ASD Essentials tracker

ASD Essentials series: the Essential Eight is being replaced. Here is what is confirmed.

The ASD Essentials series was published on 15 October 2026, with chapters for enterprise IT, cloud and operational technology. There is still no official changeover date. This page tracks what ASD has confirmed, what is still open, and what it means for an Australian business.

Every ASD statement here links to the publication it came from. When ASD publishes something new, it goes in the update log at the bottom of the page.

Book a transition gap analysis Check your E8 work 07 3114 2808

Three chapters live since 15 October 2026
No changeover date set yet
Essential Eight obligations still apply

Reviewed by Blake Bath, General Manager, on 31 October 2026.

Two people at an office table reviewing a printed document covered in coloured sticky notes, with a laptop showing a checklist and a city view through the windows. — **Changeover date**Not set. ASD says it will advise in due course.

Confirmed and open

Five things ASD has confirmed. One it has not.

Checked against ASD's own publications on 30 October 2026. Anything from interviews or commentary is labelled as such.

Three chapters are live

ASD published Essentials for enterprise IT, Essentials for cloud and Essentials for operational technology on 15 October 2026, with overview, transition, assessment and planning guides alongside them. AI is covered by a separate considerations publication rather than its own chapter.

Enterprise IT builds directly on the Essential Eight
Pick the chapter that matches what you run
Read the transition guide if you have E8 work in place

Gap check

Where your Essential Eight work lands.

Tick what you have. You get ASD's mapping to Essentials principles, what ASD says may need strengthening, and the new areas every business has to plan for. Copy the full list for your IT provider or board.

Tick the Essential Eight strategies you have in place today. The result uses ASD's own transition mapping to show where that work lands in the Essentials and what ASD says may need strengthening.

Which strategies do you have in place?

Your last Essential Eight assessment

Your starting point

3of 7 strategy groups carry forward

6 Essentials principles get a head start. 6 new areas need planning either way.

ASD says organisations at Maturity Level One should expect a greater share of actions to need more work.

Application control: not in placeMaps to Trustworthy software, Secure configuration management
Restrict administrative privileges: not in placeMaps to Identity, credential and access management, Least privilege access, Secure administration, Network segmentation and segregation
Restrict Microsoft Office macros: not in placeMaps to Trustworthy software, Secure configuration management
User application hardening: not in placeMaps to Secure configuration management, Content filtering

Book a transition gap analysis

Strategy by strategy

Every Essential Eight strategy maps to at least one principle.

This is ASD's table from Transitioning from the Essential Eight. The work you have done counts as evidence. It is assessed differently.

Essential Eight strategy	Essentials principles it maps to
Application control	Trustworthy software; Secure configuration management
Patch applications	Vulnerability management; Asset identification; Legacy system management
Patch operating systems	Vulnerability management; Asset identification; Legacy system management
Multi-factor authentication	Identity, credential and access management
Restrict administrative privileges	Identity, credential and access management; Least privilege access; Secure administration; Network segmentation and segregation
Restrict Microsoft Office macros	Trustworthy software; Secure configuration management
User application hardening	Secure configuration management; Content filtering
Regular backups	Regular and proven backups; Least privilege access

ASD says controls may still need strengthening for three reasons: the principle is broader than the old strategy, the control has to work in each domain, and the evidence has to show it keeps working, not just that it was deployed.

What is new

Six areas with no Essential Eight equivalent.

These were never assessed under the Essential Eight. Every business moving to the Essentials needs a plan for them.

Governance and cultureExecutive accountability, cyber security resourcing, risk assurance, supplier assurance, AI accountability and legacy system management.
Wider asset identificationInfrastructure, operating systems, applications, identities, credentials and data, each tracked as distinct assets.
Content filteringBlocking outbound connections to known malicious or untrusted destinations.
Cyber security awareness trainingA principle in its own right, not a side note.
Cyber supply chain securityChecking the integrity and source of software, components and updates before use.
Visibility and responseCentral logging, detection, incident coordination, tested response and learning after incidents, across every phase.

Our read

What this means for a business of 10 to 200 people.

Most of the businesses we look after run Microsoft 365, managed laptops and a handful of cloud apps. The questions they get from insurers, customers and tenders still use Essential Eight terms, and ASD says to keep meeting those obligations.

So we are not asking clients to relabel anything. We are using ASD's phase order to decide what to do next: protect sign-ins and internet-facing services first, then admin access and the systems the business cannot run without, then everything else.

The new areas are where smaller businesses will feel the change. A written list of who is accountable, a supplier register, central logging that someone actually watches, and staff training were optional extras under the Essential Eight. Under the Essentials they are principles.

Asked for Essential Eight
Keep reporting in Essential Eight terms to insurers, customers and tenders that ask for it. ASD says those obligations continue.
Need a certificate
SMB1001 is a separate standard from Dynamic Standards International and is not changed by this. It gives you something to show.
SMB1001 certification
Want to get ahead
Start with phase 1: phishing-resistant MFA, tidy accounts and locked-down internet-facing services.
Identity and access

How we do it ourselves

Getting Real Bytes ready for the same scrutiny.

