The Essential Eight is being replaced. Here's what that actually means.
ASD is retiring the Essential Eight and replacing it with the Essentials series. If your DISP obligations, customer contracts or security roadmap are written in Essential Eight language — most are — here's what's changing, what isn't changing yet, and what to do about it. Published 26/10/2026 · ACT Cyber, Principal Consultant.
From eight strategies to the Essentials series.
On 24 June 2026, the Australian Signals Directorate announced it would retire the Essential Eight within two years and consulted nationally on its replacement. In October 2026 ASD launched the result: the Essentials series, published on cyber.gov.au.
The new framework is organised into chapters — initially enterprise IT, operational technology and cloud — and each chapter is built from three elements: principles (the security outcomes to achieve), actions (what must be done to achieve them, many mapped to MITRE ATT&CK techniques), and domains (the business functions and assets the actions apply to, each with its own maturity rating). Where the Essential Eight prescribed a fixed set of technical controls and a single maturity ladder, the Essentials series is threat-informed and outcome-based — ASD's stated reason being that the Essential Eight had become too rigid for the pace of modern threats, including AI-enabled ones.
For organisations that have invested in Essential Eight maturity, ASD has been explicit: that work is not being made redundant. The Essentials series aligns closely with the existing controls — patching, MFA, application control, backups and the rest don't stop mattering because the framework around them changed shape.
Your obligations are still written in Essential Eight.
This is the part that matters commercially, and it's the part most of the early commentary skips. As at late October 2026:
The PSPF still mandates Essential Eight Maturity Level Two for non-corporate Commonwealth entities, and agencies still report against it annually. DISP membership obligations and annual security reporting still reference the Essential Eight. Commonwealth contracts, tender conditions and supplier assurance requests still ask for Essential Eight maturity evidence — and a contracts manager asking for "E8 ML2 alignment" means exactly that, today.
The Essential Eight remains in force while the Essentials series phases in. Rewriting your security documentation to "Essentials" language before your obligations change would put you ahead of every instrument you're actually measured against — and out of step with the people doing the measuring.
Treat it as cadence work, not a crisis.
The organisations that will handle this transition cheaply are the ones whose Essential Eight posture is current, evidenced and maintained — because mapping maintained controls to a new framework is an exercise, while rebuilding lapsed ones under deadline is a project.
Practically: keep your Essential Eight maturity assessment and evidence current, because it remains the compliance currency for at least the near term. When ASD publishes transition guidance for the enterprise IT chapter, map your existing controls to the new principles and actions as part of your normal review cycle. Watch for the moment your actual instruments change — PSPF releases, DISP guidance, contract templates — and move when they move, not before. And if you're partway through an Essential Eight uplift, finish it: the controls carry over, and "we maintained our posture through the framework transition" is a better sentence in front of any assessor than "we paused to wait and see".
This is precisely the kind of change a compliance subscription exists to absorb — tracked quarterly, mapped once guidance lands, with your registers and evidence carried across the transition instead of re-baselined in a panic later.
Obligations written in E8, framework moving to Essentials?
A 30-minute conversation on where your posture stands, what your contracts actually require, and how to carry both across the transition.