To ensure the continued effectiveness of ASD’s mitigation advice in the changing threat environment, in October 2026 ASD’s ACSC released the Essentials series. This is the evolution of ASD’s Essential Eight into a broader, principles-based approach, offering prioritised, threat-informed cyber security mitigations with technology-specific content.
Originally released in 2017, and regularly updated, the Essential Eight was designed to provide guidance for enterprise IT networks. ASD’s Essential Eight remains effective in preventing cyber security incidents, but the threat environment and technologies have evolved significantly since it was first developed.
The Essentials series was initially published with three chapters, each focused on a specific technology environment: Enterprise IT, OT and Cloud. The Essentials series helps organisations prioritise cyber security activities around their most important systems, services and data, while providing guidance that reflects the technologies they use.
Implementation of the Essential series framework will enable organisations to focus on the actions that will have the greatest impact on reducing cyber risks in their systems and better prepare Australian organisations to be resilient to current and future cyber threats.
ASD’s ACSC acknowledges that organisations that have implemented the Essential Eight maturity model have made significant and valuable investments in their security posture. The evolved Essentials for enterprise IT framework does not discard that work. Indeed, this investment can be carried forward by organisations as part of implementing the Essentials. However, the mitigations and how we measure them have evolved and, in many cases, apply more broadly.
The development of the Essentials series was informed by ASD’s unique intelligence insights, cyber security incident data, public cyber threat reporting, and consultation with partners across industry and government.
Throughout 2026, ASD’s ACSC has engaged with industry and government partners through more than 30 face-to-face workshops across all 8 capital cities, a consultation paper released via ASD’s Partner Portal, and bespoke targeted consultations for the cloud and operational technology chapters.
This process enabled implementers and service providers to shape the development of the Essentials series, while ensuring it is threat informed and supported by clear progression pathways and improved usability. ASD’s ACSC will continue to engage with stakeholders on the transitional arrangements into 2027.
