Essential Eight changes: what's replacing the Essential Eight?

ASD to retire the Essential Eight: what was announced

On 15 June 2026 ASD and the Australian Cyber Security Centre (ACSC) opened a national consultation on what they called the evolution of the Essential Eight, with feedback from ASD's Cyber Security Network partners submitted through the ACSC partner portal. On 24 June 2026 ASD confirmed publicly that it will retire the Essential Eight and replace it with the new Essentials series. Chris Horlyck, head of cyber security resilience at the ACSC, told iTnews that ASD expects to keep both documents live during a transition period, begin to deprecate the Essential Eight at around 12 months and retire it at around 24 months. The news was also reported by Cyber Daily, Information Age and the Australian Cyber Security Magazine.

ASD described the new Essentials guidance as grounded in the Information Security Manual (ISM), with prioritised, threat-informed controls for contemporary technology environments, practical tools and clearer guidance on implementation.

The four principles behind the Essentials series

ASD has described the new framework as built on four core principles:

1. Flexibility: outcomes rather than one fixed way of implementing each control.
2. Threat-informed insights: mitigations prioritised against how attackers actually operate today.
3. Prioritisation and risk management: focus effort where it reduces the most risk.
4. Compatibility and future focus: guidance that works with existing investments and adapts to emerging technologies.

The timeline

ASD has described the timing as approximate. Treat these dates as targets, not deadlines.

Why ASD is retiring the Essential Eight

The Essential Eight was designed in 2017 for on-premises enterprise IT: Windows-based networks with a clear perimeter. In 2026, an organisation with no cloud and no SaaS would be the surprising architecture. Cloud adoption, SaaS environments, shared responsibility models with providers, identity-based attacks and emerging threats from AI don't translate cleanly into eight prescriptive controls tied to a fixed maturity ladder built around specific technologies.

The existing maturity levels have also been criticised as a rigid maturity ladder that suits large organisations better than small ones. Fortinet's ANZ CISO, Cornelius Mare, called the Essentials series a welcome update and noted that many previous controls were aimed at large businesses with IT capabilities small businesses can't match. The shift is a significant change in approach: from a checklist score toward an organisation's actual security posture across a changing threat landscape.

What's confirmed and what isn't

What stays the same: the eight mitigation strategies

The current Essential Eight's eight mitigation strategies are patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.

These security controls still stop the most common attacks on Australian organisations, from conventional malware to email compromise. Expect strong alignment between them and Essentials for enterprise IT. What's likely to change is how they're assessed: less emphasis on hitting a maturity level on paper, more on evidence that controls work, and new guidance for identity, cloud and SaaS.

Application control and administrative privileges under the new approach

A worked example of the new direction arrived on 8 September 2026, when an ASD advisory on crypter malware cited application control, endpoint detection and response, antivirus configuration and operating system patching against numbered ISM controls, not Essential Eight maturity levels. If your evidence for application control or restricted administrative privileges is only a maturity score rather than a working control, it's worth fixing now.

What the Essential Eight changes mean for your business

Keep going. Insurers, auditors and government agencies still measure against the current Essential Eight, and will during the transition period. Non-corporate Commonwealth entities remain bound by it under the Protective Security Policy Framework until the new guidance replaces it.

Focus on outcomes, not scores. Keep evidence: MFA enforcement reports, patch reports, backup restore tests. This is the practical path to cyber security resilience under either framework.

Check your cloud and identity setup. The Essential Eight never covered cloud well. Microsoft 365 configuration, conditional access, sensitive data sharing and SaaS app permissions are likely to get more attention.

Watch for new threat tradecraft. ASD's advisories already use the Essentials logic.

Don't pay for a "new framework" assessment yet. Until ASD publishes the final chapter, nobody can assess you against it.

How Static Computers is handling the transition

Static Computers continues to assess clients against the current Essential Eight maturity model, and each Essential Eight assessment now flags findings related to cloud and identity, the areas the upcoming Essentials series is expected to expand. This page is updated when ASD publishes. For the current controls in detail, see the Essential Eight explained.