ASD Essentials: Why It Starts at Your Network Edge

Oct 18, 2026

On 15 October 2026, the Australian Signals Directorate (ASD) published ASD Essentials, the successor to the Essential Eight. The headline for network teams is simple: ASD now tells organisations to start at the network edge. In this blog, we'll cover what changed, why firewalls, VPN gateways and identity sit in priority phase 1, which network controls are new, and how to check where your network stands.

ASD Essentials starts at the network edge: an illustration of a network boundary with firewall and router icons

ASD Essentials: What Replaced the Essential Eight?

ASD Essentials replaces the Essential Eight's eight mitigation strategies and maturity levels with principles, actions and domains. Principles describe the security outcome, actions describe what must be done, and domains describe where the work applies. The enterprise IT chapter has 28 principles across eight domains, each mapped back to ASD's Information Security Manual (ISM).

There are three chapters so far: enterprise IT, cloud and operational technology (OT). The enterprise IT chapter is the direct successor to the Essential Eight, and it's written for Commonwealth entities, critical infrastructure and large organisations. ASD says smaller organisations can use it too, with more of the work sitting with their service providers.

The biggest structural change? Maturity Levels One to Three are gone. In their place are three priority phases, which ASD describes as a sequencing mechanism, not a rating.

No transition dates have been set. Both frameworks stay on cyber.gov.au during the transition, and anything that requires the Essential Eight today (government policy, contracts, supplier questionnaires, cyber insurance) still does.

Priority Phase 1: Why Does ASD Start at the Network Edge?

ASD puts boundary services and identity services first because they're the most common way adversaries get in. Boundary services are the assets that broker connectivity between environments of different trust levels: internet-facing services and edge devices such as firewalls, VPN gateways and routers. Fix these first, and the rest of the program builds on solid ground.

The priority phases run like this. Phase 1 is boundary services and identity services. Phase 2 is critical processes and services, and privileged environments. Phase 3 is business systems and user devices. Two capability domains, governance and culture, and visibility and response, run across all three.

That's a real shift. The Essential Eight's controls leaned heavily on laptops and servers: application control, macros, user application hardening. ASD Essentials puts the network boundary at the front of the queue, and the head of ASD's Australian Cyber Security Centre has been blunt about why: an insecure edge device gives threat actors an easy way into the network.

Here's the part network teams will notice. In the enterprise IT matrix, every technical action applies to the boundary services domain. Patching, secure configuration, secure administration, MFA, segmentation, content filtering, logging — all of it applies to your firewalls and VPN gateways first.

Pro-Tip: Start with a list. ASD's first action is a current record of assets, so pull every internet-facing device into one inventory with its model, software version, owner and vendor end-of-support date. Most teams find at least one device they'd forgotten about.

Network Controls: What's New Compared With the Essential Eight?

Several principles in ASD Essentials have no Essential Eight equivalent, and most of them land on the network. Network segmentation, content filtering, legacy system management and supplier assurance are all new, and logging, detection and response is now a domain of its own rather than a detail inside other strategies.

Segmentation: PRO-18

Network segmentation and segregation asks for zones based on business criticality and trust level, with traffic in and out of each zone limited to explicitly approved pathways. It also asks you to limit lateral movement within segments, not just between them. On a flat network, that's a project, not a setting. In Cisco terms, it's the job of Cisco Secure Firewall at zone boundaries and Cisco ISE with security group tags inside them.

Content Filtering: PRO-09

Block outbound connections to known malicious destinations, inspect inbound content, and inspect outbound flows for sensitive data leaving the organisation. DNS-layer security, intrusion prevention and data loss prevention all map here.

Configuration, Administration and Legacy Kit

Secure configuration management now covers infrastructure in every domain: hardening baselines, deployed consistently, with configuration drift detected and acted on. Secure administration asks for management from dedicated, hardened environments, time-bound privilege and a record of every administrative change (who, when and which device). And legacy system management expects compensating controls and a replacement plan for anything past end of support.

