Australia’s baseline cyber framework is changing. The Australian Signals Directorate (ASD) has opened public consultation on evolving the Essential Eight into a broader Essentials series. It is a roughly two-year evolution, with both the current and the new guidance expected to run side by side while it happens — not an overnight switch.
If your business has put work into the Essential Eight, this note is the calm version of what that means.
What stays the same
The controls you already know are not going away:
- multi-factor authentication on the accounts that matter;
- keeping operating systems and applications patched;
- backups that are actually tested and actually restore;
- restricting administrator rights to the people who need them;
- hardening macros and applications.
The ASD’s own position is that work already done against the Essential Eight remains valid. Good practice is still good practice.
What’s changing
Mostly the packaging, not the substance:
- the familiar maturity levels are giving way to a more outcomes-based, threat-informed model — describing what a control should achieve, rather than a fixed rung on a ladder;
- the scope widens to take in cloud services, operational technology, and — under active consideration — AI.
The detail is still in draft. We won’t speculate on the specifics of a standard that hasn’t been published; when ASD releases it, the specifics fold into the way a good assessment already works.
What this is not
It is not an emergency, and it is not a reason to spend on its own. You may start to see “the Essential Eight is being retired — act now” messages; they tend to arrive from a provider with something to sell. Most of what a well-run business would do this year, it would do anyway. A change in a framework’s name and structure does not change what your insurer will ask for at renewal, or what good practice looks like.
The question that’s actually worth asking
The ASD can tell every business, for free, that its Essential Eight work still counts. What no general guidance can answer is the question specific to your business:
Is your IT provider actually doing the things your cyber-insurer’s renewal questionnaire and your client contracts require — and is there independent evidence of it?
That question doesn’t depend on which framework is in fashion. It is the same question whether the standard is called the Essential Eight or the Essentials series. The honest answer usually needs someone independent of the provider being assessed — because the provider cannot mark its own homework without a conflict.
In short
- Your existing controls still count.
- The change is a two-year evolution opened for consultation, not a deadline.
- Be wary of urgency from anyone selling the fix.
- The thing worth checking is whether your provider is doing what you pay for — independently, and in writing.
Adeo is an independent IT oversight practice in Adelaide. We audit, advise, and oversee what your IT provider delivers — mapped to the prevailing ACSC baseline (currently the Essential Eight, evolving to the Essentials series) and the controls your insurer asks for at renewal. Our only revenue is the client’s fee, never a vendor’s commission, which is what keeps the read independent.
A thirty-minute conversation costs nothing and carries no sales script — contact@adeo.au · adeo.au