The Essential Eight is being retired: what it means for you

If you've spent the past year getting your head around the Essential Eight, hearing it's being retired probably landed somewhere between annoying and alarming. Here's the calm version. It's true. It's slow. And the work you've done isn't wasted.

The short answer: on 15 June 2026, the Australian Signals Directorate (ASD) announced that the Essential Eight will evolve into a new framework called the Essentials series, with the transition staged over roughly two years. The current Essential Eight Maturity Model stays in force the whole way through. Your existing controls carry across.

What ASD actually announced

ASD opened consultation on what it calls the evolution of the Essential Eight. The replacement isn't another eight-item checklist. It's a multi-chapter framework, and each chapter covers a distinct technology domain.

The first chapter, Essentials for enterprise IT, is the direct successor to the Essential Eight. It covers the same ground the Essential Eight was built for: workstations, servers, identity, email. Ordinary business IT, in other words. Consultation on it ran through ASD's Cyber Security Partnership Program and closed on 12 July 2026. Later chapters are expected to cover operational technology and cloud, and ASD has flagged agentic AI as a likely future chapter.

The new guidance is grounded in ASD's Information Security Manual, which is the same source the Essential Eight draws on. That's one reason to believe the compatibility message. This is a reorganisation of guidance that already exists, not a clean-slate rewrite.

The Essential Eight retirement timeline, as currently indicated

• June–July 2026: announcement and consultation on Essentials for enterprise IT (closed 12 July 2026).
• Late 2026 (expected): the first Essentials chapter is published. From then on, both frameworks are live side by side.
• Around mid-2027 (indicated): ASD expects to start deprecating the Essential Eight.
• Around mid-2028 (indicated): the Essential Eight is retired entirely.

Two points on those dates. First, only the consultation dates are fixed. Everything after that is ASD's stated intent, and it could move. Second, for most small businesses the deadline that actually matters isn't on this list. It's whenever the people who ask you about the Essential Eight (insurers, big customers, government buyers) update their paperwork, and that happens gradually across the transition window.

Is your Essential Eight work wasted?

No. And that's not spin. ASD has been explicit that existing Essential Eight implementations map across to the Essentials series. The controls that make up the Essential Eight, such as multi-factor authentication, patching, regular backups and restricting admin privileges, aren't being deleted. They're being reorganised into a structure that can also handle the areas the Essential Eight never covered well, like cloud services and operational technology.

If you understand your maturity levels today, that understanding carries over. If you're halfway through lifting a control from Level 1 to Level 2, keep going. Stopping now is the one genuinely wasteful way to react to this news.

What insurers are doing during the transition

Right now? Exactly what they were doing before. Australian brokers and insurers commonly reference the Essential Eight in renewal questionnaires, and the contracts, procurement panels and policies that name it keep running on it until each one is updated. That updating will eat up much of the two-year window. Large organisations don't rewrite their questionnaires overnight.

So if your renewal falls in the next twelve months, expect the same Essential Eight-shaped questions as last year. We've covered what that means for your renewal in detail in a separate post.

What an Australian small business should do now

1. Keep assessing against the current model. The November 2023 Essential Eight Maturity Model remains the published, current framework until the Essentials series replaces it. It's what everyone measuring you is using. New to the framework altogether? Start with our Essential Eight compliance guide.
2. Keep your evidence current. The one constant across both frameworks is that controls need to be documented and demonstrable. Evidence of MFA coverage, backup testing and patching cadence stays valuable whatever the framework ends up being called.
3. Don't buy a panic rewrite. Anyone selling an urgent "Essentials series readiness" overhaul in 2026 is selling ahead of the facts. The first chapter isn't even final yet.
4. Watch the milestones, not the noise. Two moments matter: the first chapter's final publication, and the first time your insurer or a major customer updates their questionnaire to reference it.

If you don't know where you stand today, start there. Our free Essential Eight self-assessment gives you an indicative Level 0–3 per control in about 20 minutes, based on the current ACSC model. It's a self-assessment, not an audit or certification, and it reflects your own answers. Once the Essentials series is finalised, we'll track the change so your documentation moves with the framework instead of going stale. Frankly, that's the whole case for keeping compliance documentation on a subscription rather than a one-off PDF.

FAQ

Is the Essential Eight being retired?

Yes. On 15 June 2026 the Australian Signals Directorate announced the Essential Eight will evolve into a new multi-chapter framework called the Essentials series. The transition is staged over roughly two years, and the current Essential Eight Maturity Model stays in force while it runs.

When will the Essential Eight be retired?

ASD has indicated a staged transition. The first Essentials chapter is expected to be published in late 2026, deprecation of the Essential Eight is expected to begin around mid-2027, and full retirement is expected around mid-2028. These dates may shift as ASD finalises the framework.

What is replacing the Essential Eight?

The Essentials series, a framework organised into chapters by technology domain. The first chapter, Essentials for enterprise IT, is the direct successor to the Essential Eight. Later chapters are expected to cover operational technology and cloud, and ASD has flagged a possible chapter on agentic AI.

Do insurers still ask about the Essential Eight?

Yes. Brokers and insurers commonly reference the Essential Eight in questionnaires today, and existing contracts and requirements that name it keep applying until they're updated. Nothing in the announcement changes what you're likely to be asked at your next renewal.

Will I have to redo my Essential Eight work?

ASD has been explicit that existing Essential Eight investments map across to the Essentials series. The underlying controls (MFA, patching, backups, restricting admin privileges) aren't going away. They're being reorganised and modernised.