On 15 October 2026 the Australian Signals Directorate (ASD) published ASD Essentials, the framework that replaces the Essential Eight. Maturity levels are gone. Each security action is now rated on whether it works, one business domain at a time, and the rating depends on your evidence. A CREST-certified penetration test is one strong source of that evidence for controls an attacker can reach. This guide sets out what to keep, what to stop and what to start.
What actually changed on 15 October?
The Essential Eight scored you against maturity levels. ASD Essentials asks a different question: does each action achieve its intended outcome for the assets in each domain? Every action gets one of four ratings: not assessed, not effective, partially effective or fully effective. The enterprise IT chapter has 28 principles, 58 actions and eight domains. Separate chapters cover operational technology and cloud. ASD says the series is aimed at Commonwealth entities, critical infrastructure owners and operators, and large organisations. Each domain also gets a score: fully effective counts as 1, partially effective as half, and not effective as 0, divided by the principles that apply. ASD says boards can use that percentage to track progress.
Two details matter most. Your old result does not carry over. ASD says Essential Eight maturity levels do not automatically convert, and even Maturity Level Three does not automatically earn "fully effective". Also, one control can score differently by domain. For example, MFA might cover every staff laptop but miss the admin workstations that manage your servers. ASD's own guidance says an enterprise-wide control can be fully effective in one domain and only partially effective in another.
Maturity levels are out. Outcome-based domain effectiveness is in. An assessor will not ask what level you are; they will ask for evidence that the control holds where it matters most.
Do you have to switch now?
Not yet. Both frameworks stay on cyber.gov.au during the transition, and ASD has not set a mandatory changeover date. Any contract, policy or insurer that names an Essential Eight level still applies until that party says otherwise. ASD's first step is to record where you stand today: your Essential Eight results, existing controls, risk assessments and key business functions. It then advises mapping your existing and planned work to Essentials before deciding whether to carry on unchanged. ASD also advises against starting new work only to hit a superseded Essential Eight target, unless an obligation requires it or the work still reduces real risk.
What should you keep, stop and start?
KEEP: Your Essential Eight Programme & Evidence
Keep your Essential Eight programme and its evidence. The controls carry across as evidence even though the ratings do not. Our playbook on Essential Eight, SOC 2 and ISO 27001 testing for AU SaaS companies shows how one engagement can serve several frameworks.
STOP: Treating Maturity Levels as a Score
Stop treating a maturity level as a score, and stop treating priority phases as maturity levels. ASD calls priority phases a sequencing mechanism, not a rating. They tell you where to work first. They do not tell you how secure you are.
START: Collecting Evidence That Controls Keep Working
Start collecting evidence that controls keep working. Assessors weigh coverage, consistency, currency and evidence quality. Where evidence shows a control is deployed but not that it holds up, ASD's guidance says you may need testing, exercise results or monitoring records. Begin with the first technical domains in ASD's priority order: Boundary services and Identity services. That is where an attacker starts too.
Where does a penetration test fit?
A test turns "we have this control" into "we tried to beat it and could not". For each domain in scope, a tester can try to bypass MFA across every login path in Identity services, find and use exposed services in Boundary services, and escalate from an ordinary account in Privileged environments. A good test also records which of those steps your team detected. That speaks to Visibility and response.
Each result maps neatly to the rating language. A successful bypass is strong evidence for a "not effective" rating. A control that holds in one domain but leaks in another points to "partially effective", and ASD asks you to document the gaps and set remediation with defined actions and timeframes. That is what retesting and confirmed closure are for. A dated report plus a retest record gives an assessor current, independent evidence, and it reads well to a board.
Scope the test by domain, not by system list. Name the domains, the assets in each and the actions you want evidence for. Then ask your provider to report findings in the same language, domain by domain, so an assessor can reuse them without translation.
What can a test not prove?
A test is a sample at one point in time. It cannot rate Governance and culture, and it does not replace ASD's own assessment process, where an assessor decides the rating. Our guide to CREST-certified penetration testing in Australia explains what a CREST report adds to your evidence. If you supply Australian government or critical infrastructure customers, expect Essentials language in your next security questionnaire.
Book your free PTaaS demo and ask our CREST-certified testers to scope a test against your Identity services and Boundary services domains.
Frequently Asked Questions
What is ASD Essentials?
ASD Essentials is the framework ASD published on 15 October 2026 to replace the Essential Eight. It uses principles, actions and domains, and rates each action as not assessed, not effective, partially effective or fully effective. Chapters cover enterprise IT, operational technology and cloud.
Has the Essential Eight been withdrawn?
Not yet. Both frameworks remain published on cyber.gov.au during the transition, and no mandatory changeover date has been set. Obligations that name an Essential Eight maturity level still apply until the relevant authority says otherwise.
Do Essential Eight maturity levels convert to ASD Essentials ratings?
No. ASD says maturity level ratings do not automatically convert, and Maturity Level Three does not automatically earn a fully effective rating. Ratings come from assessing whether each action achieves its intended outcome in each domain.
Does ASD Essentials require a penetration test?
ASD asks for evidence that each action works. Testing is one form of evidence its guidance points to, alongside exercise results and monitoring records. A CREST-certified penetration test is a strong way to evidence controls an attacker can reach, such as MFA and exposed services.
Who is ASD Essentials written for?
ASD says it is for Commonwealth entities, critical infrastructure owners and operators, and large organisations. The Essential Eight stays published during the transition, so other organisations and anyone with an Essential Eight contract requirement can keep using it.
