Updated September 2026: the ASD’s consultation on the first chapter, Essentials for enterprise IT, closed on 12 July 2026, and nothing has been published since.

The Australian Signals Directorate (ASD) consulted during 2026 on evolving the Essential Eight into a broader Essentials series. The existing Essential Eight is expected to remain the basis of the guidance in the meantime, and the final transition arrangements are not yet published.

If your business has put work into the Essential Eight, this note sets out what the change means in practice.

What stays the same

The controls you already know are not going away:

  • multi-factor authentication on the accounts that matter;
  • keeping operating systems and applications patched;
  • backups that are tested and actually restore;
  • restricting administrator rights to the people who need them;
  • hardening macros and applications.

The ASD’s own position is that work already done against the Essential Eight remains valid.

What’s changing

Mostly how the guidance is packaged:

  • the Essential Eight becomes the first chapter — Essentials for enterprise IT — of a series, with further chapters to follow for other technology environments;
  • the ASD describes the new guidance as “prioritised, threat-informed mitigations for contemporary technology environments”, and says organisations already using the Essential Eight “can expect strong alignment with their existing controls and investments”. Whether the maturity levels survive in their current form has not been published.

The detail is still in draft; when the ASD publishes it, the specifics fold into the way a good assessment already works.

What this is not

It is not an emergency, and it is not a reason to spend on its own. You may start to see “the Essential Eight is being retired — act now” messages; they tend to arrive from a provider with something to sell. Most of what a well-run business would do this year, it would do anyway. A change in a framework’s name and structure does not change what your insurer will ask for at renewal, or what good practice looks like.

The question worth asking

The ASD can tell every business, for free, that its Essential Eight work still counts. No general guidance can answer the question specific to your business:

Is your IT provider actually doing the things your cyber insurer’s renewal questionnaire and your client contracts require — and is there independent evidence of it?

That question doesn’t depend on which framework is in fashion. It is the same question whether the standard is called the Essential Eight or the Essentials series. The honest answer usually needs someone independent of the provider being assessed — because the provider cannot mark its own homework.

In short

  • Your existing controls still count.
  • The change is a staged evolution, with transition arrangements still to be published; there is no deadline to beat.
  • Be wary of urgency from anyone selling the fix.
  • The thing worth checking is whether your provider is doing what you pay for — independently, and in writing.