On 15 October 2026, the Australian Signals Directorate (ASD) launched ASD Essentials, an evolution of the Essential Eight. Aimed at Commonwealth entities, critical infrastructure owners and operators, and large organisations, the series provides guidance for enterprise IT, cloud and operational technology (OT). It recognises that these environments have different risks and operational constraints.
The framework uses three layers across its environment-specific chapters:
This common structure supports a consistent approach while allowing implementation to reflect each environment. Flexibility still requires organisations to address the applicable actions and demonstrate the intended outcomes.
ASD has also published a reading guide and supporting resources covering the reasons for the change, executive responsibilities, chapter selection, AI, transition, implementation and assessment.
ASD’s case for change explains that a fixed set of prescriptive controls does not always translate across different technology environments. Threats also evolve, including attacks that reach organisations through suppliers and service providers.
ASD Essentials responds with a threat-informed, principles-based approach. It focuses on security outcomes while allowing controls and implementation methods to reflect operational needs. This is particularly relevant where cloud services, legacy OT, safety requirements or long system lifecycles affect what can be implemented.
Existing Essential Eight controls and investment remain valuable. ASD will maintain both frameworks during the transition period, and organisations should continue meeting current regulatory obligations until regulators communicate changes. Organisations should also check any contractual commitments before changing their assessment or reporting approach.
ASD’s guidance for senior executives makes board and executive accountability more explicit, including oversight of cyber risk, investment and resourcing. Leaders need to understand which business functions matter most and whether security investment is delivering the required outcomes.
Security posture is reported by domain, giving leaders visibility of where outcomes are being achieved and where gaps remain. The chapters also use priority phases to sequence implementation. These phases are not maturity levels or assurance ratings, and should not be presented as equivalent to Essential Eight maturity levels.
Implementation is an ongoing responsibility. Leaders should establish ownership, fund the work, monitor outcomes and ensure controls remain effective as systems, suppliers and threats change.
ASD’s chapter selection guidance asks organisations to consider their technology environments, regulatory and contractual obligations, gaps in protection, and the likelihood and consequences of compromise.
The enterprise IT chapter is an appropriate starting point for on-premises, hybrid and infrastructure-as-a-service environments. The cloud chapter is an appropriate starting point for organisations operating predominantly software-as-a-service or platform-as-a-service. The OT chapter addresses operational technology. More than one chapter may apply, and organisations do not have to adopt them in a fixed order.
Using a provider does not remove the need to manage cyber risk. Organisations need to establish which responsibilities they retain and obtain appropriate assurance over the outcomes delivered by providers.
A practical starting point is to identify critical business functions, map their supporting assets and services, and use the relevant chapters to prioritise improvements.
ASD’s AI guidance explains that the framework applies whether an organisation consumes, develops or deploys AI. AI should be included when scoping assets, implementing controls and assessing security outcomes.
AI introduces additional attack surfaces and can make existing attacks faster and cheaper. Relevant assets can include models, training data, prompts, outputs, connectors and the identities and permissions used by AI agents. These need appropriate protection and oversight.
AI-enabled security tools can support analysis and response, but need to be assessed, configured and monitored. People remain accountable for security outcomes, and AI-generated outputs should be validated before they inform significant decisions.
Organisations should establish executive accountability, approval processes and ongoing review of AI use cases. As a practical governance consideration, ASD Essentials should be considered alongside applicable privacy, legal and broader AI governance requirements.
What this means for your organisation
ASD Essentials gives organisations a broader way to organise cyber security improvements across the environments and business functions they depend on. Existing controls provide a starting point, but organisations will need to assess how those controls contribute to the applicable outcomes.
The practical priority is to understand the relevant chapters and domains, identify gaps, and agree a funded plan with clear owners. Reporting should show the outcomes achieved and the risks that remain, rather than simply progress through implementation phases.
For organisations already using the Essential Eight, transition planning should build on the work completed while maintaining existing obligations and commitments.
If you’re working through what ASD Essentials means for your organisation, Infotrust can help you interpret the guidance, assess existing controls and develop a practical improvement plan.