The threat has grown
Cyber threats affect organisations of every size and sector. Advanced attack methods are widely used, and attackers can come in through suppliers and service providers.
ASD Essentials
Understand
The ASD Essentials for boards and executives.
The ASD Essentials changes what boards hear about cyber security, and makes their accountability for it more explicit. This page explains it in plain English: what changed, what to ask your team, what good reporting looks like and how to fund the work.
Reviewed 17 October 2026 · Current to ASD's The Essentials for senior executives, published 15 October 2026
The one-minute version
Short enough to paste into a board paper.
The ASD Essentials in one minute
ASD released the ASD Essentials on 15 October 2026 as an evolution of the Essential Eight.
It sets outcomes, not products: principles (what to achieve), actions (what to do) and domains (where the work applies).
The Essentials has no maturity levels: each action is rated in each domain it applies to. "Not assessed" means not checked yet, or not enough evidence to decide. It is neutral, not a failure.
Priority phases are ASD's recommended order for tackling the technical domains. They show scope, not how secure the organisation is.
Essential Eight work still counts, but ASD says it should be checked against the new actions, not assumed to be equivalent.
The board or executive committee is accountable for cyber security, including how much risk to accept (risk appetite), and oversees resourcing. An assessment can now check this, in the Governance and culture domain.
There is no finish line. Ask your team for a baseline of where you stand (counting Essential Eight work), agreed reporting, and funding that separates building, running and assessing costs.
Why ASD changed its approach
Technology is more varied
Enterprise IT, cloud and operational technology (OT) can each need a different route to the same security outcome.
Fixed lists can fall behind
A fixed set of controls, like the Essential Eight, does not always fit every environment or keep up with change. AI is a clear example.
So the Essentials sets the outcomes and leaves the "how" to you, with a chapter for each kind of environment (see Which chapter applies to you?).
What is different for your organisation
The Essentials is built from principles (the outcome), actions (what to do) and domains (groups of business functions and assets that share similar risks).
| Topic | Essential Eight | ASD Essentials |
|---|---|---|
| What you aim for | A maturity level target. | Effective outcomes in every domain, reached phase by phase. |
| What gets measured | Whether specific controls are in place. | Whether each action works for the assets in each domain. |
| What the board sees | A single maturity level. | Principle ratings and a percentage score for each domain, grouped by priority phase, with a detail view of the gaps. |
| The board's role | Governance was not part of an Essential Eight assessment. | Formal accountability, which can be assessed in the Governance and culture domain. |
Domains and the order ASD recommends
The enterprise IT chapter has eight domains. The six technical domains are worked through in three priority phases, in the order ASD says brings the biggest and fastest drop in risk (how the phases work). The two capability domains run across all phases.
Priority phase 1
Boundary services
Identity services
Priority phase 2
Critical processes and services
Privileged environments
Priority phase 3
Business systems
User devices
Across all phases
Governance and culture
Visibility and response
A statement such as 'we have reached priority phase 2' describes implementation scope, not how secure the organisation is.
Why each domain matters
Our plain summary of the risk ASD links to each domain.
Without clear owners and accountability, security decisions can be inconsistent and controls can weaken over time.
Poor visibility and response can delay finding, analysing and containing intruders.
Internet-facing systems and edge devices, such as firewalls, are scanned and attacked all the time. They are a common way in.
An attacker who controls sign-in and access systems can gain lasting or privileged access across the organisation.
Critical processes and services
Compromise or loss of the systems behind your core services can disrupt those services, and may affect health and safety.
An attacker in your admin systems can gain wide control over your systems, services and security controls.
A breach of the everyday systems that keep the organisation running can disrupt day-to-day work and open a path to more sensitive or critical systems.
Staff laptops and desktops are everywhere and exposed, so they are a common entry point.
Your Essential Eight work carries forward
ASD says the Essentials builds on the Essential Eight rather than replacing work already done. Existing controls count where they achieve an action's outcome. But ASD says to assess them against the new framework, not assume they are equivalent.
Ask your team which controls already meet an action, which need extending and what is new. Keep approved security improvement work going: ASD does not recommend slowing or stopping it, but says to check how it lines up with the Essentials as you go. Do not start new work only to reach a superseded Essential Eight target, unless a regulator or other obligation still requires it or it still addresses material cyber security risk.
Our page on moving from the Essential Eight sets out ASD's starting points and crosswalk.
The board's accountability
ASD's Implementation planning guide points to three governance principles that make the executive role explicit. ASD's guidance on AI adds a fourth.
