If you've spent the last year budgeting for, and working toward, a higher Essential Eight maturity level, news that ASD proposes to evolve the framework can feel like the rug being pulled out from under you. It isn't - but it does mean a few things are worth checking before you keep spending on the current plan.
First, This Isn't a Reason to Stop
The cited announcement does not set 12-month or 24-month retirement deadlines. ASD says organisations already using the Essential Eight can expect strong alignment with their existing controls and investments. Nothing about an Essential Eight uplift becomes pointless or wasted the moment ASD publishes new guidance. The controls you're implementing - MFA, patching, backups, restricted admin access - are standard security practice, not bespoke to one framework's naming convention.
What's Genuinely Uncertain Right Now
We don't yet know, and won't until ASD publishes formal guidance, whether there'll be an official way to map an existing Essential Eight maturity level onto the new framework. Without that, every business currently anchored to Essential Eight maturity levels may need to redo parts of its assessment from scratch under the new model, rather than simply translating an existing result across. That's a bigger lift than a like-for-like rename, so it's worth being realistic about the possibility when planning budgets beyond the next 12 months.
Three Things to Check Before You Spend Further
- Talk to your cyber insurer. Ask whether they intend to keep referencing Essential Eight maturity for policy terms if official requirements change, and what happens once the new framework exists.
- Talk to any client or tender body that requires a maturity level of you. Confirm how they'll treat the transition, and whether there's flexibility if requirements shift mid-engagement.
- Avoid signing up to a vendor's "Essentials-ready" package right now. ASD hasn't published the final guidance yet, so anyone selling a finished product against it is getting ahead of the actual guidance.
What to Keep Doing
Keep progressing your current Essential Eight work. The strategies it covers map directly onto how most businesses actually get compromised, and that won't change just because the framework around them is being redesigned. If anything, businesses that are already disciplined about patching, MFA, and backups will have the easiest time adapting to whatever outcome-based guidance ASD eventually releases, since outcome-based frameworks reward good underlying practice rather than a specific checklist.
Frequently Asked Questions
Should I pause my Essential Eight uplift because of the ASD changes?
Generally no. ASD expects strong alignment with existing Essential Eight controls and investments, and the Essential Eight remains the current benchmark referenced by insurers and clients. Pausing work to wait for guidance that hasn't been finalised yet means losing momentum for no real benefit.
Will my current maturity level still count under the new framework?
That's genuinely unclear at this stage. ASD hasn't yet published a crosswalk or mapping showing how Essential Eight maturity levels might translate to the new Essentials series. Until one is published, treat your current maturity level as valid under the existing framework, not as something with a confirmed equivalent elsewhere.
What should I ask my insurer or client about this?
Ask how they plan to treat the transition: whether they'll keep referencing Essential Eight maturity if official requirements change, whether they'll adopt the new framework once it's released, and whether there's a grace period if requirements change mid-contract.
Is it worth starting a new Essential Eight assessment now, given the proposed changes?
Generally yes, if you don't already have one. The underlying controls it assesses (MFA, patching, backups, restricted admin privileges) are core security practices that will matter regardless of which framework organises them, and a multi-year transition window means there's no immediate reason to wait.
We help Perth businesses keep their Essential Eight uplift on track, and plan ahead sensibly as ASD's guidance changes.
IT Strategic Planning →Mid-way through an Essential Eight uplift?
Call 0433 087 091 for a free, no-obligation conversation about where you stand and how to plan around the transition.
Book a Free ConsultationFor related reading, see Essential Eight Evolution for Perth Businesses and Cyber Security Compliance Is Changing.
This article reflects ASD's published announcement as of September 2026, and is general information only, not formal compliance or legal advice. Confirm current requirements with your insurer, client, or tender body directly, and refer to ASD's own publications at cyber.gov.au for authoritative guidance.