All year we have been saying the Essential Eight was going. We could not tell you what replaced it, or when. We said so every time we wrote about it.

That changed on Thursday. On 15 October 2026 the Australian Signals Directorate published ASD Essentials, the successor to the Essential Eight. It is real, it is on cyber.gov.au, and it is a bigger change than the name suggests. [1][2]

So this is the follow-up to everything we have written while the replacement was still a rumour. The caveat is closed. Here is what was actually published, with the focus on the chapter that affects the most organisations, enterprise IT, and a look at where cloud and operational technology sit alongside it.

What ASD actually published

ASD Essentials is not a tweak to the Essential Eight. It is a chaptered framework that keeps the same job, raising a baseline of cyber resilience, but changes almost everything about how you measure it. It stays aligned to the Information Security Manual, and it followed consultation with industry, government and critical infrastructure. [1][3]

It comes in three chapters, each for a different kind of environment.

Enterprise IT is the direct successor to the Essential Eight, and the one most organisations start with. It carries 28 principles and 58 actions. [3][4]

Cloud is for organisations whose technology is delivered through software and platform services rather than kit they run themselves. It carries 78 actions, and each one is marked as the customer’s responsibility, a provider capability the customer has to switch on, or the provider’s own responsibility. [3][4]

Operational technology is for critical infrastructure owners and operators. It carries 61 actions and its own order of priority, and ASD notes that most organisations will eventually need both this chapter and enterprise IT. [3][5]

No chapter is mandatory, and there is no required order for working through them. Where a contract or a regulator ties you to a particular environment, you start with that chapter, because an obligation sets a floor rather than a sequence. Separate guidance covers AI across all three. [3][5]

The maturity ladder is gone

This is the change that matters most.

Under the Essential Eight you picked a target maturity level, usually Maturity Level Two for Commonwealth entities and many critical infrastructure operators, and worked towards it. That ladder is gone. You no longer select a target level at all. [3]

In its place, each action is rated in every domain it applies to, as not assessed, not effective, partially effective or fully effective. A principle takes the weakest rating of any of its actions, so one weak control drags its whole principle down rather than being averaged away. ASD calls this the weakest link rule. Each principle rating is then scored, not effective zero, partially effective a half, fully effective one, and the domain percentage is the sum of the principle scores divided by the number of applicable principles. [7]

Worked example, illustrative: how action, principle and domain scores roll up on common Essential Eight controls. Ratings are hypothetical to show the mechanics.

One rule in the assessment guide does more work than anything else, because it closes the most common way of looking better than you are. Deployment is not effectiveness. ASD says a control that is configured or enabled does not prove the outcome is achieved, and a control that covers only part of the domain only partially satisfies the action. You are rated on whether the outcome holds across every asset in scope, not on whether a tool is installed. [7]

Read that twice. There is no ladder left to stand on, and no credit for a half-deployed product. You are rated on whether the control actually works, everywhere it is supposed to, proven by evidence. That is the whole philosophy of the change.

Deployment is not effectiveness. A control that is configured but not achieving the outcome does not count. There is no ladder left to stand on.

Eight domains in place of eight strategies

The old eight mitigation strategies are replaced by eight domains, and they are shared across all three chapters. Two are capability domains that run through everything: governance and culture, and visibility and response. The other six are technical: boundary services, identity services, critical processes and services, privileged environments, business systems, and user devices. Each action is rated in the domains it maps to. [3][5]

That structure tells you something about ASD’s intent. Governance, culture and the ability to see and respond are no longer assumed or bolted on at the end. They are first-class domains that every action is scored against, which is a long way from a checklist of eight technical controls.

Priority phases, which are not maturity levels wearing a disguise

ASD Essentials also sets three priority phases. It is important to read these correctly, because it is easy to mistake them for the old maturity ladder renamed. They are not. They are a sequencing mechanism, the order in which to do the work, not a rating you achieve. [3]

ASD has detailed the first phase. It focuses on boundary services, identity services, governance and culture, and visibility and response, the places most intrusions begin and the capabilities that let you govern and detect at all. The later phases carry the remaining technical domains, the critical processes, the privileged environments, and then the business systems and user devices, in sequence. The point is the order of work, not a score to reach. [3]

Risk-based, evidence-based, and board-accountable

Three more shifts sit underneath the scoring.

The fixed patch and update deadlines that the Essential Eight set for you become risk-based timeframes that you set and justify yourself. That is more flexible and more demanding at once, because you now have to defend your own numbers rather than point at ASD’s.

Evidence moves to the centre. The old question was whether a control was turned on. The new one is whether it works, across every asset, with something to show for it. Deployment is not effectiveness, as the scoring rule says in as many words.

And accountability moves up. The framework expects formal board-level ownership of cyber security, and of AI, rather than leaving it a technical matter below the executive line. That is consistent with where the rest of the regulatory world has been heading, from APRA’s CPS 230 and CPS 234 to the critical infrastructure regime.

Does your Essential Eight work carry across?

This is the first question most people ask, and the answer is careful. Not automatically.