GOV-01
Executive cyber security accountability
The board or executive committee is accountable for cyber security. That includes setting, monitoring and adjusting risk appetite.
GOV-03
Security risk management assurance
Cyber risk management sits inside your normal risk framework. The board or executive committee keeps checking that it works.
GOV-04
Cyber security resourcing
You identify, get and keep enough suitable people and resources. The same executive body keeps checking this.
GOV-08
Executive artificial intelligence accountability
The board or executive committee is accountable for making sure AI is secure, stays under control, is supervised by people and is used ethically and accountably.
Our AI guide covers the approvals and reviews behind it.
Executive commitment is now assessable content within the Governance and culture domain, and the framework requires sustained executive engagement to enable effective security outcomes for the organisation.
In practice, action IT.GOV-01.1 asks you to formally define the board's and executives' accountabilities for cyber security, including setting, monitoring and adjusting risk appetite. It also asks you to review them on a set schedule. ASD's signs that this is fully effective include a named executive or board member with documented accountability, and reporting to the board or executives on a set schedule.
Questions to ask your team
ASD says you should ask these when a proposal reaches you, and again as the work goes on. Use the answers for investment, risk acceptance and reporting decisions. ASD says the list is not exhaustive. We have grouped its ten questions by theme; the numbers follow ASD's order.
Scope and priorities
Which of our key functions and assets sit in each domain? Which domains hold the assets that would hurt us most if compromised?
What specific risk reduction does the priority phase 1 spending buy? Which attack routes, seen in real incidents, does securing those domains disrupt for us?
Where does our plan depart from ASD's recommended order, and where is the documented, risk-based reason?
Money and people
What did our Essential Eight spending already buy us under the Essentials? What is genuinely new work, such as the governance principles and wider detection and response?
Once we reach priority phase 3, what will it cost to keep running, and what people and resources will we need? How will we review that against threat trends and incidents?
Assurance and reporting
When will we see the first posture report (a report on how secure we are now)? What will it cover, and what will it list as not assessed? Are the reasons for not assessing those assets sound?
How will we check that controls actually work? Will we use independent assessment or simulated attacks, and how often?
How are exceptions, compensating controls (stand-in controls that get the same security result when an action cannot be applied) and accepted risks governed? Who owns each one, when does it expire, and when do we re-approve or close it?
Getting through the transition
What disruption should staff and operations expect during the work, and how will it be managed?
How will we keep meeting our current regulatory reporting duties during the transition?
ASD's original wording
Questions senior executives should ask, quoted
- Which of our key functions and assets sit in each domain, and which domains hold the assets whose compromise would be most consequential for the organisation?
- What did our Essential Eight investment buy us under the ASD Essentials framework, and what is genuinely new work, such as the governance principles and the expanded detection and response capability?
- When will we see the first posture report, what will it cover and what will be reported as not assessed? Are the reasons justified for the assets deemed not assessed?
- What specific risk reduction do priority phase 1 investments provide? Which observed attack paths does hardening those domains disrupt for us?
- Where does the plan depart from ASD's recommended sequencing, and what is the documented, risk-based justification?
- How will effectiveness be validated, and will independent assessment or adversary-simulation testing be used, and on what cycle?
- What are the ongoing operational costs and resourcing needs once priority phase 3 is reached, and how will resourcing be reviewed against threat trends and incident outcomes?
- How are exceptions, compensating controls and accepted risks governed? Who owns them, when do they expire and when do we re-approve or close them?
- What are the anticipated disruptions to operations and user experience during implementation, and how will they be managed?
- How will we continue to meet our current regulatory reporting obligations during the transition?
ASD, The Essentials for senior executives
What good reporting looks like
ASD says board reports should show how many principles in each domain sit at each rating, plus a percentage (we call it the domain score). Each principle takes the lowest of its action ratings in that domain. It then scores 1 if fully effective, a half if partially effective and 0 if not effective. The percentage is the total divided by the number of applicable principles (see how scoring works).
ASD's Implementation planning guide recommends agreeing four things at the start:
A standard format, by priority phase and domain.
A radar chart for the board (a web-shaped chart with one spoke per domain), with each new assessment drawn over the last to show change.
A detail view of principles rated partially effective or not effective, with the fix under way.
Honest use of "not assessed" as a neutral status (not checked yet, or not enough evidence to decide), always kept separate from "not effective" (checked, and not working).
Cyber security posture, second assessment
Example onlyRating key.
