The end of the maturity score: what ASD Essentials asks of boards

One line, a lot of work#

For almost a decade, one line has done a lot of work in Australian board papers, tender responses and insurance forms: "We are Essential Eight Maturity Level Two." It was simple, comparable and easy to report. It is on its way out.

On 15 October 2026, the Australian Signals Directorate released ASD Essentials, the successor to the Essential Eight. Most commentary will focus on what has changed technically. The bigger change is for governance, and that is where directors should focus.

What has changed, briefly#

• ENTERPRISE IT

  Start with identity and boundary

  Identity services and internet facing systems and edge devices.

• OPERATIONAL TECHNOLOGY

  Start with boundary and critical processes

  The pathways into OT, and what keeps operations safe and running.

• AI

  An executive owns it

  ASD publishes AI considerations, and executive AI accountability is a principle.

For enterprise IT, ASD recommends starting with identity services and boundary services, such as internet facing systems and edge devices, rather than spreading effort evenly across the whole environment. The OT chapter starts with boundary services and critical processes instead. ASD has also published AI considerations for applying the framework, and the Essentials make an executive explicitly accountable for how AI is used and governed.

The detail is in ASD's own publications at cyber.gov.au/essentials ↗ (opens in a new tab), including its guide Transitioning from the Essential Eight ↗ (opens in a new tab). For a practitioner view of the technical changes, see Chris Tiqui's article for security leaders, ASD Essentials: from maturity levels to proof that controls work. The more useful question for directors is what changes beyond IT.

Five things that change beyond IT#

1. 01

   Board reporting needs a new shape. A single maturity number was always a summary, and summaries hide things. An organisation could be "Level Two" while its most exposed systems were its weakest. Under ASD Essentials there is no single score to report. Boards should expect an effectiveness view by priority phase and domain: where protection is effective on the systems that matter most, where it is not, and what is being done about it. ASD's assessment guide calculates a percentage for each domain to summarise progress, which gives the board a trend to follow rather than a pass mark. That is a more honest picture of risk, and it needs a new reporting format.

2. 02

   Contracts, tenders and supplier questionnaires will need attention. "Essential Eight Maturity Level Two" is written into customer contracts, government tenders, supplier questionnaires and cyber insurance forms. While both frameworks run side by side, organisations will be asked about one, the other or both. ASD has not published a retirement date for the Essential Eight. For most private organisations ASD Essentials is guidance; it becomes an obligation where a regulator, contract or insurer adopts it. Now is the time to list what you have promised customers and what you ask of suppliers, before a renewal or audit forces the question.

3. 03

   Evidence becomes the currency. An outcome based rating has to be backed by proof that controls work in practice: testing, monitoring data and validation, not just policies and configuration screenshots. Penetration testing, control validation and continuous monitoring become central to showing effectiveness. Organisations that already gather evidence this way will move quickly. Those relying on self attested checklists will find the gap.

4. 04

   Accountability gets a name. By building executive and board accountability, third party risk and supply chain security into the framework, ASD Essentials turns cyber from an IT metric into a governance matter. For each domain, the board should know who owns it, what "effective" looks like and when it will next see evidence.

5. 05

   Connected frameworks will feel the change. Many requirements refer to or map to the Essential Eight, including SMB1001 certification, NSW Government agency reporting under the NSW Cyber Security Policy, Commonwealth entity reporting under the PSPF and cyber insurance questionnaires. Each will move on its own timetable. Check each one against its current documents rather than assuming they will all switch at once.

   • SMB1001 certificationCheck its current mapping
   • NSW Cyber Security PolicyNSW Government agencies
   • PSPF reportingCommonwealth entities
   • Cyber insuranceCheck the renewal questionnaire

A single maturity number was always a summary, and summaries hide things.

What not to do#

• Don't copy your Essential Eight level across. ASD is clear that maturity levels do not convert automatically into effectiveness ratings, because the two measure different things. A maturity level shows whether set requirements are in place across the environment. ASD Essentials asks whether each action achieves its intended outcome in each part of the environment, with evidence that it keeps working. Start with a fresh gap analysis, using your existing controls and evidence as the baseline.

• Don't stop work in progress. Existing Essential Eight work carries forward. MFA, patching, application control and backups remain the foundations.

• Don't run it as a separate program. Map ASD Essentials into your existing control set, whether ISO/IEC 27001, SMB1001 or your own, so evidence is collected once and serves every framework.

A practical 90 day plan for boards#

1. DAYS 0 TO 30

   Scope

   • Brief the board on what is changing and agree who is accountable for the transition.
   • Confirm which chapters apply: enterprise IT, cloud, OT or a mix.
   • Identify your priority domains, starting with identity and boundary services for enterprise IT.
   • List every contract, tender response, policy and report that refers to the Essential Eight.
2. DAYS 31 TO 60

   Assess

   • Run a gap analysis against ASD Essentials using ASD's transition guidance.
   • Map the results to your existing controls and evidence, and note where proof of effectiveness is missing.
3. DAYS 61 TO 90

   Govern

   • Confirm the board's cyber risk appetite, and agree the new board reporting format, by domain.
   • Set the order of work by ASD's priority phases, with an owner, budget and timeframe for each domain.
   • Update supplier requirements and plan how Essential Eight references will change as regulators and customers update theirs.

The opportunity#

ASD Essentials gives organisations a chance to report cyber risk the way it is actually experienced: by what matters most, with evidence that controls work. Organisations that use it this way will get better decisions from their boards and stronger answers for customers, insurers and regulators. Organisations that try to rebuild a single number will miss the point.