CTEMASD EssentialsEssential EightAustraliaSOCI Act
5 views

ASD Essentials and CTEM: How to Move On From the Essential Eight

By Heeraj NairPublished
ASD Essentials: prove it, domain by domain. Diagram of the six ASD Essentials domains in three priority phases.
On 15 October 2026, the Australian Signals Directorate published the successor to the Essential Eight. Nothing in your environment changed overnight. What changes is the question you will be asked. It is no longer which maturity level you reached. It is whether each control works, domain by domain, and what evidence shows it.
That is the short answer. The rest of this post covers what actually changed, why ASD starts at the internet-facing edge, how CTEM's five stages map onto the new framework, an eight-step transition plan, and what it means if you report under the SOCI Act.

Key findings

  • ASD rates each action, in each domain, as not assessed, not effective, partially effective or fully effective. Essential Eight maturity levels "do not automatically translate" into these ratings.
  • Priority phase 1 is boundary services and identity services, because they are "common pathways for adversaries seeking initial access".
  • In FY2024–25, ASD's ACSC observed more than 120 incidents involving attacks on edge devices, and 96% were successful.
  • No mandatory date has been set. ASD expects the regulatory transition to run over the next year or two, and government agencies will be assessed against both frameworks next year.

What is ASD Essentials?

ASD Essentials is a framework from ASD's Australian Cyber Security Centre (ACSC), described as "an evolution of the Essential Eight". The first chapter, ASD Essentials for enterprise IT, was published alongside transition guidance dated 15 October 2026. ASD's senior-executive overview lists separate chapters for enterprise IT, operational technology and cloud.
Every chapter uses the same model. A principle is the outcome you are trying to achieve, an action is what needs to be done to achieve it, and a domain is where it applies. The enterprise IT chapter has six technical domains, grouped into three priority phases:
  • Priority phase 1: boundary services and identity services. Boundary services are gateways and access points at network boundaries, "including internet-facing services and edge devices". Identity services cover directories, authentication and authorisation services, and credential stores.
  • Priority phase 2: critical processes and services, and privileged environments.
  • Priority phase 3: business systems and user devices.
Two capability domains, governance and culture and visibility and response, run across all three phases. The phases set the order of work. They are not a maturity model. In ASD's words, a statement such as "we have reached priority phase 2" "describes implementation scope, not how secure the organisation is".

Is the Essential Eight being replaced?

Yes, but slowly. In June 2026, ASD's Chris Horlyck told iTnews that ASD would "probably in 12 months, start to deprecate the Essential Eight, and then in 24 months" retire it. At the October launch, ACSC head Stephanie Crowe said the mandatory date is still being worked out with policy agencies over "the next year or two". Until then, the Essential Eight stays on ASD's website and government agencies will be assessed against both (iTnews, 15 Oct 2026).
Your existing work still counts. ASD says Essential Eight investment "remains valuable". It also says organisations "should assess those controls against the new framework rather than assume they are equivalent".

What actually changes from the Essential Eight?

The unit of measurement changes. The Essential Eight produced maturity levels. ASD Essentials rates each action within each domain. Assessors judge coverage, consistency, currency and evidence quality. "Not assessed" is a neutral rating and must stay distinct from "not effective".
Essential EightASD Essentials (enterprise IT)Where CTEM fits
Structure8 mitigation strategies with prescriptive requirementsOutcome-based principles and actions across 6 technical and 2 capability domainsAn operating model for finding and fixing exposures continuously
Posture expressed asMaturity levels (ML0–ML3)Four-tier effectiveness rating for each action in each domainProduces the evidence: exposure register, validation results, closure records
How targets are setChoose a target maturity level based on adversary tradecraftPriority phases set the order, starting with boundary and identity servicesCycle 1 scoped to the external boundary and identity exposure
ScopeApplied across the whole environmentEach action applied and assessed in every domain it maps toScoping and discovery, domain by domain
Asset identificationAsset discovery requirementsInfrastructure, operating systems, applications, identities, credentials and data as distinct assetsDiscovery: outside-in and inside-out inventory
Vulnerability treatmentPatching requirements tied to maturity levelRisk-based: exploitation, exposure, criticality, impact and compensating controls, with treatment verifiedPrioritisation and validation
EvidenceAssessment against specific requirementsProof a control keeps achieving its outcome, not just that it was deployedContinuous re-testing keeps evidence current
The enterprise IT chapter also adds outcomes the Essential Eight never directly covered. ASD names credential exposure, cyber supply chain security, content filtering, and governance principles such as executive accountability and supplier cyber security assurance. Visibility and response becomes a domain of its own.

