If your business has been working towards the Essential Eight, or a client has asked you to, the news that ASD plans to replace it raises a fair question: is the work wasted? It is not. This article sets out what the Australian Signals Directorate (ASD) announced, what is still unknown and what we recommend you do now.
The short answer
Yes, the Essential Eight is being replaced, over roughly two years. ASD is evolving it into a new Essentials series, starting with a chapter called Essentials for enterprise IT. The Essential Eight stays live in the meantime and its controls carry across. Contracts, insurers and tenders still ask for Essential Eight maturity levels today.
What ASD announced
On 15 June 2026 ASD published a notice announcing a consultation on the evolution of the Essential Eight into a new Essentials series. ASD describes the series as prioritised, threat informed mitigations for today’s technology environments, supported by practical tools and implementation guidance.
The current Essential Eight guidance becomes the first chapter of the series, Essentials for enterprise IT, with more chapters to follow. ASD invited government, industry, regulators and organisations that use the Essential Eight to comment through its Cyber Security Partnership Program portal, and the consultation closed on 12 July 2026.
The timeline
Speaking to iTnews on 24 June 2026, Chris Horlyck, head of cyber security resilience at the Australian Cyber Security Centre, said ASD expects to keep both frameworks live during a transition, begin deprecating the Essential Eight in about 12 months and retire it in about 24 months.
That timeline comes from the interview. ASD’s own notice does not set dates, and as far as we could find at the end of September 2026, no draft or final version of Essentials for enterprise IT had been published.
| When | What happened, or is expected |
|---|---|
| November 2023 | ASD publishes the current Essential Eight maturity model |
| 15 June 2026 | ASD announces the Essentials series and opens consultation |
| 24 June 2026 | ASD’s head of cyber security resilience outlines a transition of about two years |
| 12 July 2026 | Consultation closes |
| Around mid 2027 | Deprecation of the Essential Eight expected to begin, as stated in the interview |
| Around mid 2028 | The Essential Eight expected to be retired, as stated in the interview |
Why ASD is changing it
The Essential Eight was first published in 2017, before most small and medium businesses ran on Microsoft 365 and other cloud services. In the same interview, ASD pointed out that the framework predates widespread cloud use, and that the way responsibility for security is split between a business and its cloud providers now needs its own guidance.
Splitting the guidance into chapters lets ASD cover each kind of environment properly. Enterprise IT comes first, and reporting suggests chapters for operational technology and cloud will follow, with agentic AI also mentioned as a possibility.
What carries over
ASD has said the investment organisations make under the Essential Eight will still be relevant under the Essentials. The fundamentals are not going anywhere:
- Patching applications and operating systems
- Multi-factor authentication
- Restricting administrative privileges
- Application control
- Restricting Microsoft Office macros
- Hardening browsers and other applications
- Regular, protected and tested backups
The evidence you collect along the way, such as patch reports, access reviews and restore tests, carries across too.
What it means for your business
Nothing changes today. If a contract, tender or insurance policy names an Essential Eight maturity level, that is still the standard you are measured against, and it will be until the people who set those requirements move to the new guidance.
Expect more attention on cloud settings. Microsoft 365, Entra ID and other cloud services are where most small and medium businesses now keep their data, and they are a focus of the new series.
SMB1001 is a separate, independent certification standard. ASD’s change does not alter an SMB1001 certificate you already hold. See SMB1001 certification.
What to do now
- Keep working towards the maturity level your contracts or insurer name, usually Maturity Level One or Two.
- Check your contracts, tender responses and insurance policy for Essential Eight wording, and note when each is due for renewal.
- Keep your evidence: settings, reports and test records carry across to the new guidance.
- Get your cloud settings right, starting with Microsoft 365 and Entra ID.
- Watch for the final Essentials for enterprise IT. We will update this article when ASD publishes it.
To see where you stand today, download our free Essential Eight checklist. It turns every Maturity Level One requirement into a plain English question. If you would rather have someone do the work, see Essential Eight assessment and uplift, or call us on 1300 787 429.
Essential Eight questions
Is the Essential Eight still valid?
Yes. ASD has said the Essential Eight stays live while the Essentials series is developed, and contracts, insurers and tenders still ask for Essential Eight maturity levels.
When will the Essential Eight be retired?
ASD’s head of cyber security resilience has said ASD expects to start deprecating it in about 12 months and retire it in about 24 months, which points to around mid 2028. ASD’s own notice does not set dates, so treat that as a guide rather than a deadline.
Should we stop working on the Essential Eight?
No. The same controls carry across to the Essentials series, and ASD has said the investment you make now stays relevant. Stopping would leave you exposed and short of what your contracts may already require.
What is Essentials for enterprise IT?
It is the first chapter of ASD’s new Essentials series, and the current Essential Eight guidance becomes its starting point. ASD has said further chapters will follow, and reporting suggests they will cover operational technology and cloud.
Will our Essential Eight assessment still count?
While the Essential Eight remains live, an assessment against it is still the reference most contracts and insurers use. When the final Essentials guidance is published, check with whoever asked for the assessment which framework they will want next.
Sources
- ASD, Consultation on evolution of Essential Eight, first published 15 June 2026.
- iTnews, ASD to retire Essential Eight cyber security framework within next two years, 24 June 2026.
- ASD, Essential Eight maturity model, November 2023.
