ASD published Essentials for enterprise IT on 15 October 2026 as the evolution of the Essential Eight. It sets out 28 principles and 58 actions across eight domains, rated on whether each action achieves its outcome, and it replaces the Essential Eight maturity levels. ASD has not set a date to retire the Essential Eight, and organisations should keep meeting any regulatory, contractual or other obligation that requires it.
For procurement teams the practical point is narrow and urgent. Many tenders and supplier contracts cite the Essential Eight by name, and that wording now points at guidance ASD is moving beyond. This page explains what Essentials for enterprise IT contains, what it changes for supplier requirements, and the contract wording that keeps an agreement workable on either side of the change.
What is Essentials for enterprise IT?
Essentials for enterprise IT is the first chapter of ASD Essentials, a series of environment-specific cyber security guidance. ASD launched the series on 15 October 2026 with three chapters: enterprise IT, operational technology and cloud. The enterprise IT chapter is the evolution of the Essential Eight, written for organisations running corporate technology environments.
ASD had opened consultation on the evolution on 15 June 2026 and closed it on 12 July 2026. The guidance remains grounded in the Information Security Manual, and its principles trace back to ISM controls.
How is Essentials for enterprise IT built?
The chapter has three layers. Principles state a security outcome. Actions are the steps that deliver it. Domains group them by business function or asset. There are 28 principles, 58 actions and eight domains, applied in three priority phases:
| Domain | Priority phase |
|---|---|
| Governance and culture | All phases |
| Visibility and response | All phases |
| Boundary services | 1 |
| Identity services | 1 |
| Critical processes and services | 2 |
| Privileged environments | 2 |
| Business systems | 3 |
| User devices | 3 |
What replaces the Essential Eight maturity levels?
Each action is rated on a four-tier, outcome-based scale: not assessed, not effective, partially effective or fully effective. A principle takes the lowest rating of the actions under it. The question moves from “which maturity level are we at?” to “does this action achieve its outcome in our environment?”
Existing Essential Eight evidence can be reused where it is current and relevant. ASD’s message is that deploying a control does not by itself show it is effective, so evidence of how a control behaves on your systems matters more than a list of products.
What happens to the Essential Eight?
All eight Essential Eight strategies map to principles in the new chapter, so patching, application control, multi-factor authentication, restricting administrative privileges and backups remain core. ASD has not published a retirement date for the Essential Eight and has said it will advise on transition expectations in due course. Until a regulator, contract or insurer says otherwise, an obligation that names the Essential Eight still stands.
The current Essential Eight and its assessment process guide remain published by ASD.
What is new that matters for procurement?
Independent summaries of the chapter report that 23 of the 58 actions cover outcomes the Essential Eight did not directly address, including governance, awareness training, supply chain security and AI systems as assets. Three principles bear directly on how you buy:
- Supplier cyber security assurance (principle GOV-11). Suppliers of software, hardware and services are selected on the basis of a cyber supply chain risk assessment, and assurance that they keep meeting their commitments is maintained over time. In practice that is a requirement to assess before you sign and to keep checking afterwards.
- Cyber supply chain security (principle PRO-16). The integrity and authenticity of software, components and updates are assessed before use, and vendor advisories and threat intelligence are used to track supplier exposure.
- Executive accountability for AI (principle GOV-08). An executive is accountable for the use, governance and risk of artificial intelligence, which affects how AI features inside supplier products are evaluated.
These are principle titles and summaries as reported from the chapter. Check ASD’s published wording before quoting an action in a tender.
What should contracts say now?
A contract that says a supplier must “achieve Essential Eight Maturity Level Two” cites a framework whose maturity levels do not carry into the new chapter. You do not need to rewrite every agreement this week. You do need new tenders and renewals to be drafted so they work either side of the change.
| Clause | What to write |
|---|---|
| Standard cited | Name the current ASD guidance and add “or its successor as published by ASD”. |
| Outcome required | State the outcome or rating you need for the relevant actions, not only a framework name. |
| Evidence | Require evidence from your own environment, such as configuration review or testing, not general statements. |
| Supplier assurance | Ask how the supplier selects and assures its own suppliers, and how it assesses the integrity of software and updates. |
| Change | Add a review clause: if ASD guidance changes in a way that affects the service, the parties agree within a set period how alignment will be shown and who pays for any uplift. |
| Exit | Keep the right to end the service if the supplier cannot show alignment after a change. |
This is drafting guidance, not legal advice. Have your legal team confirm the wording against your contract template and regulator.
What should Australian organisations do now?