Why does ASD start with the internet-facing edge?

Because that is where attackers get in. In its Annual Cyber Threat Report 2024–25, ASD's ACSC said that in FY2024–25 it:
  • observed more than 120 incidents involving attacks on edge devices, 96% of which were successful
  • saw the number of publicly reported CVEs increase by 28%
  • responded to over 1,200 cyber security incidents, an 11% increase on the previous year.
The report also tells a short story. Through its Cyber Hygiene Improvement Programs (CHIPs), ASD found hundreds of Australian entities using an edge device with a critical vulnerability and notified them. One major critical infrastructure provider patched after the alert. Within 48 hours, it watched attackers try to exploit the device and fail.
ASD's conclusion: "Reducing the overall internet-facing attack surface, and patching internet-facing systems quickly when critical vulnerabilities emerge, remain key strategies." ASD Essentials asks you to apply that discipline to your own boundary. Identify every asset, continuously, and treat weaknesses by risk.

How does CTEM map to ASD Essentials?

CTEM is a five-stage cycle: scoping, discovery, prioritisation, validation and mobilisation (see the 5 stages of CTEM). It does not replace ASD Essentials. ASD Essentials sets out what you must achieve. CTEM is one proven how, and it keeps the evidence fresh between assessments.
CTEM stageWhat ASD Essentials asks forEvidence you end up with
ScopingScope the priority phase 1 domains first, and formally define executive and board accountabilityA scope document listing boundary and identity assets, with owners
DiscoveryContinuously identify infrastructure, applications, identities, credentials and data, using automated discovery to detect new and changed assetsA live inventory of internet-facing assets, including ones nobody knew about
PrioritisationTreat vulnerabilities above defined risk thresholds based on exploitation, exposure, criticality, impact and compensating controlsA ranked exposure register with the reasoning recorded
ValidationEffectiveness claims backed by evidence such as testing, simulated exercises and monitoring recordsProof an exposure was reachable and, after the fix, that it is gone
MobilisationVerified treatment within defined timeframes; ISM, regulatory and other mandatory timeframes still applyTickets, owners, closure dates and re-test results
There is one more difference that matters. Vulnerability management counts CVEs. CTEM tracks any exposure an attacker can use: a leaked password, a forgotten subdomain, an exposed admin panel, a lookalike domain. That wider lens is what the new asset identification and credential exposure outcomes ask for (more in CTEM vs vulnerability management).

How do you move from the Essential Eight to ASD Essentials?

