Essential Eight To ASD Essentials Transition Checklist
The Essential Eight Is Being Replaced. Is Your Team Ready?
On 15 October 2026, the Australian Signals Directorate (ASD) published ASD Essentials, the cyber security framework that succeeds the Essential Eight. A control now counts only when it is proven to work, and Essential Eight maturity levels don’t carry over.
What’s Inside
- 8 checklists and 44 actions, in the order of ASD’s transition steps
- The 7 ratings ASD has already set, and how to fix them
- A domain-by-domain gap analysis guide
- Space for an owner and due date on every action
If you would like to see how Cyble can strengthen your resilience, book a free personalized demo today.
FREE DOWNLOAD
Download The Checklist
Fill in your details to get instant access to the checklist.
ASD Essentials: Frequently Asked Questions
What is ASD Essentials?
ASD Essentials is a cyber security framework from the Australian Signals Directorate (ASD) that replaces the Essential Eight. Published on 15 October 2026, it helps Australian organisations check whether their security controls actually work, not just whether they are in place.
When will the Essential Eight be retired?
ASD hasn’t set a retirement date yet and says it will advise on transition expectations in due course. In June 2026, the Australian Cyber Security Centre indicated it would start phasing out the Essential Eight about 12 months later and retire it at around 24 months, which points to mid-2028. Both frameworks stay available on cyber.gov.au during the transition.
Is the Essential Eight still in force?
Yes. The Essential Eight is still in force today. Any contract, regulation or policy that requires an Essential Eight maturity level still applies until the relevant authority says otherwise.
What is the difference between the Essential Eight and ASD Essentials?
The Essential Eight checks whether eight specific security controls are in place. ASD Essentials checks whether security controls actually work, across a wider range of areas including cloud, operational technology, suppliers and AI.
Do Essential Eight maturity levels carry over to ASD Essentials?
No. Essential Eight maturity levels do not carry over directly. ASD Essentials uses a different scoring method, so your current maturity level is a starting point for a new assessment, not a final rating.
Where should organisations start the ASD Essentials transition?
Start by keeping your current Essential Eight program running, then review where you stand today. ASD recommends focusing first on internet-facing systems and identity, such as user accounts and logins.
Is SMS-based MFA acceptable under ASD Essentials?
No. Under ASD Essentials, multi-factor authentication that relies on SMS codes, phone calls or push notifications alone is rated not effective. ASD expects phishing-resistant MFA, such as security keys or passkeys.