Is the Essential Eight being retired, and what is the Essentials series?

Yes. In June 2026 the Australian Signals Directorate confirmed it will retire the Essential Eight and replace it with a broader Essentials series. Deprecation is expected to begin around mid-2027, with full retirement around mid-2028. The Essential Eight remains the active standard until then, and ASD has confirmed that work already invested in it carries across to the new framework.

Why it is changing

The Essential Eight was first published in 2017, before cloud was widespread. Its controls do not translate cleanly to software-as-a-service, shared-responsibility cloud models, operational technology or AI agents. The Essentials series is grounded in the Information Security Manual and takes a threat-informed, outcomes-based approach, with a stronger emphasis on defence in depth and protecting an organisation's crown jewels rather than a thin perimeter.

The timeline

Consultation on the first chapter, Essentials for enterprise IT, is open via the ASD Cyber Security Partnership Program portal until 12 July 2026. Both frameworks then run side by side, with deprecation of the Essential Eight beginning around 12 months later and full retirement around 24 months out. Further chapters are expected for cloud, operational technology and likely agentic AI. ASD has noted these timelines are indicative and could shift.

What to do now

Keep maturing against the Essential Eight. It is still the standard in force, it is still what tenders, contracts and DISP reference, and ASD has confirmed your investment is not wasted. The organisations that will transition most easily are the ones treating cyber security as a risk-led management system rather than a checklist, because that is the direction the Essentials series is moving.

For the current status and any updates as the framework evolves, check ASD's Essential Eight maturity model and its consultation on the evolution of the Essential Eight.

What it means for DISP members

DISP currently requires the Essential Eight at Maturity Level 2 across ICT systems used to correspond with Defence. How DISP will reference the Essentials series once it is finalised has not yet been confirmed by Defence. We keep Defence-industry clients across changes as they are announced. See our DISP IT support in Canberra.

How Blue Arc helps

We build and maintain controls tied to your actual risks and outcomes, so they map cleanly whether you are assessed against the Essential Eight today or the Essentials series later. See our managed services or get in touch.

Last reviewed: 1 July 2026. This guidance reflects ASD announcements current at that date; the Essentials framework is still in consultation.

Frequently asked questions

Is the Essential Eight still worth doing?

Yes. It is the active standard today, it is still what tenders, contracts and DISP reference, and ASD has confirmed the controls and tools you invest in now carry across to the Essentials series.

When will the Essential Eight be retired?

ASD expects to begin deprecating it around mid-2027 and to retire it fully around mid-2028. Those timelines are indicative and could shift while consultation is open.

What replaces the Essential Eight?

A new Essentials series, grounded in the Information Security Manual, with separate chapters for enterprise IT, cloud, operational technology and likely agentic AI, focused on security outcomes rather than a fixed maturity ladder.