The Australian Signals Directorate (ASD) is retiring the Essential Eight. Over the next two years, it will be phased out and replaced with a broader framework called the Essentials series.
If you have been working towards a maturity level or seen it come up in a tender, insurance renewal or board conversation, here is what you actually need to know: nothing changes today, your existing work isn't wasted and this is a sensible evolution.
What is actually happening
The Essential Eight has been the go-to baseline for cyber security in Australia since it was published in 2017. Eight controls with things like multi-factor authentication (MFA), patching, restricting admin privileges and application control, designed to stop the most common ways cyber attackers get in.
ASD has now confirmed that framework will be phased out and replaced by the "Essentials series," a more flexible set of guidance that splits security into separate domains: enterprise IT first, then operational technology, then cloud, with a dedicated chapter for AI likely to follow.
The rollout is happening in stages, not all at once. Both frameworks will run side by side for a while. ASD has flagged deprecation of the Essential Eight starting in around 12 months, with full retirement roughly 24 months from now.
Why ASD is making the change
The Essential Eight was built for a different world, one where most businesses ran on-premises IT with a clear network perimeter and cloud was still a novelty. That is not how most businesses operate anymore.
If your business runs on Microsoft 365, cloud backups or SaaS platforms, a cyber security framework built around perimeter-based, on-premises assumptions was always going to be a rough fit.
There is also a fairness issue ASD has acknowledged: the maturity level requirements have shifted over time as new threats emerged, which meant some organisations felt like they were going backwards even though their actual security hadn't changed.
The Essentials series is designed to separate the underlying controls from a fixed maturity ladder, so this does not keep happening.
What this doesn't mean
This is the part I want to be really clear about: the Essential Eight isn't being scrapped because it stopped working. It is being reorganised and modernised to reflect how businesses actually operate today.
If you have invested time and budget into Essential Eight controls, none of that work is wasted. ASD has been explicit that this investment carries across into the Essentials series. The controls themselves aren't disappearing but they are being rebuilt into a structure that fits a cloud-first, SaaS-heavy environment better.
If you are partway through lifting your maturity level, the right move is to keep going. The Essential Eight is still the active, supported standard today and will remain so throughout the transition period.
What next
ASD has opened public consultation on the first chapter of the Essentials series, "Essentials for Enterprise IT", with feedback closing 12 July 2026. Once that closes, we will start to get a clearer picture of what the new framework actually requires, with the full draft expected later this year.
Cloud and operational technology chapters are expected to follow and there is a reasonable chance a dedicated AI security chapter will be added given how quickly agentic AI is showing up in business environments.
What we are doing about it
We will be tracking the Essentials series as it develops and will keep you updated as ASD releases more detail. In the meantime, our advice is simple: if you are building towards Essential Eight maturity, keep building. If you haven't started, the fundamentals underneath both frameworks, MFA, patching, backups, restricting who can install and run software, are worth having in place regardless of which name sits on the framework.
If you want a clear picture of where your business actually sits today, that is a conversation worth having now rather than waiting for the new guidance to land. Get in touch and we will walk you through it in plain English.