ASD ESSENTIALSNEWASD has evolved the Essential Eight into the ASD Essentials. We map the evidence you already have, assess every principle against what it actually achieves, and close the gaps with the engineers who run environments like yours.
UPDATED FOR ASD ESSENTIALS · LAST REVIEWED 9 NOVEMBER 2026
In October 2026 the Australian Signals Directorate (ASD) published the ASD Essentials. The Essentials for enterprise IT chapter succeeds the Essential Eight with 28 principles and 58 actions across 8 domains. Maturity levels are replaced by effectiveness ratings for each domain, and new chapters cover cloud and operational technology. Your Essential Eight work still counts: every strategy maps to at least one principle.
The Essentials change what each executive is asked to answer. Choose your role.
For years the board asked for one number. The Essentials ask a harder question: does each control actually achieve its outcome, in every part of your environment? A single weak action now sets the rating for its whole principle, so a gap in privileged access or identity can no longer hide behind a good average. And the scope has grown, to executive accountability, AI, suppliers, detection and response.
Deployment is not effectiveness.
Nothing you built for the Essential Eight is wasted. Here is where each strategy now lives, and what the Essentials add. Select a card to filter the table.
All 8 strategies shown
| Essential Eight strategy | Now lives in | What stays | What changes | Status |
|---|---|---|---|---|
| Application control | PRO-07 · PRO-04 Trustworthy software; Secure configuration management | Only approved software runs | Software must also be supported and verified. Admin tooling restricted to approved sets and locations. Exceptions time bound and reviewed. | Evolved |
| Patch applications | PRO-06 · IDE-01 · GOV-14 Vulnerability management; Asset identification; Legacy system management | Scanning and patching | Fixed 48 hour, two week and one month windows give way to defined risk based timeframes. ISM and regulatory timeframes still apply. | Evolved |
| Patch operating systems | PRO-06 · IDE-01 · GOV-14 Vulnerability management; Asset identification; Legacy system management | Patching and replacing unsupported systems | Legacy systems you can't yet replace are managed with compensating controls and monitoring under a governance principle. | Evolved |
| Multi factor authentication | PRO-13 Identity, credential and access management | MFA for users and privileged access | Phishing resistant MFA in every domain. Legacy authentication disabled. Secrets vaulted. Codebases and file shares scanned for exposed credentials. | Evolved |
| Restrict administrative privileges | PRO-13 · PRO-12 · PRO-05 · PRO-18 Identity; Least privilege; Secure administration; Network segmentation | Limited, reviewed privileged access | Admin work only from dedicated hardened environments, time bound privilege grants, every admin change logged, least privilege for service accounts, lateral movement limited. | Evolved |
| Restrict Microsoft Office macros | PRO-07 · PRO-04 Trustworthy software; Secure configuration management | Untrusted code blocked | Macro settings become part of approved configuration baselines, with drift detected. Equivalent controls for other execution paths. | Stayed |
| User application hardening | PRO-04 · PRO-09 Secure configuration management; Content filtering | Browser, Office and PDF hardening | Baselines apply in every domain, not just user devices. Configuration drift detected. Outbound connections to malicious destinations blocked. | Evolved |
| Regular backups | PRO-10 · PRO-12 Regular and proven backups; Least privilege access | Backups taken, retained and restorable | Encrypted, immutable, offline or isolated storage. Repositories separated from production. Restores tested against recovery time and point objectives. | Evolved |
Principle mapping from ASD, Transitioning from the Essential Eight (October 2026). Status labels are Nueva's.
The board owns cyber risk appetite, and a named executive owns AI use, governance and risk.
An approved risk method that is actually used, and enough skilled people, reviewed against threats.
Suppliers assessed before and during engagement. Software and updates verified before use.
Systems built securely from the start, with attacker techniques feeding every risk assessment.
Inbound and outbound content inspected, including for data leaving the business. Role based training before access.
Logging, detection and incident response become principles of their own, with detection coverage reviewed and lessons fed back.
