What is the ASD Essentials?

The ASD Essentials is the Australian Signals Directorate's successor to the Essential Eight, published on 15 October 2026. It is a principles-based framework built from three layers: principles describe the security outcomes to achieve, actions describe what to do, and domains describe the business functions and assets the actions apply to. The first chapters cover enterprise IT, cloud and operational technology.

Has the Essential Eight been replaced?

Yes. ASD published the Essentials series as the Essential Eight's successor on 15 October 2026. ASD has not yet set a transition date. It says it is working with regulators and will advise on expectations for transitioning in due course, and it recommends organisations keep their current Essential Eight uplift programs going in the meantime.

Is the ASD Essentials for small business?

Not primarily. ASD says the Essentials series is written mainly for Commonwealth entities, critical infrastructure owners and operators, and large organisations. Small and medium businesses can use it where relevant, and ASD publishes separate cyber security guidance aimed at small businesses.

Can you get certified against the ASD Essentials?

No. There is no certification scheme for the ASD Essentials. ASD provides an assessment process guide, an evidence guide and a workbook for organisations to assess their own environment, and says that process is not intended for assessing suppliers or third parties. If a customer or insurer wants independent proof of your security, you need a certifiable standard such as SMB1001 or ISO 27001.

Do Essential Eight maturity levels carry over to the Essentials?

No. ASD says Essential Eight maturity levels do not automatically convert to the Essentials. The Essential Eight measured whether specific controls were implemented. The Essentials measures whether each action is effective for the assets in a domain, rated not effective, partially effective or fully effective. Every Essential Eight strategy does map to at least one Essentials principle, so the work is not wasted.

Should we stop our Essential Eight project?

No. ASD itself recommends continuing current uplift programs while assessing alignment with the new framework. Controls implemented under the Essential Eight will in most cases satisfy, or substantially contribute to, a corresponding action in the Essentials.

How is the ASD Essentials assessed?

Each action is assessed against the domain it applies to and rated not effective, partially effective or fully effective. A principle takes the rating of its weakest applicable action. For boards, ASD suggests a weighted percentage per domain showing progress towards full effectiveness.

What are the ASD Essentials priority phase one domains?

ASD names four domains in priority phase one: boundary services, identity services, governance and culture, and visibility and response. Priority phases replace the Essential Eight maturity levels and set the order in which to address domains for the fastest reduction in risk.

How does the ASD Essentials relate to SMB1001?

They do different jobs. The ASD Essentials is a principles-based framework, written mainly for large organisations, that you assess yourself. SMB1001 is a prescriptive standard built for small and medium businesses, with a defined set of controls at each of five tiers and an independent certificate. SMB1001 publishes control mappings to the Essential Eight.

Does the ASD Essentials cover AI?

Yes. The Essentials treats AI as another asset to include when scoping domains, and includes an executive accountability principle for AI. ASD has also published AI considerations for the Essentials.

ASD Essentials: What It Means for Small Business

On 15 October the Australian Signals Directorate published the ASD Essentials, the successor to the Essential Eight. If you have been on LinkedIn since, you will have seen plenty of posts telling you the Essential Eight is dead and you need to act now.

If you run a small or medium business, the honest version is calmer than that. I have read ASD’s own publications. Here is what actually changed, who it is written for, and what we would do about it.

The short answer

The Essentials replaces the Essential Eight, but there is no transition date yet. ASD says to keep your current Essential Eight work going.
It is written mainly for government and large organisations. Small businesses can use it, but it is not aimed at you.
It is principles-based, not a checklist. It describes outcomes, not the specific controls to put in place.
There is no certification. When a customer or insurer wants proof that you are secure, the Essentials cannot give it to you. SMB1001 can.

How the new framework works

The Essential Eight was a list of eight mitigation strategies, measured against maturity levels. The Essentials is a different kind of framework.

Each chapter is built from three layers:

Principles describe the security outcomes you should achieve. They are drawn from the principles in ASD’s Information Security Manual.
Actions describe what needs to be done to achieve each outcome.
Domains group the business functions and assets the actions apply to, by shared risk.

The first chapters cover enterprise IT, cloud and operational technology, with more to come. Instead of maturity levels, the Essentials uses priority phases: an order in which to tackle the domains, starting where the risk reduction is fastest. Priority phase one covers boundary services, identity services, governance and culture, and visibility and response.