Fully effectivePartially effectiveNot effectiveNot assessedLast assessment
| Domain | Principles by rating | Domain score |
|---|---|---|
| Across all phases | ||
| Governance and culture7 principles | 3 fully effective,3 partially effective,1 not effective | 64%was 43% |
| Visibility and response10 principles | 4 fully effective,4 partially effective,2 not effective | 60%was 45% |
| Priority phase 1 | ||
| Boundary services16 principles | 9 fully effective,5 partially effective,2 not effective | 72%was 50% |
| Identity services16 principles | 7 fully effective,6 partially effective,3 not effective | 63%was 41% |
| Priority phase 2 | ||
| Critical processes and services16 principles | 16 not assessed, no score yet | |
| Privileged environments16 principles | 16 not assessed, no score yet | |
| Priority phase 3 | ||
| Business systems13 principles | 13 not assessed, no score yet | |
| User devices10 principles | 10 not assessed, no score yet | |
Detail view (excerpt)
Boundary servicesPRO-13 Identity, credential and access managementNot effective.
Turn on phishing-resistant multi-factor authentication for the contractor portal, which still accepts a password alone from outside the network. Owner: head of IT. Due before the next assessment.
Visibility and responseDET-02 Cyber security event detectionPartially effective.
Add alerts for unusual sign-ins. Owner: head of security. Due in six months. Until then the gap is a recorded accepted risk that expires on the due date.
Note the honest parts: the phase 2 and 3 domains show "not assessed", not zero, and the detail view names the gaps behind each score. ASD says charts should never be shown without that detail.
The business case and funding
ASD built the framework to show measurable progress early: the first phases disrupt common attack methods within a contained scope of work.
Fund it in tranches that follow the phases
ASD suggests funding tranches that mirror the priority phases, so every item matches something the board later sees reported. The three tranches below are ASD's example for enterprise IT. Cost each tranche in three parts:
- Build
- Tools, licences and engineering.
- Run
- The ongoing people and process cost.
- Assess
- Your own assessments. ASD does not require an independent assessor, but advises an independent check from time to time, especially where you need outside assurance.
Tranche 1
- Boundary services
- Identity services
Also sets up the two capability domains.
What you are buying:
Disrupts the most common ways attackers get in and gain more access. Sets up the governance, detection and assessment that later phases depend on.
Tranche 2
- Critical processes and services
- Privileged environments
The capability domains are extended.
What you are buying:
Strengthens the systems that would hurt most if compromised, and the admin access used to run them.
Tranche 3
- Business systems
- User devices
The capability domains reach full coverage.
What you are buying:
Covers the rest of the environment, limiting what an attacker can do from any foothold.
There is no finish line. Upkeep (sustainment) starts as each tranche's controls go live and carries on after the last phase: maintaining, reassessing and refining controls. So the business case should show the implementation program's end date and the ongoing running cost separately.
Plan running costs from day one. ASD says this helps stop controls decaying for lack of funding, and reassessments will find any that are not maintained. The framework sets no implementation timeframes, so you move through the phases at a pace that suits your capability, resources and risk.
Our guide Implementing the Essentials covers the tranches and how to cost them in more detail.
Frequently asked questions
Common questions from boards and executives, answered from ASD's publications.
Do we need to stop our Essential Eight work?
No. ASD does not recommend slowing or stopping approved security improvement work, but says to check how it lines up with the Essentials as you go. ASD also says not to start new work only to reach a superseded Essential Eight target. The exceptions are work a regulator or other obligation still requires, and work that still addresses material cyber security risk (see "Your Essential Eight work carries forward").
Is the ASD Essentials mandatory?
ASD has not said who must adopt it or by when. It says it is talking with regulators and will advise on expectations for the transition in due course. Meanwhile, keep meeting your current legal and regulatory obligations and follow any direction from your regulators. Under the Protective Security Policy Framework (PSPF), federal government departments and other non-corporate Commonwealth entities must still reach Essential Eight Maturity Level Two.
What if we cannot fund every tranche now?
ASD says the early phases are built to show measurable progress in a realistic time. Any deferral should be a documented, risk-based decision, and ASD does not recommend skipping domains or deferring phases indefinitely.
Sources
The ASD publications this page explains.
- The Essentials for senior executives (on cyber.gov.au)
- The case for change (on cyber.gov.au)
- Implementation planning guide (on cyber.gov.au)
- AI considerations within the Essentials (on cyber.gov.au)
- Frequently asked questions (on cyber.gov.au)
- Transitioning from the Essential Eight (on cyber.gov.au)
- Assessment process guide (on cyber.gov.au)
- Essentials for enterprise IT (on cyber.gov.au)
- PSPF Release 2026 (PDF) (on protectivesecurity.gov.au)
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
Everything else on this page is written by Control Stack.