In short
In October 2026 the Australian Signals Directorate (ASD) began publishing ASD Essentials, a series that evolves the Essential Eight. The first chapter covers enterprise IT. ASD maintains both frameworks during the transition, and Essential Eight maturity levels do not convert into Essentials ratings. The evidence you hold stays useful; how you report it changes.
What has ASD published?
ASD Essentials is organised by environment instead of by eight mitigation strategies. The first chapter, Essentials for enterprise IT, is on cyber.gov.au together with an overview, a reading guide and a guide to transitioning from the Essential Eight. Coverage of the launch describes further chapters for cloud and operational technology.
The enterprise IT chapter sets out eight domains grouped into priority phases. Six domains are technical. Two, Governance and culture and Visibility and response, apply across every phase. ASD describes the phases as a sequencing mechanism, not a rating or maturity model. Boundary services and identity services come first because they are common paths to initial access.
Is the Essential Eight retired?
Not yet. ASD has said it will keep both the Essential Eight and Essentials on cyber.gov.au during the transition, with guidance maintained for both. Industry reporting refers to deprecation and retirement over roughly the next two years, but we have not seen a fixed changeover date from ASD.
Check cyber.gov.au before you write a date into a contract, an insurance renewal or a board report.
Do maturity levels carry over?
No. According to ASD's transition guidance, Essential Eight maturity ratings do not convert into Essentials ratings. The guide maps each mitigation strategy to principles and actions in the enterprise IT chapter, and shows where existing controls and evidence can be reused and where they may need strengthening.
What should you do now?
- Keep your current target maturity and assessment cycle. Contracts, government requirements and insurance questionnaires written against the Essential Eight still refer to it.
- Read the transition guide against your own evidence: mark what maps cleanly and which gaps it exposes.
- If you plan uplift work in the next budget cycle, start with boundary and identity services, the first priority phase.
- Ask your assessor, insurer and key customers which framework they will assess against in 2027.
Where Whitesec One fits
The Essential Eight workspace in Whitesec One follows the November 2023 maturity model, the version ASD continues to maintain during the transition. The maturity assessments, patch register and evidence you record there are the material the transition guide asks you to reuse. Whitesec AU in Perth can walk you through what the change means for your environment.
Sources
- ASD Essentials: evolving our approach to cyber security resilience, Australian Signals Directorate
- Essentials for enterprise IT, Australian Signals Directorate
- Transitioning from the Essential Eight, Australian Signals Directorate
- Essential Eight maturity ratings will not carry over to ASD's new cyber framework, Insurance Business Australia
Regulation moves. Check the official text before relying on a date or an obligation.