Want this mapping against your own controls?
Map your Essential Eight evidenceThe Essentials organise your environment into six technical domains and two capability domains. ASD recommends a sequence: secure the front door first, then the keys to the kingdom, then everything else. Phases are an order of work, not a maturity level.
The most common routes to initial access.
Where an intruder escalates and does the most damage.
Widely spread, so built on the protections above.
On paper, every domain looks close to complete. Self assessments tend to count what has been deployed.
Tested against evidence, identity and privileged access fall furthest. One weak action, such as standing admin rights or legacy authentication, sets the rating for the whole principle.
Illustrative example. Bar shows share of applicable principles rated effective. Your ratings come from evidence collected in your environment.
We test how each action performs in each domain, not how it is described, then close the gaps with Nueva Technology, the team that runs environments like yours every day. Most organisations start with a transition assessment; those new to ASD guidance can go straight to a full Essentials assessment.
For organisations with an Essential Eight program.
We map your existing evidence to the Essentials principles, show what carries over, and identify the new work, so you can plan the move without starting again.
For a full, independent view.
A full assessment of every applicable action in every domain, with principle ratings, evidence, an executive summary and a prioritised uplift roadmap.
Your extended compliance team.
Annual reassessment, continuous vulnerability and configuration visibility between assessments, and uplift delivered by Nueva Technology, so effectiveness keeps rising instead of being checked once a year.
“Nueva has been a trusted YHA partner for many years. They listen, understand our business and the problem we're trying to solve before recommending a vendor-agnostic solution. From modernising CCTV across our network to strengthening our cyber maturity through Essential Eight and CyberCert Gold, Nueva has helped us build a stronger, more measurable cybersecurity and risk posture.”
Read the YHA story
Two consecutive annual assessments, measured year on year.
Nueva helped YHA Australia modernise video security across its hostel network and build cyber maturity it can measure, year on year.
IT, cyber and office security run by one accountable partner, helping the practice meet ASIC's cyber security expectations.
We hold ourselves to the evidence standard we apply to you.
Nueva Technology closes the gaps, and our CREST Registered Testers can confirm the fixes hold.
Our 24x7 SOC and DFIR team know what effective visibility and response look like.
Each assessment is compared with the last, so progress is something you can show.
Yes. ASD published the ASD Essentials in October 2026, and the Essentials for enterprise IT chapter is the evolution of the Essential Eight. During the transition period, ASD will continue to maintain both frameworks on cyber.gov.au.
Keep meeting it. ASD advises organisations to continue meeting existing regulatory and contractual obligations until the relevant authority changes them. Commonwealth entities under the PSPF, and contracts or insurers that name the Essential Eight, still apply today. A transition assessment lets you meet today's obligation and plan for the Essentials at the same time.
Yes, where it remains current and relevant. Every strategy maps to at least one Essentials principle. Maturity levels do not convert automatically to effectiveness ratings, so Maturity Level Three does not guarantee a fully effective rating.
Executive accountability for cyber security and for AI, supplier assurance, cyber supply chain security, secure system lifecycle, content filtering, awareness training, and measured detection and response, together with separate chapters for cloud and operational technology.
There is no certification scheme. ASD rates each action as not, partially or fully effective, and its assessment guide explains how organisations can assess their own implementation. Active testing should be done by people with the skills to manage the risk, and many organisations choose an independent assessor because boards, insurers and customers give it more weight.
Most organisations start with enterprise IT. Organisations delivered entirely through SaaS and PaaS should look at the cloud chapter, and critical infrastructure operators with industrial control systems at the operational technology chapter.
An Essentials assessment measures whether defined security outcomes are achieved across your environment. A penetration test shows how an attacker could get in and what they could reach. They answer different questions, and many organisations run both.
Yes. Nueva Technology delivers the uplift or supports your team while it does, and we reassess to confirm the ratings have moved.
Start with the evidence you already have. We'll show you what carries over, what's new, and what to fund first.
