Is the Essential Eight Being Replaced? What ASD Essentials Means for AI
Picture the IT manager who spent two years getting their organisation to Maturity Level Two, then opened the news in October to find “Essential Eight” and “replaced” in the same sentence. The concern is understandable, but the transition does not make that work redundant.
The short answer
Yes, ASD is replacing the Essential Eight with ASD Essentials, but transition arrangements are still being developed. In October 2026 the Australian Signals Directorate (ASD) released ASD Essentials, a new set of cyber security guidance that grows out of the Essential Eight. The Essential Eight remains published alongside it. ASD has not yet announced a date by which organisations must move, so continue to meet your existing obligations.
Continue relevant security improvements while reviewing how planned work aligns with ASD Essentials.
If you want a refresher on the eight controls themselves, we covered them in our 2023 guide and our shorter Essential 8 explainer. This post is about what has changed since.
What ASD actually published
ASD Essentials launched with three chapters. Enterprise IT covers the everyday business environment of laptops, servers and office networks, and it is the direct evolution of the Essential Eight. Operational technology covers the machinery and control systems used by industrial and critical infrastructure operators. Cloud covers organisations that run on software-as-a-service and platform-as-a-service. Organisations should review the chapters relevant to their environment. Businesses using cloud services may need both the enterprise IT and cloud chapters.
Three changes matter most.
Domain-based effectiveness ratings replace the maturity ladder. The Essential Eight rates an organisation from Maturity Level Zero to Three, which gives you one number to quote. According to iTnews, ASD Essentials has organisations report area by area, such as identity services or internet-facing systems, with each area rated for effectiveness and backed by evidence like independent testing and simulated attacks. ASD’s priority phases set the recommended implementation order; they are not maturity levels or security ratings. Once an organisation moves to the new framework, “we are Level Two” will no longer be a complete answer.
Outcomes replace prescribed controls. The framework describes what good looks like and leaves the method to the organisation, although ASD’s examples stay specific. One is phishing-resistant multi-factor authentication, meaning sign-in methods such as FIDO2 passkeys and security keys that bind authentication to the legitimate service, helping prevent fake login sites from capturing reusable credentials.
The implementation priorities are changing. The enterprise IT chapter has six technical domains, grouped into priority phases, and two capability domains, Governance and culture and Visibility and response, that apply throughout. The first phase covers identity services and boundary services. Boundary services include internet-facing services and edge devices, which are the firewalls, VPN gateways and routers that sit between your internal network and the outside world. Weaknesses in these services can give an attacker initial access, and ASD’s Australian Cyber Security Centre has said AI is helping attackers work at greater scale and speed. The framework also asks organisations to formally define executive and board-level accountability for cyber security.
What has not changed
The Essential Eight remains published. According to iTnews’ October 2026 reporting, government agencies will be assessed against both frameworks in 2027. Existing Essential Eight controls and evidence remain useful, but they do not automatically satisfy the new framework’s broader requirements. Its transition guide notes actions in the enterprise IT chapter with no direct Essential Eight equivalent, including credential exposure, supply chain security and the two capability domains, so a gap analysis is still needed.
ASD has not yet published a transition deadline. Continue meeting any regulatory, contractual, tender or insurance requirements that specify the Essential Eight until those requirements are formally changed.
Does the Essential Eight cover AI?
ASD designed the Essential Eight to protect internet-connected IT networks, and it was last updated in November 2023. It provides useful baseline protections for systems that host or connect to AI, but it is not a complete guide to AI security. AI agents add risks such as prompt injection, where text hidden in a web page, email or document tries to give the AI instructions, and misuse of the permissions an agent has been granted. Those need measures beyond the eight strategies.
ASD’s AI considerations within the Essentials explains how the framework applies whether an organisation consumes, develops or deploys AI. It covers AI assets, agent identities, permissions, prompt injection, logging and executive accountability. For agentic AI, meaning AI that takes actions rather than only answering questions, there is joint guidance co-authored with partner agencies in May 2026, Careful adoption of agentic AI services, and ASD’s Agentic AI harnesses guide. The harness is the software layer that connects an AI model to your tools and data. The recurring themes are least-privilege access, strong identity management for agents, human oversight of sensitive actions, and logging and accountability.
The eight controls, with an AI agent in the chair
This section offers practical examples of how Essential Eight controls relate to AI agents. It is our interpretation, rather than an ASD assessment checklist. An agent is an AI tool that has been given access to your systems and instructions to act. Depending on its configuration, it may act automatically or require human approval before taking particular actions.
