The Essential Eight is being retired — what it means for you

If you've spent the last year getting your head around the Essential Eight, the news that it's being retired probably landed somewhere between annoying and alarming. Here's the calm version: it's true, it's slow, and the work you've done is not wasted.

The short answer: on 15 June 2026, the Australian Signals Directorate (ASD) announced that the Essential Eight will evolve into a new framework called the Essentials series, with the transition staged over roughly two years. The current Essential Eight Maturity Model stays in force throughout. Your existing controls carry across.

What ASD actually announced

ASD opened consultation on what it calls the evolution of the Essential Eight. The replacement isn't another eight-item checklist — it's a multi-chapter framework, with each chapter covering a distinct technology domain.

The first chapter, Essentials for enterprise IT, is the direct successor to the Essential Eight. It covers the same territory the Essential Eight was designed for: workstations, servers, identity, email — ordinary business IT. Consultation on it ran through ASD's Cyber Security Partnership Program and closed on 12 July 2026. Later chapters are expected to cover operational technology and cloud, and ASD has flagged agentic AI as a likely future chapter.

The new guidance is grounded in ASD's Information Security Manual, the same source the Essential Eight draws on. That's one reason the compatibility message is credible: this is a reorganisation of guidance that already exists, not a clean-slate rewrite.

The Essential Eight retirement timeline, as currently indicated

• June–July 2026 — announcement and consultation on Essentials for enterprise IT (closed 12 July 2026).
• Late 2026 (expected) — the first Essentials chapter is published. From that point both frameworks are live side by side.
• Around mid-2027 (indicated) — ASD expects to begin deprecating the Essential Eight.
• Around mid-2028 (indicated) — the Essential Eight is retired entirely.

Two things worth noting about those dates. First, only the consultation dates are fixed — everything after is ASD's stated intent and could shift. Second, the practical deadline for most small businesses isn't any of these dates: it's whenever the people who ask you about the Essential Eight — insurers, big customers, government buyers — update their paperwork, which happens gradually across the transition window.

Is your Essential Eight work wasted?

No — and this isn't spin. ASD has been explicit that existing Essential Eight implementations map across to the Essentials series. The controls that make up the Essential Eight — multi-factor authentication, patching, regular backups, restricting admin privileges, and the rest — are not being deleted. They're being reorganised into a structure that can also cover the things the Essential Eight never handled well, like cloud services and operational technology.

If you understand your maturity levels today, that understanding transfers. If you're mid-way through lifting a control from Level 1 to Level 2, keep going — stopping now would be the one genuinely wasteful response to this news.

What insurers are doing during the transition

For the moment: exactly what they were doing before. Australian brokers and insurers commonly reference the Essential Eight in renewal questionnaires, and the contracts, procurement panels, and policies that name it keep operating on it until each one is updated. That updating will take much of the two-year window — large organisations don't rewrite their questionnaires overnight.

So if your renewal is in the next twelve months, plan on being asked the same Essential Eight-shaped questions as last year. We've covered what that means for your renewal in detail separately.

What an Australian small business should do now

1. Keep assessing against the current model. The November 2023 Essential Eight Maturity Model remains the published, current framework until the Essentials series replaces it. It's what everyone measuring you is using — and if you're new to the framework entirely, start with our Essential Eight compliance guide.
2. Keep your evidence current. The one constant across both frameworks is that controls need to be documented and demonstrable. Evidence of MFA coverage, backup testing, and patching cadence stays valuable whatever the framework is called.
3. Don't buy a panic rewrite. Anyone selling an urgent "Essentials series readiness" overhaul in 2026 is selling ahead of the facts — the first chapter isn't even final yet.
4. Watch the milestones, not the noise. The moments that matter: the first chapter's final publication, and the first time your insurer or a major customer updates their questionnaire to reference it.

If you don't know where you currently stand, that's the place to start. Our free Essential Eight self-assessment gives you an indicative Level 0–3 per control in about 20 minutes, based on the current ACSC model — it's a self-assessment, not an audit or certification, and it reflects your own answers. When the Essentials series is finalised, we'll track the change so your documentation moves with the framework rather than going stale — which, frankly, is the whole argument for keeping compliance documentation on a subscription rather than a one-off PDF.

FAQ

Is the Essential Eight being retired?

Yes. On 15 June 2026 the Australian Signals Directorate announced the Essential Eight will evolve into a new multi-chapter framework called the Essentials series. The transition is staged over roughly two years, and the current Essential Eight Maturity Model remains in force while it runs.

When will the Essential Eight be retired?

ASD has indicated a staged transition: the first Essentials chapter is expected to be published in late 2026, deprecation of the Essential Eight is expected to begin around mid-2027, and full retirement around mid-2028. These dates may shift as ASD finalises the framework.

What is replacing the Essential Eight?

The Essentials series — a framework organised into chapters by technology domain. The first chapter, Essentials for enterprise IT, is the direct successor to the Essential Eight, with later chapters expected to cover operational technology and cloud, and ASD has flagged a possible chapter on agentic AI.

Do insurers still ask about the Essential Eight?

Yes. Brokers and insurers commonly reference the Essential Eight in questionnaires today, and existing contracts and requirements that name it keep applying until they're updated. Nothing about the announcement changes what you're likely to be asked at your next renewal.

Will I have to redo my Essential Eight work?

ASD has been explicit that existing Essential Eight investments map across to the Essentials series. The underlying controls — MFA, patching, backups, restricting admin privileges — aren't going away; they're being reorganised and modernised.