An organisation can keep its software patched, restrict privileged access and maintain reliable backups, yet remain exposed through a critical technology supplier. Even where technical controls are strong, it may be unclear who should respond to an incident or what a disruption would mean for essential services.
On 15 October 2026, the Australian Signals Directorate (ASD) launched ASD Essentials, an evolution of the Essential Eight that addresses these wider challenges.[1] It brings governance, supplier assurance and incident response into a more comprehensive approach to cyber security, while changing how organisations assess whether controls work.
For risk and compliance professionals, the implications extend beyond the technology team. The new guidance connects cyber security more closely with business risk, accountability and operational resilience.
For a practical guide to bringing cyber risks, controls and evidence together, download Protecht’s Too many tools, not enough truth eBook.
Why the Essential Eight needed to evolve
The Essential Eight has helped organisations address common cyber threats through measures such as patching, multifactor authentication, restricting administrative privileges and maintaining backups. Its prescribed requirements and maturity levels gave security teams a practical way to establish a baseline and measure progress.
Those strengths also defined its limits. Some requirements were tied to particular technologies, such as Microsoft Office macros. More broadly, the framework concentrated on technical protections within an organisation’s IT environment rather than the full range of dependencies and responsibilities involved in delivering its services.
Today, critical operations often depend on cloud platforms, software-as-a-service applications and external providers. An organisation may be accountable for a service without controlling the infrastructure on which it runs. AI applications and integrations add further assets, identities and access pathways.
ASD’s case for change also points to more varied and sophisticated threats, including attacks that exploit suppliers and connected systems.[2] Its answer is a set of security outcomes that can be applied across different technologies, with initial Essentials chapters for enterprise IT, cloud and operational technology. Existing Essential Eight controls remain useful, but they no longer define the whole picture.
What changes under ASD Essentials?
The Essential Eight organised security around eight mitigation strategies and requirements for each maturity level. ASD Essentials uses principles to define the desired security outcomes, actions to describe what organisations must do and domains to identify where those actions apply.[3]
Each principle uses a corresponding identifier from ASD’s Information Security Manual (ISM). The accompanying assessment evidence guide also identifies relevant ISM controls, Essential Eight controls and other framework references that can support assessment.
The enterprise IT chapter has six technical domains arranged into three priority phases. Boundary and identity services come first, followed by critical processes and privileged environments, then business systems and user devices. The additional domains, Governance and culture and Visibility and response, apply throughout. These phases guide the order of implementation; they are not maturity levels.
Much of the technical work will be familiar. Organisations still need to control access, address vulnerabilities and protect software and data. But controls must now be considered against the risks of the particular systems or services they protect.
For example, the Identity, credential and access management principle (PRO-13) includes an action requiring phishing-resistant multifactor authentication (IT.PRO-13.4). Applied to the Identity services domain, this means assessing whether relevant authentication systems are consistently protected, with evidence to demonstrate effectiveness.
Cyber security becomes a broader business responsibility
The most significant expansion for risk leaders is the attention paid to capabilities outside the Essential Eight’s traditional technical scope.
Governance and culture addresses executive accountability, security resourcing, cyber risk assurance and supplier cyber security. It also covers accountability for the use of artificial intelligence. Visibility and response brings together event logging, detection, incident coordination, response and lessons learned.[4]
These requirements reflect how incidents affect businesses. A security team may be able to protect its own network but cannot independently manage the consequences of a supplier outage, decide which critical services must be restored first or accept risk on behalf of the organisation.
The 2025 Qantas data breach is a useful illustration. A social engineering attack on an overseas third-party provider exposed personal information relating to approximately 5 million Australians. In July 2026, the privacy regulator reported that its preliminary inquiries had found no failings in Qantas’s precautions or oversight of that provider.[5] The incident nevertheless showed how an organisation can be exposed through systems operated by someone else.