We are preparing our own SMB1001 Diamond audit. Much of that work lines up with Essentials principles, which is why we recommend it.

Asset registers for hardware and software
We keep separate registers for hardware and for the SaaS we use. That is the start of the wider Asset identification principle.
Application control on our own computers
Only approved software runs on Real Bytes computers. That is the Trustworthy software principle in practice.
Documented MFA exceptions
A few supplier portals offer nothing stronger than basic MFA. Each is written down as an exception and rated for supplier risk, the way ASD asks exceptions to be handled.
Detection on our devices
Managed detection and response runs on Real Bytes devices, with a person ready to act on an alert. That feeds the Visibility and response domain.

Mistakes to avoid

Five ways transitions go wrong.

These are drawn from ASD's own list of common transition pitfalls.

Treating phases as maturity levelsPhase 1 done does not mean Maturity Level One. Phases set the order of work only.
Claiming equivalence instead of assessingA control that met an Essential Eight requirement is evidence. It is not an automatic rating.
Assessing the business, not the domainThe same control can be fully effective in one domain and partial in another.
Leaving governance and logging until lastGovernance and culture, and Visibility and response, apply from phase 1.
Reusing stale evidenceOld reports and expired exceptions only count if they still describe how things work today.

Update log

What changed, and when.

Newest first. We add an entry whenever ASD publishes something that changes the advice on this page.

Date	What happened	Source
30 Oct 2026	Page rebuilt and every claim checked against ASD's publications. ASD's FAQ still says transition timeframes will be advised in due course.	ASD FAQ
15 Oct 2026	ASD publishes the Essentials series: chapters for enterprise IT, cloud and operational technology, plus overview, transition, assessment and implementation planning guides.	cyber.gov.au
12 Jul 2026	Public consultation on the Essentials closes.	ASD FAQ
24 Jun 2026	ACSC's Chris Horlyck tells iTnews ASD will probably start deprecating the Essential Eight in about 12 months and retire it at 24 months. Interview only.	iTnews
15 Jun 2026	ASD opens consultation on evolving the Essential Eight into the Essentials series.	ASD FAQ

How we run a transition

ASD's six-step pathway, done with you.

This follows the sequence in ASD's transition guide. We bill at $195 per hour ex GST and scope the hours before we start.

Step 1Establish the baseline
Collect your existing Essential Eight evidence, exceptions and risk records, and check what is still current.
Step 2Scope phase 1 domains
Work out which of your systems sit in Boundary services and Identity services.
Step 3Gap analysis
Rate each phase 1 action against what you have, and list what needs more work or new evidence.
Step 4Plan the work
A costed plan for phase 1, with governance and logging started at the same time.
Step 5Deliver and measure
Make the changes, then collect evidence that they keep working, not just that they were deployed.
Step 6Move through the phases
Repeat for phase 2 and phase 3, reporting untouched domains as not assessed.

Related work

Where the Essentials meet day-to-day work.

The services that cover the principles most businesses need first.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about the Essentials.

When does the Essential Eight stop being used?

ASD has not set a date. Its Essentials FAQ says it is talking with regulators about timeframes and will advise in due course. In a June 2026 iTnews interview, ACSC's Chris Horlyck said ASD would probably start deprecating the Essential Eight in about 12 months and retire it at 24 months. Treat that as an interview estimate, not published guidance.

Should we stop our Essential Eight uplift?

No. ASD says it does not recommend slowing or stopping uplift programs that improve your security. Keep going, and check how the work lines up with the Essentials as you plan the next steps. Keep meeting any contract, insurer or regulator requirement that asks for Essential Eight.

Does our Maturity Level carry over?

Not as a rating. ASD says Essential Eight maturity levels do not automatically translate into Essentials ratings, because the two measure different things. Your existing controls and evidence are the starting point for a gap analysis, and current evidence can be reused.

Is the Essentials series meant for small businesses?

ASD says it is written primarily for Commonwealth entities, critical infrastructure and large organisations. Smaller businesses can use it where relevant, and ASD publishes separate guidance for small businesses. For most of our clients, the practical steps are the same either way: protect sign-ins and internet-facing services first.

What replaces maturity levels?

Priority phases, which set the order to work through the technical domains, and a four-tier rating for each action: not assessed, not effective, partially effective and fully effective. ASD is clear that phases are a sequence, not a maturity or compliance rating.

Does this change SMB1001?

SMB1001 is a separate standard published by Dynamic Standards International, not by ASD. The Essentials release does not change it. SMB1001 remains a certifiable option for smaller businesses that need something to show customers and insurers.

Which chapter should we start with?

The one that matches what you run. ASD says enterprise IT is the starting point if you run on-premises, hybrid or infrastructure-as-a-service, and cloud is the starting point if you mostly use platform or software as a service. Operational technology covers industrial and control systems. Most of our clients run Microsoft 365 with managed laptops, so they look at enterprise IT and cloud together.

Next step

Want your Essential Eight work mapped across?

Send us your last assessment or a list of what you have in place. We will map it to the ASD Essentials, show you the phase 1 gaps, and tell you what is worth doing now.

Book a transition gap analysis 07 3114 2808