What is the ASD Essentials?

At a glance

• There are three chapters: enterprise IT, cloud and operational technology (OT). ASD says more can be added.

• Each chapter is built from principles (the outcome), actions (what to do) and domains (where it applies). Enterprise IT has 28 principles, 58 actions and 8 domains.

• Instead of maturity levels, each action gets one of four ratings in each domain it applies to: not assessed, not effective, partially effective or fully effective.

• Priority phases are ASD's recommended order for working through the domains. They are not a rating.

• The Essential Eight still applies wherever an obligation requires it. ASD will keep both during the transition and has set no end date. Under the Protective Security Policy Framework (PSPF), federal government departments and other non-corporate Commonwealth entities must still reach Maturity Level Two.

Three chapters, one model

Each chapter applies the same model to one kind of technology environment. You use only the chapters that fit your environment, in any order. ASD says most organisations will need both enterprise IT and cloud over time.

Not sure which fits? Our chapter guide walks through ASD's four questions.

Principles, actions and domains

Every chapter uses the same three layers. Here they are for one real action: phishing-resistant multi-factor authentication (MFA), a second sign-in check that a fake login page cannot steal and reuse.

• 28 principles: the outcomes to achieve. Each has a short code, such as PRO-13 (PRO for Protect).

• 58 actions: what to do, written so you choose your own controls. Each has an identifier, such as IT.PRO-13.4.

• 8 domains: groups of business functions and assets with similar risk. Six are technical domains. The other two are capability domains: Governance and culture (policies, risk processes, roles and security culture), and Visibility and response (spotting and handling incidents). You start these two early and expand them through every phase.

How the three fit together

An action is assessed in every domain it applies to. A good result in one domain does not carry over to another. For example, phishing-resistant MFA that is fully effective on staff laptops (User devices) says nothing about the dedicated workstations admins use to manage servers (Privileged environments). Each domain is rated on its own evidence. To place your own systems, see our guide to choosing a domain.

Priority phases are a sequence, not a rating

Each chapter groups its technical domains into priority phases. This is ASD's recommended order: deal with an earlier phase's domains before the next phase's, because each phase builds on the one before. The order is based on how attackers get in and move around today, where controls are often weakest and where good solutions already exist.

ASD calls its order "a starting position, not a constraint". You can change it, for example when threat intelligence shows a later domain is under attack. If you do, write down why. Domains you move later still have to be done.

Our chapter guide explains why ASD chose this order and how the OT chapter orders its domains differently. ASD's own reason for each phase is on our enterprise IT page.

How the Essentials is rated

An assessment asks whether each action achieves its outcome for the assets in scope, not just whether a control exists. Each action gets an action rating in every domain it applies to.

A principle takes the lowest rating of its actions in a domain, which ASD calls the weakest link rule. Each domain then gets a domain score: the share of its principles rated fully effective, with each partially effective one counting as half. Not assessed gets no score and must always be shown apart from not effective, so a domain you have not assessed yet shows N/A, not 0%.

For every enterprise IT action, ASD also describes what not effective, partially effective and fully effective look like. These indicators of good practice (529 in all) sit under each action on our enterprise IT page. ASD says they support an assessor's judgement and are not a checklist. We found none for the cloud or OT chapters as at 15 October 2026.

Our assessment guide covers the four ratings and works through ASD's domain score example. ASD does not require an independent assessor, but it recommends a periodic independent check, especially where you need outside assurance. A regulator or contract may still ask for one.

ASD Essentials vs the Essential Eight

ASD sums up the difference like this:

Your Essential Eight maturity level does not automatically carry over to the Essentials, but your controls and current evidence do. ASD's own table of how each Essential Eight concept translates is in our transition guide.

Does the Essential Eight still apply?

Yes, wherever an obligation requires it. ASD's launch announcement says:

ASD has set no end date. It is talking with regulators and will advise on transition expectations in due course. Our Essential Eight guide and Essential Eight controls stay available while the transition runs.

Commonwealth entities and the PSPF

Government policy has not changed yet. The Australian Government's Protective Security Policy Framework (PSPF Release 2026) still requires non-corporate Commonwealth entities, such as federal government departments, to reach Essential Eight Maturity Level Two. As at 15 October 2026, none of the PSPF documents we reviewed mentions the ASD Essentials.

What to do now

If you use the Essential Eight today, here is where ASD says to start.

Steps 3 and 4 are the first two of ASD's six transition steps. Our transition guide sets out all six.

Either way, plan the work with Scoping assets into domains and Implementing the Essentials. For every action, our ASD Essentials for enterprise IT catalogue adds plain-English guidance, implementation tips, audit tips and mappings.