The Australian Signals Directorate (ASD) consulted during 2026 on evolving the Essential Eight into a broader Essentials series. The existing Essential Eight is expected to remain the basis of the guidance in the meantime, and the final transition arrangements are not yet published.
If your business has put work into the Essential Eight, this note sets out what the change means in practice.
What stays the same
The controls you already know are not going away:
- multi-factor authentication on the accounts that matter;
- keeping operating systems and applications patched;
- backups that are tested and actually restore;
- restricting administrator rights to the people who need them;
- hardening macros and applications.
The ASD’s own position is that work already done against the Essential Eight remains valid. Good practice is still good practice.
What’s changing
Mostly how the guidance is packaged:
- the familiar maturity levels are giving way to a more outcomes-based, threat-informed model — describing what a control should achieve, rather than a fixed rung on a ladder;
- the scope widens to take in cloud services, operational technology, and — under active consideration — AI.
The detail is still in draft. We won’t speculate on a standard that hasn’t been published; when the ASD releases it, the specifics fold into the way a good assessment already works.
What this is not
It is not an emergency, and it is not a reason to spend on its own. You may start to see “the Essential Eight is being retired — act now” messages; they tend to arrive from a provider with something to sell. Most of what a well-run business would do this year, it would do anyway. A change in a framework’s name and structure does not change what your insurer will ask for at renewal, or what good practice looks like.
The question that’s actually worth asking
The ASD can tell every business, for free, that its Essential Eight work still counts. What no general guidance can answer is the question specific to your business:
Is your IT provider actually doing the things your cyber insurer’s renewal questionnaire and your client contracts require — and is there independent evidence of it?
That question doesn’t depend on which framework is in fashion. It is the same question whether the standard is called the Essential Eight or the Essentials series. The honest answer usually needs someone independent of the provider being assessed — because the provider cannot mark its own homework without a conflict.
In short
- Your existing controls still count.
- The change is a staged evolution, with transition arrangements still to be published; there is no deadline to beat.
- Be wary of urgency from anyone selling the fix.
- The thing worth checking is whether your provider is doing what you pay for — independently, and in writing.
Adeo is an independent IT oversight practice in Adelaide. We audit, advise, and oversee what your IT provider delivers — mapped to the prevailing ASD baseline (currently the Essential Eight, evolving to the Essentials series) and the controls your insurer asks for at renewal. Our revenue is the client’s fee alone; we take no commission from any vendor, and that is what keeps the read independent.
Questions about your own position: contact@adeo.au · adeo.au