Restrict administrative privileges is an important control for agents that can reach business systems or perform administrative tasks. An agent’s access depends on its identity, how it is connected and the permissions it has been granted, so an administrator setting one up does not automatically give it administrator rights. Connecting it through a privileged account can still create unnecessary exposure, so check what it can actually reach instead of assuming it is limited to the task. ASD’s agentic AI guidance points the same way: limit each agent to the minimum access its approved tasks need. For example, an employee might connect an AI tool to their work account to save time without reviewing the permissions it requests or the data it could reach.
Multi-factor authentication looks different for agents. Unattended agents need authentication arrangements suited to software identities, while the people who configure and manage them still need strong MFA. Depending on the platform, an agent may use delegated user access, a managed identity or other application credentials. Each arrangement needs appropriate access controls, monitoring and a clear way to revoke access quickly. Protect the accounts used to configure and manage agents with phishing-resistant MFA, particularly where they can grant access to sensitive systems or data.
Application control already asks which software is allowed to run. With AI, the question extends to which tools may connect to company data, because agents arrive as apps, browser extensions, plug-ins and connectors, often installed by individuals. Maintain an approved tool list, supported by controls for installation, consent, data access and periodic review. We cover the data side in our post on shadow AI.
Patch applications starts with a less glamorous job. Record AI applications, extensions and integrations so ownership, support status and security updates can be managed. Unknown assets are harder to manage reliably, so the inventory comes first.
User application hardening has a new item on the list. Browsers increasingly include AI assistants, and some can read pages and act on them. That makes prompt injection a browser question as well, since a web page can carry text aimed at the assistant reading it. Review what the browser’s AI is allowed to see and do.
Restrict Microsoft Office macros has a modern cousin. Macros were popular with attackers because they let a document carry its own instructions. Scripts and automated workflows generated by AI tools are an additional software execution risk. They do not replace the Office macro control, but the same habit applies: block by default and approve deliberately.
Regular backups matter because an agent with edit or delete permissions can cause widespread changes quickly. Both accidental changes and malicious actions can require recovery from backups. Backups should be restorable to a point before the agent acted, tested, and kept out of reach of the agent’s account.
Patch operating systems remains relevant wherever AI tools run on organisation-managed devices or servers. Keep those operating systems supported and apply security updates according to risk.
What we would do this quarter
- Continue relevant security improvements, and review how planned work lines up with ASD Essentials. ASD has said existing Essential Eight work counts towards the new framework, although Essentials introduces additional requirements.
- Look at identity and boundary services first. They are the first priority phase, and common pathways for initial access.
- Record the AI tools, extensions and integrations already in the business. For each one, note the owner, connected systems, granted permissions and access to sensitive data.
- Name an executive owner for cyber security. Essentials asks for it, and it is a good idea regardless.
- Read ASD’s transition guide before changing how you report. ASD released it alongside the framework and has workshops planned.
Where Affinity MSP fits in
Affinity MSP helps businesses strengthen their security through the Essential Eight. ASD’s transition guidance gives a basis for reviewing which existing controls and evidence can support alignment with ASD Essentials. AI adoption also needs to account for identity, permissions, data access and ongoing oversight.
AffinityScan offers a free first look at your organisation’s publicly visible exposure. It does not establish Essential Eight maturity or ASD Essentials effectiveness. You can contact Affinity MSP to discuss Essential Eight services, your existing controls and current obligations.
Frequently asked questions
Is the Essential Eight being replaced?
Yes. ASD is replacing the Essential Eight with ASD Essentials, but transition arrangements are still being developed. ASD launched ASD Essentials in October 2026, and the Essential Eight remains published alongside it.
Do I still need to meet the Essential Eight?
Continue meeting any regulatory, contractual, tender or insurance requirements that specify the Essential Eight until those requirements are formally changed.
Does the Essential Eight cover AI?
Its controls provide useful baseline protections for systems that host or connect to AI, but additional safeguards are needed for AI-specific risks. ASD’s Essentials framework applies whether an organisation consumes, develops or deploys AI, and ASD has published supporting guidance, including joint guidance on agentic AI.
Is ASD Essentials mandatory?
ASD has not announced a universal transition deadline. Requirements depend on the government policies, regulations and contractual obligations that apply to your organisation.
How does Affinity MSP help with the Essential Eight changes?
Affinity MSP provides Essential Eight services. Contact our team to discuss your existing controls, current obligations and preparation for ASD Essentials.