Evidence: How Will Your Network Be Rated?

Each action is rated per domain as not assessed, not effective, partially effective or fully effective. A principle takes the lowest rating of its actions, and each domain gets a percentage score: fully effective counts as one, partially effective as half. Ratings rest on evidence that a control keeps working, not just that it was deployed.

So what does that buy you? A much clearer picture than "Maturity Level Two", and a much higher bar for proof. A firewall rule review that happened once isn't evidence of approved pathways. A hardening standard in a SharePoint folder isn't evidence of a deployed baseline.

One more thing to plan for: Essential Eight ratings don't automatically convert to ASD Essentials outcomes. If your organisation is at Maturity Level Two today, that work still counts, but ASD advises checking each control against the new actions rather than assuming they're equivalent.

Pro-Tip: For the network, the evidence mostly already exists if your tooling is set up for it. Configuration backups and compliance reports, AAA command accounting, central syslog with time synchronisation, and firewall change records cover a surprising share of the boundary actions.

Where to Start: A Practical Order for Network Teams

Start with the boundary, then build the foundations around it. In practice that means four steps: know and harden every edge device, lock down how the network is administered, centralise and protect network logs, then segment the zones that matter most. Each step produces evidence the next assessment will ask for.

First, the edge. Inventory every internet-facing device, close management access from the internet, turn off unused services, and put a replacement date and extra monitoring on anything past end of support. Agree risk-based patch timeframes for edge devices and track vendor advisories against them.

Second, administration and identity. Phishing-resistant MFA on every remote access connection, individual admin accounts through central authentication, and management traffic on its own network. Then switch off the legacy protocols that tend to linger (Telnet, SNMP v1 and v2c, unencrypted web management).

Third, visibility. Send firewall, VPN, router and switch logs and configuration changes to a central platform, protect them from tampering, and alert on unauthorised changes and unusual admin sign-ins.

Fourth, segmentation and filtering. Separate management, servers and building systems first, tighten the pathways between zones, and extend DNS-layer filtering to remote users.

Who does the work matters too. ASD notes that what differs between organisations is how much responsibility sits with service providers and vendors. If an external team runs part of your network, its patching, configuration and logging practices are part of your evidence, and supplier assurance is now a principle in its own right.

ASD Essentials: FAQs

What Is ASD Essentials?

ASD Essentials is the Australian Signals Directorate's successor to the Essential Eight, published on 15 October 2026. It replaces maturity levels with principles, actions and domains, and orders the work into three priority phases. The first chapters cover enterprise IT, cloud and operational technology.

Does ASD Essentials Replace the Essential Eight Straight Away?

No. ASD hasn't set transition dates, and both frameworks stay available during the transition. Organisations should keep meeting their current Essential Eight obligations until their regulator, contract or policy owner says otherwise.

Who Does ASD Essentials Apply To?

The enterprise IT chapter is written for Commonwealth entities, critical infrastructure owners and operators, and large organisations. ASD says smaller organisations can use it where relevant, with more of the responsibility sitting with their service providers and vendors.

Does ASD Essentials Cover Network Segmentation?

Yes. Network segmentation and segregation (PRO-18) is a principle in ASD Essentials, with no Essential Eight equivalent. It asks for zones based on criticality and trust, approved pathways between them, and limits on lateral movement within segments.

ASD Essentials: Summary

ASD Essentials moves the starting line to the network edge. Firewalls, VPN gateways and identity services come first, segmentation, content filtering and central logging are now principles in their own right, and every control is rated on evidence that it keeps working. Network teams that inventory and harden the boundary now, and set up the records to prove it, will be well placed whenever the transition dates land.

Need Help With ASD Essentials?

We've built the ASD Essentials Network Readiness Assessment: 30 questions across eight network areas, scored the way ASD rates actions, with a report that sets out what to do first in ASD's priority order. If you'd like to go further, our engineers can review the results against your live network. See our network security services, get in touch with the IPTel team, or email sales@iptel.com.au.