If you've worked with us on cyber security, you've probably heard us mention the Essential Eight. It's the Australian Government's set of practical protections against cyber attacks, such as keeping software patched, using multi-factor authentication and keeping good backups.

On 15 October 2026, the Australian Signals Directorate (ASD) launched ASD Essentials, which it describes as "an evolution of Australia's widely adopted Essential Eight framework". New frameworks can sound daunting, so here's what has changed, what hasn't, and what it means for you.

What has changed

ASD Essentials takes the ideas behind the Essential Eight and organises them into a series of focused "chapters" for different kinds of technology:

• Essentials for enterprise IT: the direct evolution of the Essential Eight, covering the computers, accounts and systems most businesses run.

• Essentials for operational technology (OT): for critical infrastructure operators protecting things like industrial control systems.

• Essentials for cloud: for organisations whose technology runs entirely on cloud services (software-as-a-service and platform-as-a-service).

There are two main differences from the Essential Eight.

1. A focus on outcomes, not maturity levels. The Essential Eight gave organisations a maturity level (One, Two or Three). ASD Essentials instead checks whether each security action actually achieves its intended outcome, rating it not assessed, not effective, partially effective or fully effective. ASD is clear that existing Essential Eight maturity levels "do not automatically convert" into the new ratings.

2. A clear order of priorities. ASD suggests tackling the most important areas first. Governance and culture, visibility and response, internet-facing "boundary" systems and identity (your accounts and sign-ins) come first. Critical processes and privileged environments follow, then business systems and staff devices.

Why ASD made the change

Technology has moved on since the Essential Eight was created. Most businesses now rely on cloud services, Microsoft 365 and remote working, and attackers increasingly target accounts and internet-facing systems. ASD says the Essentials are designed to help organisations strengthen their defences "in a way that aligns with their risk profiles and operational requirements".

What it means for small businesses

Here's the reassuring part. ASD says the Essentials are aimed at Commonwealth entities, critical infrastructure owners and operators, and large organisations. ASD also says that until regulators announce any changes, organisations "should continue to meet their current regulatory obligations".

For most Sydney and NSW small businesses, there's no new rule to follow today. We still recommend the Essential Eight for every business, and for certain industries we strongly recommend it. If a contract, insurer or regulator asks you for the Essential Eight, that request still stands, and ASD is keeping both frameworks on cyber.gov.au during the transition.

What stays the same

• Your existing work still counts. ASD says Essential Eight investment "remains valuable", and many existing controls contribute to the new framework.

• The basics haven't changed. Patching, multi-factor authentication, limiting admin access, application control and backups all remain important.

• The Essential Eight is still available, alongside ASD Essentials, while organisations transition.

One honest caveat: ASD also notes that the new framework applies some controls more broadly and adds areas the Essential Eight didn't directly cover. So it's worth checking where you stand rather than assuming you're already covered.

Simple next steps

1. Don't panic, and don't start from scratch. ASD specifically warns against throwing away work you've already done.

2. Keep meeting any current requirements. If an insurer, customer or contract mentions the Essential Eight, carry on as normal.

3. Start with sign-ins and internet-facing systems. These are ASD's first priorities, and they're good security in any case.

4. Ask for a quick gap check. ASD recommends mapping your existing controls to the new framework and identifying what's left to do.

How iHelp IT can help

Our cyber security work has always been aligned with the Essential Eight, and iHelp IT is SMB1001 Gold certified. For every managed client, we already handle patching and multi-factor authentication on every account, which covers much of the groundwork.

If you'd like to know how your business measures up against ASD Essentials, we can map your current setup to the new framework and give you a simple, prioritised plan. There's no jargon and no pressure, just a clear picture of where you stand.

Have a question, or want a readiness check? Call us on (02) 8213 4225 or email support@ihelpit.com.au. You do business. We do IT.

Sources

• Australian Signals Directorate, ASD Essentials: evolving our approach to cyber security resilience (15 Oct 2026)

• ASD's ACSC, Transitioning from the Essential Eight (15 Oct 2026) (PDF)

• ASD's ACSC, The Essentials for senior executives (15 Oct 2026)