ASD swaps Essential Eight maturity levels for phased priorities in new Essentials framework
Australian Signals Directorate has launched ASD Essentials, a principles-based framework that evolves the Essential Eight for IT, OT and cloud. Compliance obligations stay unchanged for now, The Cyber Express reported.
The Watch · Security desk
Organisations work through phased priorities, highest-risk assets first. Guidance is written primarily for Commonwealth entities. Essentials for OT supports infrastructure operators; Essentials for cloud supports SaaS and PaaS users. Compliance: nothing changes for now.
- Who has to decide decision Organisations Work through phased priorities, not maturity levels, directing effort to highest-risk assets first, claim 4
- Who's exposed exposure Commonwealth entities Guidance written primarily for them, critical infrastructure owners and operators, and large organisations, claim 12
- What's now possible capability Infrastructure operators Essentials for OT supports them in protecting OT environments from cyber threats, claim 9
- What's now possible capability SaaS and PaaS organisations Essentials for cloud supports environments delivered entirely through SaaS and PaaS, claim 10
- What it limits constraint Organisations, on compliance Nothing changes for now; keep meeting current obligations until regulators communicate any changes, claim 14
| Who | How | Kind | Claim |
|---|---|---|---|
| Organisations | Work through phased priorities, not maturity levels, directing effort to highest-risk assets first | decision | 4 |
| Commonwealth entities | Guidance written primarily for them, critical infrastructure owners and operators, and large organisations | exposure | 12 |
| Infrastructure operators | Essentials for OT supports them in protecting OT environments from cyber threats | capability | 9 |
| SaaS and PaaS organisations | Essentials for cloud supports environments delivered entirely through SaaS and PaaS | capability | 10 |
| Organisations, on compliance | Nothing changes for now; keep meeting current obligations until regulators communicate any changes | constraint | 14 |
What happened
- Phased priorities replace maturity levels, and organisations will direct effort to their highest-risk assets first.
- The OT chapter supports critical infrastructure operators, and the cloud chapter covers organisations whose environment is delivered entirely through SaaS and PaaS.
- ASD cites its Annual Cyber Threat Report 2024-2025 as evidence that the threats Australian organisations face are growing more sophisticated.
- During the transition both the Essential Eight and ASD Essentials stay on cyber.gov.au, with supporting resources and implementation guidance.
- The guidance is aimed mainly at Commonwealth entities, critical infrastructure owners and operators, and large organisations.
Why it matters
- What it limits constraint Teams carry two frameworks until regulators speak. Mapping work and reporting run in parallel while ASD and regulators settle timing.
- Who has to decide decision Each organisation has to name its critical business functions and systems, because those set the order of work under phased priorities.
- What's now possible capability OT operators now have ASD guidance written for their environment, a gap the source says the Essential Eight was never designed to fill.
The Cyber Express headlines its report that the Essential Eight is being replaced [17]. The text is more measured. The enterprise IT chapter is the direct evolution of the Essential Eight [8], and ASD says the new framework is in line with both its own best-practice advice and the Australian Government Information Security Manual [13]. The report does not include a retirement date for the older document.
What is settled is the unit of measurement. The framework moves away from prescriptive requirements toward principles and actions that help organisations assess whether intended security outcomes are being achieved [5]. It is not tied to specific technologies [3]. That is ASD's answer to technology environments that now span on-premises systems, hybrid cloud and emerging technologies, which a fixed list of controls struggles to cover [21].
A team that reports progress as a maturity level will have to report something else: which functions come first, and whether the outcome was met.
The timing sits with regulators. ASD says it is talking with regulators about how the transition will affect organisations and how long it is expected to take, and that it will set out its expectations later [15]. Until then the Essential Eight stays the working reference.
The Cyber Express suggests security teams read the new chapters now, check how their existing Essential Eight controls line up with the new principles, and work out which of their critical functions and systems would be first in line under a phased priority plan [19]. That is the outlet's advice, not an ASD instruction. The guidance is written mainly for large organisations, but smaller businesses that do not operate at enterprise scale can apply it where relevant [20]. ASD has also made AI-focused guidance available for organisations weighing AI-enabled systems in their environments [11].
This account rests on The Cyber Express's summary of the ASD publication.
What to watch
- Regulator guidance on whether Essential Eight obligations carry over to ASD Essentials, and on what timeframe.
- Any date ASD sets for withdrawing the Essential Eight from cyber.gov.au once the transition period ends.
- Further chapters beyond the first three, since the series is described as launching with enterprise IT, OT and cloud.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Australian Signals Directorate has launched ASD Essentials, a new cyber security framework that evolves the Essential Eight into broader guidance covering enterprise IT, operational technology and cloud environments.
- [2]
ASD points to its Annual Cyber Threat Report 2024-2025, which shows Australian organisations facing increasingly sophisticated threats.
- [3]
The framework takes a threat-informed, principles-based approach that gives organisations flexibility to achieve security outcomes without being tied to specific technologies.
- [4]
Phased priorities replace maturity levels: instead of climbing maturity levels, organisations will work through phased priorities, directing effort to their highest-risk assets first.
- [5]
The framework moves away from prescriptive security requirements toward principles and actions that help organisations assess whether intended security outcomes are actually being achieved.
- [6]
The framework introduces cyber security principles, actions and domains, focusing uplift efforts on critical business functions and systems.
- [7]
The series launches with three chapters: Essentials for enterprise IT, Essentials for operational technology (OT), and Essentials for cloud.
- [8]
Essentials for enterprise IT is the direct evolution of the Essential Eight.
- [9]
Essentials for OT supports Australian critical infrastructure operators protecting their operational technology environments from cyber threats.
- [10]
Essentials for cloud supports organisations whose technology environment is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS).
- [11]
ASD has also made AI-focused guidance available, helping organisations consider AI-enabled systems within their technology environments.
- [12]
The guidance is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations.
- [13]
ASD says the framework remains consistent with its best-practice advice and the Australian Government Information Security Manual.
- [14]
For now, nothing changes on the compliance front. Organisations should continue meeting their current regulatory obligations until regulators communicate any associated changes.
- [15]
ASD is in discussions with regulatory bodies about the impact and expected timeframes of the transition and says it will advise on expectations in due course.
- [16]
During the transition period, both the Essential Eight and ASD Essentials will remain available on cyber.gov.au, along with supporting resources and implementation guidance.
- [17]
The Cyber Express headlines its report that the Essential Eight is being replaced.
- [18]
The new framework changes how organisations handle environments the original Essential Eight framework was never designed for.
- [19]
The Cyber Express suggests security teams start reviewing the new chapters now, map current Essential Eight controls against the new principles, and identify which critical business functions and systems would sit at the top of a phased priority plan.
- [20]
Small and medium-sized businesses that do not operate at enterprise scale can still apply the guidance where relevant.
- [21]
Modern technology environments have grown more complex, spanning on-premises systems, hybrid cloud and emerging technologies, and a fixed list of controls struggles to keep up with that variety.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- thecyberexpress.comThe Essential Eight Is Being Replaced: What Australian Organisations Need to Know
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Cybersecurity frameworksFollow
- Critical infrastructure securityFollow
- Cyber regulation and complianceFollow
Entities
- Essential EightFollow
- The Cyber ExpressFollow
- ASD EssentialsFollow
- Australian Signals DirectorateFollow