The Australian Signals Directorate launched ASD Essentials on 15 October 2026 as an evolution of the Essential Eight. Organisations no longer pick a target maturity level. Each action is rated by whether it works. ASD says Essential Eight maturity ratings do not automatically translate, so existing evidence becomes the starting point for a gap analysis.
Key takeaways
- ASD launched three chapters: enterprise IT, operational technology and cloud.
- Maturity levels are replaced by four effectiveness ratings per action.
- Essential Eight ratings do not automatically translate into the new ratings.
- Keep meeting current regulatory and contractual Essential Eight obligations.
What did ASD publish?
According to ASD’s release, the Essentials series has three chapters. Essentials for enterprise IT is the evolution of the Essential Eight. Essentials for operational technology supports critical infrastructure operators. Essentials for cloud covers organisations whose technology is delivered entirely through SaaS and PaaS.
The companion guide, Transitioning from the Essential Eight, says every Essential Eight strategy maps to at least one principle in the enterprise IT chapter. Actions are now rated not assessed, not effective, partially effective or fully effective. Assets are grouped into domains, and priority phases set the order of work.
ASD has not published an end date for the Essential Eight. Its release says both frameworks stay on cyber.gov.au during the transition period.
What does this mean in plain language?
The Essential Eight rated you by maturity level. The Essentials rates each action by whether it works in each part of your environment.
According to the transition guide, organisations at Maturity Level Two can expect many controls to count in the early phases. They should not assume every action will be fully effective in every domain. Common extra work includes the new Governance and culture domain, wider logging and response, and evidence that a control keeps working over time.
Where does Essentials for cloud fit?
The Essentials for cloud chapter is for organisations that run no servers of their own. ASD says parts of the enterprise guidance describe work a SaaS or PaaS provider now performs. The chapter instead focuses on identity and data, configuration and integrations, and provider assurance.
Each action carries a marker: Customer, Supplied or Provider-inherited. ASD notes that a supplied capability left at an insecure default is not yet effective. Phase 1 covers boundary services and identity services.
Why does it matter for Australian organisations?
ASD names Commonwealth entities, critical infrastructure operators and large organisations as the audience. Its release adds that until regulators communicate changes, organisations should continue to meet their current regulatory obligations. Suppliers asked for an Essential Eight maturity level in a contract still owe that answer.
Sorami’s view
This section is opinion. It is our reading of the ASD documents for buyers, not a statement from ASD.
Do not throw away Maturity Level Two work, and do not start new work only to chase a level ASD has superseded.
Start with a gap analysis of your current evidence against the Phase 1 domains. That shows which controls already count and where Governance and culture or logging needs work. For a SaaS-only business, read the cloud chapter first, because it removes server work you cannot evidence.
What to do now
- Record your current Essential Eight results, exceptions and planned uplift.
- Decide whether the enterprise IT or cloud chapter matches what you run.
- Scope the Phase 1 domains and map existing evidence to each action.
- Classify each action as addressed, partially addressed or not addressed.
- Keep any Essential Eight reporting a regulator or contract still requires.
If you need your existing evidence mapped before you spend more, see our Essential Eight assessment, or contact us to discuss scope.
Related guides
- Essential Eight ML2 for AWS and Azure workloads
- What the September 2026 ISM requires for AI agents
- ASD Cyber Action Year 2026: the five critical actions
- Every Sorami article is in the guides index.
Sources
- Australian Signals Directorate, ASD Essentials: evolving our approach to cyber security resilience (15 October 2026)
- ASD’s ACSC, Transitioning from the Essential Eight (15 October 2026)
- ASD’s ACSC, Essentials for cloud (15 October 2026)
- ASD’s ACSC, Asset scoping guide for cloud (15 October 2026)
Facts on this page were checked against these sources on 16 October 2026. We update the page when the source changes.