ASD has announced a proposed evolution of the Essential Eight into a broader Essentials series. Existing users should distinguish a consultation proposal from final requirements or a confirmed retirement schedule. This guide explains what the official announcement supports.
What the Official Announcement Says
ASD describes proposed guidance grounded in the Information Security Manual, with Essentials for enterprise IT as the first chapter. It expects strong alignment with existing Essential Eight controls and investments. The announcement does not establish the 12-month and 24-month retirement dates previously quoted here.
Consult the official consultation announcement and current maturity model before changing contractual or assessment requirements.
What Requires Further Confirmation
Final requirements, transition timing, and any mapping to new guidance should come from current official publications. Do not treat earlier industry commentary as a confirmed retirement deadline.
Why Change a Framework Businesses Have Spent Years Adopting?
The Essential Eight was designed around 2017, for a world of on-premises, domain-joined IT. Cloud and SaaS adoption has since become the norm for most small and medium businesses, and a lot of the framework's controls were never a clean fit for environments where a vendor like Microsoft owns the infrastructure layer. We've written more about that in why the Essential Eight never quite fit cloud-based businesses.
ASD's stated aim is to give organisations more flexibility in how they implement cyber security while still providing a clear path to strong cyber resilience, using principle-based guidance that can be updated as the threat environment changes. That outcome-focused approach brings ASD closer to how frameworks like NIST CSF and ISO 27001 already operate.
Does This Mean You Should Stop Working on the Essential Eight?
No. Continue to meet the current requirements agreed with clients, insurers, and tender bodies. If your business is mid-way through an uplift, or if insurers, clients, or tenders currently ask about your Essential Eight maturity, that requirement doesn't disappear today. The underlying controls - MFA, patching, restricted admin access, backups - are fundamental security practices regardless of which framework organises them, so work toward them remains worthwhile either way.
What to Actually Do Right Now
- Keep going if you're mid-assessment. Don't pause an Essential Eight uplift waiting for guidance that hasn't been finalised yet - ASD expects existing controls to align with the new framework.
- Check with anyone who requires Essential Eight maturity of you - insurers, clients, tender bodies - on how they intend to treat the transition once Essentials is released.
- Watch for the final Essentials for enterprise IT guidance on cyber.gov.au, especially how maturity levels carry across.
- Avoid rushing into any vendor pitching a finished "Essentials package" before ASD has actually published the final guidance.
- No Essential Eight requirement at all? If nobody is asking you for Essential Eight maturity specifically, a certification like SMB1001 may be a more practical target in the meantime. Our transition checklist covers the options.
Frequently Asked Questions
Is the Essential Eight being retired?
ASD describes a proposed evolution of the Essential Eight into an Essentials series. Its consultation announcement does not establish 12-month or 24-month retirement deadlines. Check current official guidance before changing assessment plans.
What is replacing the Essential Eight?
A broader body of guidance called the Essentials series. The evolved version of the Essential Eight becomes its first chapter, "Essentials for enterprise IT", grounded in ASD's Information Security Manual (ISM). Further chapters will follow, with their scope subject to further official guidance.
Should I stop working on Essential Eight maturity now?
No. The Essential Eight remains the current, valid benchmark referenced by insurers, clients, and tenders, and any transition requirements should be confirmed through current official guidance. ASD has also said organisations already using the Essential Eight can expect strong alignment with their existing controls and investments - the underlying controls (MFA, patching, backups, restricted admin access) aren't going away.
Where can I get official, up-to-date information?
ASD's own publications at cyber.gov.au, starting with its announcement on the evolution of the Essential Eight. This article is general information only, not a substitute for ASD's official guidance.
We help Perth businesses understand where they sit against the Essential Eight today, and how to plan ahead as ASD's guidance evolves.
Essential Eight Assessment →Not sure how this affects your business?
Call 0433 087 091 for a free, no-obligation conversation about your current security posture and what to keep an eye on.
Book a Free ConsultationFor related reading, see our guides to The Essential Eight Explained and Essential Eight and Cyber Insurance.
This article reflects ASD's published announcement as of September 2026 and is general information only, not formal compliance or legal advice. Details may change when ASD publishes the final Essentials guidance - refer to ASD's own publications at cyber.gov.au for authoritative, up-to-date information.