ASD has said plainly that Essential Eight ratings do not automatically convert into effectiveness outcomes. A Maturity Level Two does not become a set of fully effective ratings, and nor does a Maturity Level Three. Much of the work you have already done will count towards the early phases, especially if you were at ML2, but it has to be reassessed against the new ratings rather than carried over. In practice that means a gap analysis, not a copy and paste. [3][5]

The same requirement, old model to new, through the ISM. The maturity level where each control is introduced and its ISM number are from ASD’s published mapping; the Essentials action rating and its 1 / 0.5 / 0 score are an illustrative worked example. A maturity level does not convert into an effectiveness rating.

Assessment is self-directed. ASD says you may engage an independent assessor, but it is not required, so the responsibility for an honest rating sits with you. [3]

The dates, and the ones that are not set

Here is the part everyone wants pinned down, and here is where precision matters most.

ASD has not published any transition dates. The Essential Eight is not being switched off. Both frameworks, with their implementation guidance, stay on cyber.gov.au through the transition, and ASD has said it will advise on expectations for transitioning in due course. Government agencies are reported to be assessed against both frameworks next year, and the head of the Cyber Security Centre has described a transition running roughly one to two years. [1][3][5]

Be careful with the numbers that have circulated all year. The mid-2027 deprecation and mid-2028 retirement dates that appear in a lot of commentary, our own earlier writing included with a caveat, are not published ASD dates. They trace back to a June 2026 interview, not to any ASD publication, and as of this week they are still not official. If you are building a plan or a business case, do not anchor it to a date ASD has not set. [3]

One more point that matters for day-to-day decisions. Contracts, procurement panels, insurers and the Protective Security Policy Framework that name the Essential Eight still name the Essential Eight. Nothing about those changed on 15 October. Where an obligation names the old framework, the old framework is still what you have to meet, until that obligation is formally changed. [6]

Where cloud and OT fit

Most of the above is the enterprise IT chapter, because it touches the most organisations and is the direct heir to the Essential Eight. The other two chapters matter the moment your environment is not just corporate IT.

If your systems run largely on software and platform services, the cloud chapter is where the detail is, and its shared-responsibility marking is the useful part. Each of its 78 actions is tagged as yours, your provider’s, or a provider capability you have to enable, which cuts through the perennial argument about who was supposed to do what. [3][4]

If you own or operate critical infrastructure, the OT chapter carries its own 61 actions and its own priority order, and you will most likely need it alongside enterprise IT rather than instead of it. The two are designed to sit together. [3][5]

What to do now

None of this needs panic, and none of it needs a new date on the wall. It needs an honest reassessment, on your own timeline, before someone else sets one for you.

Find out where you actually stand on the Essential Eight today, from evidence rather than memory. Work out which of your controls carry forward and which do not. Understand that the thing being rated has changed, from whether a control is switched on to whether it demonstrably works, everywhere, and that a plan no longer counts for anything. Keep meeting the obligations that still name the Essential Eight while you move. And treat the move as a continuous operation, not a one-off project, because the new model rewards a position you can prove at any time, not a score you reached once.

Where BayRisk lands on this

When we set up BayRisk, it was on one premise. You manage a risk operation, you do not tick compliance boxes. That is what RiskOps means, and it is what we have been saying since we started. The Essentials is ASD saying the same thing. A score you reach once gives way to a position you prove on evidence, at any time. What we have been extolling is now what ASD says you should move to.

Make no mistake. The Essentials Series is a lot more work than the Essential Eight. Eight strategies become dozens of actions, rated across domains. A plan no longer counts. A tool that is installed but not configured no longer counts. Every control has to work, everywhere, with the evidence to show it. That is a standing operation, not a project you finish.

Every engagement starts with your business goals, not the control list. We set out what the business is trying to achieve, then map the Essentials Principles that each goal depends on, so the strategy to reach the goal is built with those Principles in mind from the start. The remediation plan follows the same logic. It is prioritised by where a weak Principle is putting a business goal at risk, not by where a generic checklist says the gap is biggest.

This is the point to bring in help. It is time to engage the team to support the transition. If you want to know where your Essential Eight position really stands under the new model, and which fixes protect the goals that matter most, that is a short conversation: hello@bayrisk.com.au.

References

  1. Australian Signals Directorate, “ASD Essentials: evolving our approach to cyber security resilience”, 15 October 2026. https://www.asd.gov.au/news/2026-10-15-asd-essentials-evolving-our-approach-cyber-security-resilience
  2. Australian Signals Directorate, ASD Essentials, cyber.gov.au. https://www.cyber.gov.au/essentials
  3. Australian Signals Directorate, ASD Essentials for enterprise IT, cyber.gov.au. https://www.cyber.gov.au/essentials/essentials-for-enterprise-it
  4. Cyber Daily, “Essential Eight evolved: Aussie cyber agency launches ASD Essentials”, 15 October 2026. https://www.cyberdaily.au/security/14304-essential-eight-evolved-aussie-cyber-agency-launches-asd-essentials
  5. IDM, “Essential Eight out, ASD Essentials in”, 16 October 2026. https://idm.net.au/article/0015834-essential-eight-out-asd-essentials
  6. Compliance365, “ASD Essentials published: what changed (October 2026)”. https://www.compliance365.com.au/blog/asd-essentials-published/
  7. Australian Signals Directorate, Assessment process guide, cyber.gov.au, published 15 October 2026. https://www.cyber.gov.au/publication/assessment-process-guide