Follow ASD's transition pathway and priority phases. For a lean team, the first cycle takes about a quarter.
  1. Set your baseline and gap analysis. Record your current Essential Eight position: assessment results, controls, exception and risk registers, and planned uplift. Map each item to the relevant ASD Essentials action and classify it as already effectively addressed, partially addressed or not addressed. These are ASD's gap-analysis terms, not formal ratings. ASD also advises against starting new work just to reach a superseded Essential Eight target, unless a regulator or another obligation still requires it.
  2. Scope cycle 1 to priority phase 1. Limit the first CTEM cycle to boundary services and identity services, plus the two capability domains. Name a business owner and a technical owner for each, and agree who reports to the board.
  3. Discover your boundary from the outside in. Start from registered domains, certificate transparency logs, DNS, IP ranges, cloud accounts, and subsidiary or acquired brands. Find the subdomains, VPN and remote-access gateways, firewalls, exposed admin interfaces, APIs and staging sites. Compare the results with your CMDB. The gap between the two is your first finding (see what attackers can discover about you).
  4. Add identity exposure. Look for corporate credentials in breach dumps, infostealer logs and Telegram channels. Scan code, configuration files and collaboration platforms for unsecured secrets, which is an ASD action in its own right. Check which login pages face the internet and whether each enforces phishing-resistant MFA. A leaked session or password is a boundary exposure even when every patch is applied (see credential leak monitoring).
  5. Prioritise the way ASD asks. Rank by exploitation (is it on CISA's Known Exploited Vulnerabilities list, or being exploited now?), exposure (is it reachable from the internet?), asset criticality, likely impact and compensating controls. Don't rank by raw CVSS. Write down why each item sits where it does. That reasoning is evidence too.
  6. Validate before and after. Confirm that top exposures really are reachable and exploitable, using approved testing. After the fix, re-test from the outside. Validation is where many programs stall (see why CTEM programs stall at stage 3), and it is the kind of operational evidence an effectiveness rating relies on.
  7. Mobilise with owners and deadlines. Send each finding to the owning team's queue with the evidence attached. Apply the ISM, regulatory or internal timeframe that covers it. Track exceptions formally, with an owner and an expiry date.
  8. Rate, report and expand. Rate each phase 1 action using your validation evidence and report domain by domain (see how to present security risk to the board). Report what you have not yet assessed as not assessed, not as a pass or a fail. Then set a reassessment cadence and extend to phase 2 domains and key suppliers.
After 90 days you want four things: a boundary inventory you trust, a short list of validated exposures with dated closures, phase 1 ratings you can defend, and a cadence that keeps them current. Point-in-time scans can't give you the last one (see continuous monitoring vs monthly scans).

What about the SOCI Act?

If you are a responsible entity under the Security of Critical Infrastructure Act 2018, ASD Essentials matters in two ways.
First, the CIRMP Rules require entities covered by the risk management program obligation to comply with a listed cyber security framework, or an equivalent. One option is the Essential Eight Maturity Model at maturity level one. The Rules refer to these documents "as in force from time to time", and regulators have not yet said how the move to ASD Essentials will be treated. ASD's transition guidance says to keep meeting any obligations that require Essential Eight implementation or reporting. If your CIRMP names the Essential Eight, start mapping now and take advice before your next annual report.
Second, Systems of National Significance carry enhanced cyber security obligations, including vulnerability assessments and providing system information for a near real-time threat picture (CISC). A continuous, outside-in exposure register supports both. It also extends naturally to third-party risk assessment of your major suppliers, a supply chain hazard your CIRMP has to address.
For financial entities, see our guide to APRA CPS 234.

Is external attack surface management enough on its own?

No, and it is worth being clear about what each tool category covers.
External attack surface management (EASM) covers discovery and much of the prioritisation work for boundary services. It also covers part of identity services, through internet-facing login pages and credential exposure. It cannot see inside privileged environments, internal business systems or user devices, which make up phase 2 and 3. Endpoint, identity and configuration management tools do that work.
What internal tools can't answer is how your boundary looks from the outside right now. In a CTEM program, EASM is that outside-in input: it shows whether internal controls hold up from the attacker's side of the internet.

What most teams will get wrong

ASD's transition guidance lists these pitfalls itself. Each one has a CTEM answer.
  • Treating priority phases as maturity levels. "We're in phase 2" says where you are working, not how secure you are. Report effectiveness ratings instead.
  • Claiming equivalence instead of assessing. A control that met an Essential Eight requirement is evidence, not a rating. Re-test it.
  • Assessing the enterprise instead of the domain. A control can be fully effective in one domain and only partially effective in another. Scope by domain.
  • Ignoring the capability domains. Governance and culture, and visibility and response, start in phase 1, not after the technical work is done.
  • Trying to transition every domain at once. Effort spread across everything moves nothing. Start with boundary and identity.
  • Reusing stale evidence. Evidence only counts if it reflects the environment as it is today. Continuous discovery keeps it fresh.
  • Overlooking new requirements. Credential exposure and cyber supply chain security have no direct Essential Eight equivalent. Plan and resource them.

