ASD Essentials: from maturity levels to proof that controls work

One number is no longer the answer#

For most of the last decade, "we're Maturity Level Two" was the answer boards, insurers and customers wanted to hear. It fitted neatly into a board pack and a contract clause.

ASD Essentials retires that number. The controls behind it carry forward. What goes is the idea that one level can describe a whole organisation. In its place is a rating that looks much more like the way an attacker sees you: domain by domain, with your weakest control setting the score.

Below I look at what has changed, then at what it means through two lenses: governance, risk and compliance, and the CISO.

What actually changed#

ASD published the Essentials series on 15 October 2026. The Essentials for enterprise IT chapter succeeds the Essential Eight, with separate chapters for cloud and operational technology. The differences that matter:

Two things haven't changed. Every Essential Eight strategy maps to at least one Essentials principle, so existing work carries forward. And ASD hasn't published a retirement date, so both frameworks will be in use during the transition.

For a strategy by strategy view of what stayed, what evolved and what is new, see our ASD Essentials mapping.

The GRC lens: accountability you can show#

Your current obligations still stand. ASD is clear that organisations should keep meeting existing regulatory, contractual and other obligations until the relevant authority changes them. If the PSPF, a government contract, a customer agreement or your cyber insurer names Essential Eight Maturity Level Two, that requirement is still in place. The task now is to keep meeting it while you plan the move.

Contracts and questionnaires will need new language. Many supplier agreements, tenders and insurance forms quote a maturity level. Those levels don't carry into the Essentials, and ASD states plainly that maturity levels don't convert automatically to effectiveness ratings. Start a register of every document that cites the old framework, so wording can be updated at renewal rather than in a rush. Your legal team should own the drafting.

Governance is now assessed, not assumed. The Essentials open with a Governance and culture domain that was never assessed before. It includes principles for:

• executive and board accountability for cyber security, including setting and monitoring risk appetite
• executive accountability for the use, governance and risk of AI
• a risk management methodology that is actually used
• sufficient, skilled cyber resourcing, reviewed against current threats
• supplier cyber security assurance, before engagement and throughout it
• managing the risk of legacy and unsupported systems until they are replaced

For many organisations these already exist somewhere in a risk framework or an ISO/IEC 27001 ISMS. The difference is that they now sit inside the same assessment as patching and MFA, so any gaps show up in the same report the board reads.

Board reporting changes shape. Instead of one level, the board sees ratings by domain and principle. That is more honest and more useful, but it needs framing. A board used to hearing "ML2 achieved" may read "identity services: partially effective" as a step backwards. ASD suggests a weighted percentage for each domain that shows progress towards full effectiveness, which gives the board a trend to follow rather than a pass mark. Brief them before the first report, not after.

The CISO lens: evidence of effect, not deployment#

The evidence bar has moved. ASD's assessment guidance asks whether each action achieves its intended security outcome, judged on coverage, consistency, currency and evidence quality. Configuration screenshots and policy documents show that a control was deployed. To be rated fully effective, you will increasingly need operational evidence: validation results, configuration drift reports, restore tests, detection reviews and exercise results. ASD also notes that even Maturity Level Three does not automatically produce fully effective ratings.

The weakest link sets the score. Each action is rated in every domain it applies to, and a principle takes the rating of its weakest action. A strong MFA rollout with legacy authentication still enabled, or excellent privileged access controls with standing admin rights on a few servers, will be rated on the gap rather than the average.

Scope follows the attacker, not the endpoint. The six technical domains group assets by shared risk. ASD's priority phases reflect where intrusions start and spread:

Governance and culture, and Visibility and response, run across all three. ASD is explicit that phases are a sequence, not a maturity level.

Familiar controls, higher bar. The controls you know are still there, with broader reach. Phishing resistant MFA applies in every technical domain. Administrative work must come from dedicated, hardened environments, with time bound privilege grants and every change logged. Backups need encrypted, isolated or immutable storage, with restores proven against recovery objectives. Patching moves from fixed windows to defined, risk based timeframes, although ISM and regulatory timeframes still apply.

New work you haven't been asked for before. Expect to plan for scanning code and file shares for exposed secrets, verifying software and update integrity, content filtering in and out of the network, role based awareness training, and detection and response treated as principles in their own right, including periodic review of detection coverage. Where applicable, actions are mapped to the MITRE ATT&CK techniques they are intended to address, which makes threat informed prioritisation easier to explain and defend.

Five questions to answer before your first Essentials report#

1. Which of our regulatory, contractual and insurance obligations still name the Essential Eight, and who is tracking them?
2. Which systems sit in Boundary services and Identity services, including the ones IT doesn't run?
3. For each phase 1 action, can we show the control works, or only that it was deployed?
4. Who is the executive accountable for AI, and what have they reported to the board?
5. How will we explain to the board that a lower rating can be a more honest one?

If you can answer all five with confidence, you are ahead of most. If you can't, that is where to start.

Can't answer all five yet? Our transition assessment starts with the evidence you already hold. See how the transition assessment works

What to do in the next 90 days#

ASD's transition guidance recommends a staged path: establish a baseline, scope the phase 1 domains, run a gap analysis, then plan, deliver and measure. In practice, a sensible first 90 days looks like this.

1. Weeks 1 to 2.

   Confirm what still binds you. List every regulation, contract and insurance requirement that names the Essential Eight. Keep meeting them. Brief your executive team that reporting will change.

2. Weeks 2 to 4.

   Map before you rebuild. Gather your existing evidence and map it to the Essentials principles. Reuse what is current and relevant. Review expired exceptions and stale risk acceptances before relying on them.

3. Weeks 4 to 6.

   Assign assets to domains. Decide which systems sit in Boundary services, Identity services and the other domains. Include non production environments that can reach production, and connected building systems.

4. Weeks 6 to 10.

   Assess phase 1 and the governance domain. Rate boundary and identity services on effectiveness, not deployment. At the same time, test whether board accountability, AI accountability and supplier assurance exist in practice.

5. Weeks 10 to 12.

   Report and fund. Give the board its first domain based view, with a costed roadmap in ASD's priority order and the existing obligations you are still meeting alongside it.

If you'd rather not start from a blank page, our transition assessment maps your existing evidence to the Essentials and shows what carries over and what is new.

Common mistakes to avoid#

Drawn from ASD's own guidance:

• treating priority phases as maturity levels
• claiming equivalence from an old rating instead of assessing
• assessing the enterprise as a whole instead of each domain
• leaving governance, visibility and response until the technical work is done
• trying to transition every domain at once
• reusing evidence that no longer reflects how the control operates
• overlooking new requirements that have no Essential Eight equivalent

The bottom line#

The Essential Eight gave Australian organisations a common language for cyber hygiene. ASD Essentials keeps that foundation and asks a harder, better question: does each control work, everywhere it needs to?

For GRC leaders, that means accountability for cyber and AI that can be shown, not assumed. For CISOs, it means evidence of effect, domain by domain. From where I sit, the organisations that start mapping now will spend the transition improving security rather than rewriting paperwork.