ASD Essentials and the Essential Eight: what’s changed

 By Muhammad Islam, Principal Security Architect, The Missing Link
Adapted from Muhammad’s original article, published on LinkedIn on 15 October 2026. 
The Australian Signals Directorate (ASD) has launched ASD Essentials, a broader and more outcome-focused approach to cyber resilience that builds on the Essential Eight. I’ve spent a lot of time helping organisations assess and uplift their Essential Eight maturity, so I wanted to understand what had really changed. My first reaction was that this goes well beyond adding a few more controls to the Essential Eight. ASD has changed the way it wants organisations to think about cyber resilience, and I think that’s a good thing. 

Why did the Essential Eight need to evolve?

The Essential Eight needed to evolve because modern technology environments have outgrown a fixed list of controls. The Essential Eight succeeded because it gave organisations clear priorities: patch applications and operating systems, use multi-factor authentication, restrict administrative privileges, control applications, harden user applications, restrict macros and maintain backups. It was simple to explain, achievable to implement and grounded in ASD’s understanding of real adversary behaviour.

Technology has moved on, though. Most organisations no longer run a tidy collection of corporate endpoints and servers. They’re working with software as a service (SaaS), platform as a service (PaaS), cloud platforms, operational technology (OT), third-party services, complex identity ecosystems, AI systems, non-human identities and legacy platforms that can’t simply be patched every 48 hours. A fixed list of controls can’t translate cleanly across all of that. My read is that ASD Essentials is a response to this, moving towards a threat-informed, principles-based, and outcome-focused model. ASD’s Essentials reading guide is a good place to start if you want the source material.

What is ASD Essentials and how is it structured?

ASD Essentials is built around three concepts:

• • Principles: the security outcome you’re trying to achieve

  • Actions: what needs to be done to achieve it

  • Domains: where each action needs to apply

It may sound like a terminology change, and it changes the question being asked. The Essential Eight was largely focused on technology and individual controls. The new approach asks whether you’re achieving the intended outcome across the parts of your environment that matter. That takes more judgement, a better understanding of risk, and much stronger evidence.

What are the three ASD Essentials chapters?

 ASD Essentials has three chapters, each written for a different type of technology environment: 

• • Essentials for enterprise IT

  • Essentials for cloud

  • Essentials for operational technology (OT)

Applying the same controls to a corporate Windows environment, a SaaS platform, and an industrial control system never made much sense. The outcomes may be similar, but the way you achieve them can differ a great deal. The structure lets common principles stay in place while implementation reflects the technology and the risk, and ASD describes the Essentials as a series, so more chapters may follow.

What do the enterprise IT domains cover?

The enterprise IT chapter groups systems and assets into eight domains, each covering a part of the environment that shares similar cyber security risks: 

• • Governance and culture

  • Visibility and response

  • Boundary services

  • Identity services

  • Critical processes and services

  • Privileged environments

  • Business systems

  • User devices

The Essential Eight controls are still there, but organisations will also need to consider security risk management, supplier cyber security, legacy systems, AI accountability, security awareness, detection capability, incident coordination and whether controls stay effective over time. To me, this reads as an organisational cyber resilience framework as much as a technical baseline.

How do the ASD Essentials ratings work?

ASD Essentials assesses each action against each domain using four outcome-based ratings, as set out in ASD’s assessment process guide:

• • Not assessed

  • Not effective

  • Partially effective

  • Fully effective

Organisations use Maturity Levels 1 to 3, and those don’t automatically convert under ASD Essentials.

I think this is a real improvement. A technically configured control isn’t necessarily effective, and the new model emphasizes whether the outcome is being achieved. It also makes assessments harder, since confirming a configuration setting is straightforward while judging effectiveness across a domain, backed by evidence and in the context of current threats, needs professional judgement.

What are the ASD Essentials priority phases?

ASD’s priority phases set out the order in which to implement the domains, so effort goes where it reduces the most risk first. For enterprise IT, the first priority is boundary services and identity services, supported from the start by governance and culture and by visibility and response. Critical processes and privileged environments follow, then business systems and user devices.

I read the sequencing as: protect where attackers are most likely to enter, protect the identities they’ll try to compromise, make sure you can see what they’re doing, then progressively harden everything else. It also changes the conversation with executives. Rather than “we need budget because we’re only at ML1.6”, security leaders can talk about the attack paths presenting the greatest risk, the capability being built first, and the risk reduction expected from the investment.

How does ASD Essentials treat AI?

ASD Essentials treats AI systems as assets within the scope of the framework, including models, infrastructure, training data, prompts, outputs, connectors, APIs, and accounts and non-person identities used by AI agents and services. ASD has also published guidance on how AI should be considered within the Essentials. AI systems are treated as assets within the scope of the framework, including models, infrastructure, training data, prompts, outputs, connectors, APIs, and accounts and non-person identities used by AI agents and services.

That last point matters. If an AI agent has an identity, credentials, permissions, and the ability to take actions, those access pathways need to be identified and governed accordingly. AI can help defenders analyse threats and respond faster, but accountability stays with people, which is where I think the industry needs to land.

What do organisations do now?

Keep your Essential Eight program running and start with a transition assessment. ASD will keep both the Essential Eight and the Essentials live during the transition, and has said work already done carries forward, so there’s no need to abandon your Essential Eight program. The effort you’ve put into MFA, patching, application control, privileged access, hardening, backups and logging remains valuable. I wouldn’t assume your current Essential Eight maturity tells you where you stand under ASD Essentials, though.

I’d start with a transition assessment: map your existing controls and evidence to the new principles, actions and domains, then identify what’s genuinely new. If you’d like a baseline of where you currently sit first, our ASD Essential 8 assessment is a good starting point.

For many organisations, the biggest gaps are likely to sit in areas such as:

• • Governance

  • Asset understanding

  • Risk identification

  • Supplier assurance

  • Detection effectiveness

  • Legacy systems

  • AI accountability

  • Evidence that controls are achieving their intended outcomes

Is ASD Essentials just Essential Eight 2.0?

My read is that it’s more than that: ASD has changed the model itself. Cyber security can’t be reduced to a static checklist. Technology, attackers and businesses keep changing, and AI is now reshaping both attack and defence faster than most frameworks can be rewritten. Rather than continuing to add a ninth, tenth or fifteenth control, ASD has changed the model: keep the principles stable, update the actions as threats evolve, apply them differently by environment and measure whether they work.

The Essential Eight gave Australian organisations an excellent foundation. ASD Essentials asks whether that foundation is producing cyber resilience across the whole organisation. For organisations that have spent years chasing a maturity target, that may mean a shift in mindset, and I think it’s the right one.

How The Missing Link can help

At The Missing Link, we’re looking at what this transition means for organisations currently using the Essential Eight, including how existing controls and evidence carry forward, where new gaps appear, and how enterprise IT, cloud, OT and AI environments should be approached under the new model.

If you’re already working towards an Essential Eight maturity level, our ASD Essential 8 as a Service and ASD 8 assessment can show you where you stand today, and our Governance, Risk and Compliance team can help you plan the move to ASD Essentials. To talk through what this means for your cyber security program, get in touch with our team.