The Essential Eight Is Changing: What It Means for Your Business

If you have spent the past two years working towards Essential Eight maturity, the news that the framework is being replaced is not what you were hoping to hear. We have had several clients raise it with us since June, usually with some version of the same question: have we just spent eighteen months building towards something that is about to disappear?

The short answer is no. The longer answer is worth reading, because a good deal of the commentary published since the announcement has been more dramatic than the facts support, and the distinction matters when you are deciding what to do next.

What the ASD Has Actually Announced

On 15 June 2026, the Australian Signals Directorate opened a consultation on what it describes as the evolution of the Essential Eight. The proposal is to expand the current framework into a broader Essentials series, with separate chapters covering different technology environments rather than a single list of eight controls applied universally. The first chapter, Essentials for enterprise IT, went out for consultation through the ASD Cyber Security Partnership Program portal and closed for feedback on 12 July 2026.

The ASD’s stated reasoning is straightforward and, in our view, fair. The Essential Eight was first published in 2017, when most Australian businesses ran on premises, Windows heavy, perimeter based networks. Cloud was not yet the default. Applying an identical set of eight controls at an identical maturity level to a twenty person law firm and a five hundred person financial services business was always a rough approximation, and the ASD has been open about that limitation.

It is worth being precise about the language, because this is where a lot of the published commentary has drifted. The ASD’s own consultation notice describes an evolution and does not use the word “retire.” The widely reported timeline, deprecation at roughly twelve months and full retirement at around twenty four, comes from an interview given by the ACSC’s head of cyber security resilience rather than from published ASD guidance. It may well prove accurate, and we would not be surprised if it does. But as things stand, the ASD has not published a retirement date, and we would rather tell you that plainly than repeat a timeline as though it were settled.

As at the time of writing, the final Essentials for enterprise IT guidance has not been published and the ASD has not committed publicly to a publication date.

What Has Not Changed

Rather a lot, as it happens, and this is the part that should be reassuring if you are midway through an uplift programme.

The Essential Eight Maturity Model published in November 2023 remains the current, published release. The eight mitigation strategies themselves have not changed. Every existing obligation that references the Essential Eight, the Protective Security Policy Framework, Defence Industry Security Program membership, the Security of Critical Infrastructure Act, and the various state government policies, still points at it. If you hold a current assessment, it remains valid.

More importantly, the ASD has said directly that organisations already using the Essential Eight can expect strong alignment between their existing controls and investments and the new guidance. That is not a throwaway reassurance. Multi factor authentication, patching, application control, restricting administrative privileges and tested backups are not disappearing from any credible security framework. The controls carry forward; it is the structure around them that is changing.

The one genuine shift worth understanding is philosophical. The new guidance will be grounded in the ASD’s Information Security Manual and built around outcomes rather than a fixed checklist. In practice, that means it asks what you are protecting and why, rather than handing you eight boxes to tick and a score at the end.

For a business that has treated the Essential Eight as a compliance exercise, that will be a harder landing than expected. For one that has treated it as a set of risk driven controls it can justify, it will barely register. This is a useful moment to work out which of those describes your organisation.

Where the Bar Actually Sits

This is the question we are asked most often, and the answer has shifted over the past two years in a way that many businesses have not caught up with.

The maturity model runs from Level One through Level Three. Level One is designed to protect against opportunistic attackers using widely available tools, mass phishing, exploiting software that has not been patched. Level Two addresses more focused adversaries willing to invest effort in getting around basic controls, including targeted phishing designed to defeat weaker forms of MFA. Level Three is aimed at adaptive attackers who will modify their approach to exploit a specific weakness in your environment.

The ASD’s general guidance has been that Level One may suit small to medium enterprises, Level Two large enterprises, and Level Three critical infrastructure and other high threat environments. In practice, the ground has moved. Maturity Level Two is increasingly referenced in government tenders and by cyber insurance underwriters, and non corporate Commonwealth entities are expected to reach it under the Protective Security Policy Framework.

For most of the businesses we work with, that makes Level One the starting point rather than the destination. It is a sensible place to begin, it is achievable within a reasonable timeframe and budget, and it removes the great majority of opportunistic risk. But if you sell to government, sit anywhere in a defence or professional services supply chain, or renew cyber insurance annually, you should be planning a path to Level Two rather than treating Level One as done.

One piece of advice we would offer firmly: do not attempt to jump to a higher maturity level before the one beneath it is genuinely working. The model is designed as a progression, and each level assumes the controls below it are operating properly. We have been called in to tidy up environments where an organisation reached for advanced controls while basic patching was still unreliable, and the result is usually fragile rather than secure.

Where Businesses Overestimate Themselves

Self assessment is useful, and it is also where we see the largest gap between what an organisation believes about its security posture and what is actually true.

There are two reasons for this, and neither reflects badly on anyone. The first is straightforward optimism. The second, and more common, is the gap between policy and implementation. A documented policy stating that critical vulnerabilities are patched within forty eight hours is not evidence that they are. Evidence is demonstrable, measured patching performance across your actual asset inventory, including the devices that sit in a drawer for three weeks and the server everybody has forgotten about.