Assessment changes too. Each action is rated not effective, partially effective or fully effective for the assets in a domain, and a principle is only as strong as its weakest action.

Who it is written for

ASD is clear about this. Its own FAQ says the Essentials series is “written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations”. Smaller businesses can use the guidance where it is relevant, and ASD points them to its separate small business guidance.

That matters, because the Essentials asks a lot of the organisation using it. You scope your own domains, choose how to achieve each outcome, gather evidence and rate your own effectiveness. That is a sensible model for a government agency with a security team. For a 40-person business with no one in a dedicated security role, it is a lot of judgement to exercise alone.

The move from a checklist to principles

The biggest change is philosophical. The Essential Eight told you what to do: application control, patching, MFA and so on, with maturity levels describing how well. The Essentials is deliberately technology-agnostic. It describes outcomes and leaves the “how” to you.

If that sounds familiar, it should. It is the same shift that separates ISO 27001 from a prescriptive standard. We wrote about exactly that last week, in SMB1001 vs ISO 27001: a principles-based framework tells you to manage your risks well, but it does not tell you which tools to run.

Your existing work is not wasted. ASD says every Essential Eight strategy maps to at least one Essentials principle, and that in most cases the controls you already run will satisfy or substantially contribute to a corresponding action. What does not carry over is the maturity level itself. ASD says Essential Eight maturity ratings do not automatically convert to Essentials effectiveness ratings.

What the Essentials does not give you

Two things, and for most SMBs they are the things that matter most.

A defined list of what to put in place. The Essentials is principles-based by design. For a large organisation with a security team, that flexibility is the point. For a smaller business, it means someone still has to translate each outcome into the specific controls you run.

A certificate. There is no certification scheme for the Essentials. ASD’s assessment guide is for assessing your own environment, and ASD says it is not intended for assessing suppliers or third parties.

That second point is worth sitting with. The question most SMBs actually face is not “what framework should we follow?”. It is “our customer, insurer or tender panel wants proof we are secure. What do we show them?” The Essentials, by ASD’s own description, is not built to answer that.

Where SMB1001 fits

SMB1001 was built for exactly the gap the Essentials leaves for smaller businesses:

It is prescriptive. At each of its five tiers, Bronze to Diamond, the standard tells you which controls apply. No one has to interpret an outcome into a toolset.
It is certified. CyberCert issues the certificate. Bronze, Silver and Gold are attested by a director, and Platinum and Diamond add an independent third-party audit.
It moves every year. SMB1001 is revised annually and raises the bar at each tier. The 2027 edition added an AI governance framework at Platinum and control of unauthorised AI use at Diamond. We covered what changed at Gold and Platinum earlier this month.
It maps to the Essential Eight. SMB1001 publishes control mappings to the Essential Eight, as well as ISO 27001, so Essential Eight work carries across.

What we would do now

Do not stop your Essential Eight work. ASD itself recommends continuing current uplift programs. Patching, MFA, application control and backups protect you whatever the framework is called.

If a contract, regulator or insurer names the Essential Eight, keep meeting it. ASD has not set a transition date, and says it is working with regulators on expectations. Until your customer or regulator changes their wording, the Essential Eight is still what they are asking for.

If you need to prove your security, certify. Neither the Essential Eight nor the Essentials gives you a certificate. SMB1001 does, and if a buyer names ISO 27001 specifically, see our guide to pairing ISO 27001 with SMB1001 Gold.

If you are larger, a critical infrastructure operator, or supply government, start a transition baseline. ASD suggests recording your current posture, including your Essential Eight maturity and existing controls, then scoping the priority phase one domains.

A note on sources

Everything above about the ASD Essentials comes from ASD’s own publications of 15 October 2026, including its frequently asked questions. You can read the full series at cyber.gov.au/essentials. DJC is certified to SMB1001 Diamond and holds ISO 27001 and ISO 9001.

Book Your Free SMB1001 Readiness Check: 20 minutes with Julian or myself. We will look at where your Essential Eight work leaves you, and what it would take to turn it into a certificate your customers will accept.

The ASD Essentials is out. Here is what it means if you are not a government department