Skip to content
ISO 27001 certified
Client portal
Menu

ASD Essentials series explained

The Essential Eight is being replaced. Here’s what comes next.

The Australian Signals Directorate (ASD) is consulting on a new Essentials series. Its first chapter evolves today’s Essential Eight, with chapters for operational technology and cloud planned.

Updated

Book a free Essential Eight review See the timeline
A worn navy ring binder lying flat beside a new white binder standing upright on an office desk, with a laptop open to a two-column document.

The short version

  • Keep your Essential Eight work going Both documents stay live during the transition, closely aligned.
  • A two-year plan, no fixed dates yet ASD plans to retire the Essential Eight but hasn’t set dates.
  • More flexibility in how you comply Outcomes to meet, rather than product settings to tick.

Essential Eight retirement timeline

From 2017 to the Essentials.

  1. 2017

    Essential Eight published

    The strategies in February, the maturity model in June.

  2. Consultation

    Essentials for enterprise IT

    ASD consults its partners on the first chapter.

  3. Now

    Transition

    The Essential Eight and the Essentials are both live.

  4. Within two years

    Retirement planned

    The Essential Eight retires. No fixed dates yet.

Essentials for enterprise IT, OT and cloud

One framework, several chapters.

Grounded in ASD’s Information Security Manual (ISM), with prioritised mitigations for each environment.

A laptop, an industrial controller on a DIN rail and a small network switch side by side on an office desk.

  • Chapter 1 · First

    Essentials for enterprise IT

    The evolution of today’s Essential Eight, now in consultation.

  • Planned

    Operational technology

    Industrial control systems and connected plant.

  • Planned

    Cloud

    Your shared responsibility with a cloud provider, and cloud-native controls.

  • Possible

    Agentic AI

    Identity and access for AI agents, and defences against prompt injection.

What the Essentials change for your controls

Evolution, not a restart.

  • What’s changing

    • Outcomes in place of product-specific settings such as Office macros
    • Separate chapters for enterprise IT, operational technology and cloud
    • Practical tools and implementation guidance alongside the controls

  • What’s staying

    • A prioritised baseline from ASD, grounded in the Information Security Manual (ISM)
    • Strong alignment with existing Essential Eight controls and investment
    • MFA, patching, admin privileges, application control, hardening and backups as fundamentals

“The investment you’ve made under the Essential Eight will still be relevant under the Essentials.”

Chris Horlyck, Head of Cyber Security Resilience, ASD, speaking to iTnews

What to do before the Essential Eight retires

Keep going, and prepare for outcomes.

Today’s controls stay useful. These steps make the move straightforward.

  1. 01

    Keep building Essential Eight maturity

    Insurers and clients still ask for it, and the work carries across.
  2. 02

    Record evidence by outcome

    Write down what each control achieves, not only which setting is on.
  3. 03

    Map your cloud responsibilities

    For Microsoft 365 and each key SaaS platform: what they secure, what you do.
  4. 04

    Identify your crown jewels

    The systems and data you can’t afford to lose.

Essential Eight replacement FAQs

Transition questions.

Details may change as ASD finalises the series.
When will the Essential Eight be retired?
ASD has advertised a two-year plan to retire it in favour of the Essentials series, without fixed dates yet. Until then, it stays the current guidance, and both documents are live during the transition.
Will our Essential Eight work be wasted?
No. ASD has said organisations already using the Essential Eight can expect strong alignment with their existing controls and investments.
Should we wait for the new framework before starting?
No. The weaknesses attackers exploit haven’t changed, and ASD expects MFA, patching and tested backups to stay foundational. Start with the eight controls.

Sources

  1. ASD, “Consultation on evolution of Essential Eight”, 15 June 2026
  2. iTnews, “ASD to retire Essential Eight cyber security framework within next two years”, interview with Chris Horlyck, ASD, 24 June 2026
  3. ASD, Essential Eight explained (first published February 2017) and Essential Eight maturity model (June 2017)

Get ready for the Essentials without losing momentum.

Book a free review with a Perth engineer. We check your Essential Eight maturity today and how that maps to the new Essentials series. The report is yours to keep either way.

Or call (08) 9467 2269

What’s bugging you
Staff

A Perth engineer, not a salesperson, replies within one business day.

We hold ISO/IEC 27001:2022 certification from BSI, certificate IS 840964.

Call now Free risk review