months after launch and retire it about 24 months after, but no formal retirement date has been published. Keep your Essential Eight work and reporting in place until your regulator or contract says otherwise.

• Every Essential Eight strategy maps to at least one Essentials principle.
• Essential Eight maturity ratings do not convert into Essentials ratings.
• You can reuse current evidence.
• ASD's transition guidance says not to start new work solely to hit a superseded Essential Eight target, unless a regulator or contract requires it.

Why did ASD change the Essential Eight?

The Essential Eight predates widespread cloud use, AI is increasing the scale and speed of attacks, and highly capable adversaries are now a credible threat to a broader range of organisations. The Australian National Audit Office also flagged low cyber resilience in 2023.

A single maturity level also hid too much. A score of “Maturity Level 2” said little about which controls were working, how consistently, or on what evidence. Essentials asks for that detail.

Which ASD Essentials chapters exist?

Three chapters have been released: Essentials for enterprise IT (the evolution of the Essential Eight), Essentials for OT, and Essentials for cloud, which is for organisations that are entirely software as a service (SaaS) and platform as a service (PaaS). ASD has said further chapters will follow.

ASD also published an overview, Which chapter should I start with, to help organisations choose. The cloud chapter marks each responsibility as Customer, Supplied or Provider, and asks you to keep a register of the responsibilities you inherit and those you retain.

What are the ASD Essentials domains and priority phases?

There are eight domains: six technical (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) and two capability domains (Governance and culture, Visibility and response) that apply across every phase.

The priority phases are a sequence for doing the work, not maturity levels.

In the OT chapter, user devices are excluded because all OT devices are treated as privileged. The cloud chapter uses the same eight domains.

How is ASD Essentials assessed?

Maturity levels are replaced by a four-tier rating for each action in each domain: not assessed, not effective, partially effective or fully effective. Ratings consider coverage, consistency, currency and evidence quality. The weakest rating governs, and insufficient evidence means an action is not assessed.

• Where several implementation guidance points apply, the lowest rating governs.
• Domain scores count not effective as 0, partially effective as 0.5 and fully effective as 1, shown as a percentage of the principles.
• Evidence is graded on a pyramid: excellent, good, fair, poor.
• Sampling is allowed if it is documented, and active testing needs an approved plan first.
• Results need a summary view and a detailed view. A radar chart alone is not enough.
• ASD's assessment guide is written for self-assessment. ASD has said guidance for assessing suppliers will follow.

What does ASD Essentials rate as not effective?

ASD's implementation guidance is blunt in several places. Some common practices are rated not effective outright, and some caps apply however good the rest looks.

• SMS, voice or push-only multi-factor authentication: not effective.
• Standing privileged access (break-glass accounts excepted): not effective.
• Shared local administrator credentials: not effective.
• No secret scanning: not effective.
• Backups that share the production identity platform: capped at partially effective.
• An incident response plan that has not been tested: partially effective at best.
• Segmentation must be technically enforced and validated, not just documented.

What is the difference between the Essential Eight and ASD Essentials?

The Essential Eight is eight mitigation strategies scored by maturity level. ASD Essentials is a broader set of principles, actions and domains scored by evidence-based effectiveness ratings, with governance, visibility and response, and cloud built in.

Does ASD Essentials apply in New Zealand?

ASD Essentials is an Australian publication and is not a New Zealand requirement. New Zealand government agencies work to the New Zealand Information Security Manual (NZISM), published by the NCSC, part of the GCSB. As at 16 October 2026 we have not found a statement from the NCSC on ASD Essentials.

ASD's material is published under a Creative Commons Attribution 4.0 licence, so New Zealand organisations can use it as a reference. ASD's evidence guide cross-references the Australian Information Security Manual, the Essential Eight, NIST CSF 2.0, NIST SP 800-171 Rev 3 and AEMO's AESCSF v2. It does not list ISO 27001 or NZISM.

What should Australian and New Zealand organisations do now?

Keep current Essential Eight work going, baseline your evidence against the four-tier rating starting with Boundary services and Identity services, choose the right chapter, and keep evidence you can show. New Zealand organisations should keep to NZISM and watch for NCSC guidance.

1. Keep Essential Eight reporting wherever a regulator or contract requires it.
2. Pick the chapter that fits: enterprise IT, OT, or cloud if you are entirely SaaS and PaaS.
3. Scope your assets using ASD's asset scoping guides for enterprise IT and for cloud.
4. Rate each action honestly. If you cannot show evidence, the rating is not assessed.
5. Start with Boundary services and Identity services, then move through the phases.
6. Test what you rely on, especially incident response plans and restores.

What should boards and executives ask about ASD Essentials?

Ask for the evidence behind every rating, and ask when it was last tested. Essentials makes executive accountability explicit, so the answer cannot stop at “IT has it covered”.

• What evidence sits behind each rating, and how good is it?
• Which controls are we assuming a supplier or cloud provider handles, and how do we know?
• When did we last test our incident response plan and restore from backup?
• Who is accountable at executive level, and are they resourced to deliver?

Sources

Checked 16 October 2026. ASD publications are © Commonwealth of Australia 2026 and licensed under Creative Commons Attribution 4.0.

• ASD, ASD Essentials: evolving our approach to cyber security resilience, 15 October 2026: asd.gov.au
• ASD Essentials hub (enterprise IT, OT and cloud chapters, transition, implementation planning, assessment and evidence guides, senior executives paper): cyber.gov.au/essentials
• ASD, Essentials for cloud: cyber.gov.au/publication/essentials-for-cloud
• Cyber Daily, Essential Eight evolved: Aussie cyber agency launches ASD Essentials: cyberdaily.au
• iTnews, ASD to retire Essential Eight cyber security framework within next two years: itnews.com.au
• Information Age (ACS), ASD overhauls Essential Eight cybersecurity guidance: ia.acs.org.au
• GCSB, National Cyber Security Centre (New Zealand): gcsb.govt.nz/our-work/ncsc

General information only, not legal or professional advice. Insicon Pty Ltd (ABN 22 161 181 764), operating as Insicon Cyber.