Supplier assurance therefore needs to consider what services a provider supports, what evidence exists of its security controls and how disruption would be managed. Incident planning needs the same business context: service dependencies, decision-makers, escalation arrangements and recovery priorities. These are matters for risk, procurement, technology and business owners as well as cyber specialists.
From maturity levels to evidence of effectiveness
Under the Essential Eight, organisations assessed prescribed requirements against Maturity Levels 0 to 3. ASD Essentials instead asks whether each security action achieves its intended outcome within the relevant domain.[6]
Actions are rated not effective, partially effective or fully effective. Not assessed is recorded separately when an assessment has not taken place or there is insufficient evidence. Partial effectiveness requires a real security benefit; installing a tool is not enough. Control testing and other assurance evidence inform these ratings, but the assessment focuses on whether each action achieves its intended security outcome.
Take vulnerability management. A record showing that scanning software has been deployed may demonstrate coverage, but not that material vulnerabilities are consistently identified and fixed. Evidence of remediation, exceptions and ongoing monitoring provides a stronger basis for assessing effectiveness.
The same action may also perform differently across domains. Strong controls on user devices do not prove equivalent protection for privileged systems. Assessors must consider the scope, consistency and currency of the evidence, as well as the risks involved.
For boards and risk committees, this offers a more informative account of cyber security than a single maturity rating. Reporting can identify which controls are working, where weaknesses remain and which business services may be affected. It also makes sustained control testing and remediation more important than periodic compliance exercises alone.
What should organisations do now?
ASD has not announced a fixed transition deadline. It will maintain both frameworks during the transition, and organisations must continue meeting existing regulatory obligations until regulators communicate changes.
For transition, the starting point is a clear record of current controls, assessment results, exceptions and evidence. ASD’s transition guidance explains how Essential Eight investment carries forward and where controls may need to cover more assets, meet broader outcomes or be supported by stronger evidence.
From that baseline, organisations can map controls to the new actions and domains and identify gaps. ASD recommends initially focusing on boundary and identity services, alongside governance and response capabilities. This should draw on information held by security, risk, procurement and business teams, particularly where critical services depend on outside providers.
Previous maturity ratings cannot simply be converted into Essentials effectiveness ratings. Evidence may be reusable, but it must be current and show that the required outcome is being achieved.
For executives, the priorities are practical: understand the organisation’s most important systems and suppliers, establish whether their protections work and decide how to address the weaknesses that matter most.
Next steps for your organisation
ASD Essentials gives organisations a reason to connect technical assurance with supplier risk, incidents, control ownership and business consequences. That work should improve cyber risk decisions well beyond the framework transition.
Protecht’s cyber and IT risk management solution connects risks, controls, assets, incidents, evidence and remediation actions in one workspace, supporting framework mapping and clearer reporting across cyber and enterprise risk.
Request a Protecht demo to see how a connected approach can help your organisation assess control effectiveness, manage gaps and give decision-makers a clearer view of cyber risk.
References
[1] Australian Signals Directorate, “ASD Essentials: evolving our approach to cyber security resilience”, 15 October 2026, https://www.asd.gov.au/news/2026-10-15-asd-essentials-evolving-our-approach-cyber-security-resilience
[2] Australian Signals Directorate, “The case for change”, https://www.cyber.gov.au/publication/the-case-for-change
[3] Australian Signals Directorate, “Essentials for enterprise IT”, https://www.cyber.gov.au/publication/essentials-for-enterprise-it
[4] Australian Signals Directorate, “Transitioning from the Essential Eight”, https://www.cyber.gov.au/publication/transitioning-from-the-essential-eight
[5] Office of the Australian Information Commissioner, “Privacy Commissioner completes preliminary inquiries into Qantas 2025 data incident”, 16 July 2026, https://www.oaic.gov.au/news/media-centre/privacy-commissioner-completes-preliminary-inquiries-into-qantas-2025-data-incident
[6] Australian Signals Directorate, “Assessment process guide”, https://www.cyber.gov.au/publication/assessment-process-guide