Key takeaways

  • ASD Essentials replaces maturity levels with evidence-backed effectiveness ratings, assessed action by action within each domain.
  • Priority phase 1 is boundary services (internet-facing services and edge devices) and identity services. That is where attackers get in.
  • Essential Eight work carries forward, but maturity levels do not convert into ratings. Run the gap analysis.
  • CTEM's five stages line up with what ASD asks for: scope, discover, prioritise by exploitation and exposure, validate, then remediate and verify.
  • You cannot rate a domain whose assets you have not identified. Start with an outside-in view of your boundary.

Is your phase 1 boundary ready?

Check these five things. You can answer each one from your own records this week.
  • ☐ Can you list every internet-facing service and edge device you run, including those in subsidiaries, acquired brands and vendor-hosted subdomains?
  • ☐ Have you mapped your Essential Eight controls to ASD Essentials actions and classified each as already effectively addressed, partially addressed or not addressed?
  • ☐ Do you know whether your staff's corporate credentials or sessions appear in breach dumps or infostealer logs?
  • ☐ Does every internet-facing login enforce phishing-resistant MFA?
  • ☐ For your top boundary exposures, do you have evidence of the fix, such as a re-test or monitoring record, rather than just a closed ticket?

What ScruteX finds here

ScruteX (formerly BrandSek) looks at your organisation from the outside, the way an attacker does. Vulnerability Insights continuously discovers your internet-facing assets and checks each one for exposed services, open ports, expired certificates, outdated technologies and dangling subdomains. It ranks findings by real-world exploitability rather than raw CVSS. Data Exposure Insights watches the dark web, paste sites, Telegram and breach corpora for credentials tied to your domain. Vendor Insights extends the same outside-in view to your suppliers.
Together they give you the boundary and identity-exposure evidence that priority phase 1 asks for, inside a CTEM platform built in Melbourne.

See your boundary the way an attacker does

Start with a free exposure scan. Setup is agentless: a domain and a set of keywords. No credit card.
ScruteX sees only what is visible from outside your network. It won't rate your privileged environments, internal business systems or user devices. Those ratings come from your internal controls and your assessor.

FAQ

Q: Is the Essential Eight still valid?

A: Yes, for now. ASD keeps the Essential Eight published alongside ASD Essentials during the transition, and government agencies will be assessed against both next year. In June 2026, ASD said it expected to start deprecating the Essential Eight in about 12 months and retire it in about 24.

Q: When does ASD Essentials become mandatory?

A: No date has been set. On 15 October 2026, ASD said it was working with policy agencies on a regulatory transition timeframe over the next year or two. Until then, keep meeting existing obligations that reference the Essential Eight.

Q: Does CTEM replace ASD Essentials or the Essential Eight?

A: No. ASD Essentials defines the security outcomes and how they are rated. CTEM is an operating model for continuously finding, prioritising, validating and fixing exposures. Used together, CTEM produces the current, evidence-backed findings that ASD Essentials effectiveness ratings depend on.

Q: Which ASD Essentials domains should we start with?

A: Priority phase 1: boundary services (gateways, internet-facing services and edge devices) and identity services (directories, authentication and authorisation, and credential stores). Governance and culture and visibility and response run alongside every phase. ASD's FY2024–25 data shows why the edge comes first: more than 120 edge-device attacks, 96% of them successful.

Q: Do Essential Eight maturity levels carry over?

A: Not as ratings. ASD says maturity levels do not automatically translate into effectiveness ratings. Existing controls and evidence can be reused where they remain current and relevant, but each action still needs a gap analysis and assessment within each applicable domain.

Q: How does CTEM help with SOCI Act obligations?

A: A CIRMP must identify, and keep current, the material risks to a critical infrastructure asset, including cyber and supply chain hazards. CTEM keeps a continuously updated, prioritised record of external exposures, with remediation evidence. That supports CIRMP reviews, annual board reporting and, for Systems of National Significance, vulnerability-assessment obligations.

Sources

Back to all posts