An honest way to test this is to pick one control and ask for the evidence rather than the policy. Take multi factor authentication. Most businesses will tell us MFA is enabled. The more useful questions are whether it covers every account including service accounts and contractors, whether it can be bypassed on legacy authentication protocols, and whether anyone would notice if it were switched off for a single user. Those three questions tend to produce a more accurate picture than any self assessment questionnaire.

Below is a rough guide you can work through for your own environment. It is not a formal assessment, but it will tell you whether you are closer to the start or the middle of the journey.

If more than two of those rows made you pause, that is worth acting on regardless of what the framework is eventually called.

Our existing guide, Essential Eight: What It Is and How TechPath Helps, sets out each control in more detail alongside the part your own team plays in making it work.

What This Means for Insurance and Tenders

For most of the businesses we work with, this is the practical pressure point rather than the framework itself.

Cyber insurance underwriters now routinely ask for evidence of Essential Eight maturity before issuing or renewing a policy, and they ask with more specificity than they did three years ago. Client contracts and government tenders increasingly specify a maturity level. None of that changes during the transition period. If anything, an organisation that pauses its uplift because the framework is being revised will find itself explaining that decision at renewal, which is not a comfortable conversation.

The sensible approach is to keep going. When the Essentials guidance is published, the right move will be a fresh gap check against it rather than starting again from nothing.

A Note on Certification

There is a reasonable question sitting underneath all of this, which is what you do if you need something certifiable now and cannot wait for a framework that has no published release date.

ISO 27001 is worth considering. It is externally audited, internationally recognised, and not subject to a transition timeline. It is also more resource intensive than working towards Essential Eight maturity, and we would not suggest it to every business. For many, Essential Eight alignment is proportionate and sufficient.

We hold ISO 27001 certification ourselves, which means our own information security practices have been independently assessed rather than simply described. We mention it here not to suggest every client should pursue the same standard, but because it shapes how we approach this work: we are accustomed to producing evidence rather than assertions, and that is broadly what the new guidance appears to be moving towards.

What We Would Suggest Doing Now

If you are partway through an uplift, continue. Nothing you are implementing this quarter becomes wasted work, and the ASD has said as much.

If you have not started, start with the current Essential Eight rather than waiting for the replacement. The controls carry forward, the framework remains the current published baseline, and waiting simply leaves you exposed for another year.

If you hold a maturity assessment more than twelve months old, it is worth refreshing, because environments drift quietly and an assessment describes a moment rather than a state.

And it is entirely reasonable to ask your IT provider what their transition plan is. A provider working in this space should be tracking the consultation outcome and mapping your environment against the new guidance as it lands, without being prompted.

Frequently Asked Questions

Is the Essential Eight being scrapped? No. The ASD has announced an evolution of the framework into a broader Essentials series, beginning with a chapter covering enterprise IT. Consultation closed on 12 July 2026 and the final guidance has not yet been published. The Essential Eight remains the ASD’s current published baseline.

Will my existing Essential Eight work be wasted? No. The ASD has stated that organisations already using the Essential Eight can expect strong alignment with their existing controls and investments. The eight mitigation strategies carry forward into the new guidance.

Has the Essential Eight Maturity Model changed? The Maturity Model published in November 2023 remains the current release, and the eight controls have not changed since. The ASD has not publicly confirmed whether the maturity model itself will change under the new framework.

What maturity level should my business be working towards? Maturity Level One is a sensible starting point for most small and medium businesses. Maturity Level Two has become the practical benchmark referenced by government tenders and cyber insurers, so it is the appropriate target if you sell to government, sit in a supply chain that does, or renew cyber insurance annually.

Should we wait for the new framework before starting? We would not recommend it. The current framework remains active and supported, the controls carry forward, and waiting leaves your business exposed in the meantime. When the new guidance is published, a gap check against it is a far smaller exercise than starting from nothing.

How long does it take to reach Maturity Level One? It depends considerably on the starting point and the complexity of the environment. For a business already running a well managed Microsoft 365 environment, it is usually a matter of months rather than years. Environments carrying legacy servers or unmanaged devices generally take longer, and the assessment is what tells you which of those you are.

Working Out Where You Stand

A maturity assessment is not a pass or fail exercise. It identifies where each control currently sits, highlights the specific gaps, and produces a prioritised roadmap. Every organisation has a path forward from wherever it happens to be, and the goal is steady improvement rather than perfection on day one.

Our TechSecure assessment benchmarks your environment against the ACSC Essential 8 and delivers a practical register of risks, impacts and mitigation steps, along with recommendations you can actually sequence and budget for.

Wondering where your business currently sits? Our TechSecure assessment can give you a clear picture of your current security posture, the gaps that matter most, and what to tackle next.

Find Out Where You Stand →

Read more about TechSecure, our cyber security assessment