Keep meeting current obligations
If a regulator, contract or insurer requires the Essential Eight, keep implementing and assessing it until they announce changes. APRA-regulated entities should keep working to the prudential standards that apply to them and watch for APRA’s position.
Map existing evidence to the new principles
Take your current Essential Eight evidence and map it to the principles and actions it supports. Note where evidence is current and relevant, and where an action has no evidence at all. That gap list is your transition plan.
Choose the chapters that apply
Most organisations will start with enterprise IT. Those using software-as-a-service and platform-as-a-service heavily should read the cloud chapter, and critical infrastructure operators the operational technology chapter. ASD’s reading guide explains where to begin.
List which contracts and insurers cite the Essential Eight
Build a register of tenders, supplier agreements, customer commitments and insurance questionnaires that name the Essential Eight. Each is a place where wording will need to change at renewal, and the list tells you which to tackle first.
Avoid buying tools on the label alone
Do not buy a product because it is marketed as ready for Essentials for enterprise IT. Evaluate technology against your own requirements, current threats, architecture, integration needs, evidence quality and commercial value. Effectiveness is shown on your environment, not in a brochure.
Procurement implications for technology and security providers
- Requirements should be outcome-led. Avoid locking a procurement to one product architecture when several approaches can meet the security objective.
- Evidence should be contractually available. Confirm who can provide configurations, logs, test results, assurance reports and remediation records.
- Control responsibility must be explicit. Shared-responsibility models should name the client, provider and vendor obligations for every relevant control.
- Change needs a commercial path. Contracts should say how new guidance, configuration changes and uplift work will be scoped, governed and priced.
- Claims need independent evaluation. Marketing labels are not a substitute for tested control effectiveness.
How CYBORIUM can support an evidence-ready transition
CYBORIUM helps Australian organisations define requirements, evaluate the market, compare providers and create a defensible procurement decision. The approach is independent and vendor-neutral. The selected provider pays CYBORIUM a capped fee at an agreed percentage, providers that are shortlisted but not selected pay nothing, and you contract directly with the provider. The decision is always yours.
For this transition, that can include requirements prioritisation, mapping controls to providers, evidence expectations, commercial benchmarking, vendor due diligence and negotiation support. CYBORIUM does not sell, deliver, operate, manage or invoice the selected technology.
Related guidance: Cybersecurity Vendor Evaluation Framework for Australian Enterprises, MoSCoW Requirements for Enterprise Technology Procurement and Information Security in Procurement.
Evaluating an uplift or provider proposal? Use CYBORIUM’s Essential Eight procurement evaluation preview to test scope, evidence, pricing and contract terms before you commit.
Frequently asked questions
What is Essentials for enterprise IT?
It is the first chapter of ASD Essentials, published on 15 October 2026. It evolves the Essential Eight into 28 principles and 58 actions across eight domains, rated by outcome instead of maturity level.
Has the Essential Eight been retired?
No. ASD has not set a retirement date and has said it will advise on transition in due course. Keep meeting any regulatory, contractual or other obligation that requires the Essential Eight until the relevant regulators announce changes.
Do maturity levels still exist?
Not in the enterprise IT chapter. Each action is rated not assessed, not effective, partially effective or fully effective, and a principle takes the lowest rating of its actions.
Do we need to change our contracts now?
Not necessarily. Draft new tenders and renewals so they work either side of the change: name the current guidance, add “or its successor as published by ASD”, require evidence, and include a review clause.
Which chapter applies to us?
Most organisations start with enterprise IT. Heavy users of software-as-a-service and platform-as-a-service should read the cloud chapter, and critical infrastructure operators the operational technology chapter.
How should procurement teams prepare?
Keep requirements outcome-led, make evidence contractually available, assess suppliers before signing and keep checking afterwards, and add a change clause for future ASD guidance.
Official sources and update status
- ASD, ASD Essentials: evolving our approach to cyber security resilience, the launch announcement.
- ASD Essentials series reading guide.
- ASD consultation on the evolution of the Essential Eight, first published 15 June 2026.
- ASD Essential Eight guidance.
- ASD Information Security Manual.
Information status: rewritten on 21 October 2026 after ASD published Essentials for enterprise IT. Counts, domain names and principle titles are as reported from the published chapter and independent summaries; check ASD’s chapter for exact wording. Review again when ASD announces transition arrangements for the Essential Eight.
Preparing a security procurement or provider evaluation? Speak with CYBORIUM about an independent, evidence-led pathway.
What should you do while the Essential Eight transition is unclear?
Keep meeting your current obligations, and write contract clauses that refer to the Essential Eight or its successor as published by ASD. Review again when ASD sets a date.
Planning this in the next year? Contact CYBORIUM or request a free market briefing.
Last updated:
