Is the Essential Eight being retired, and what is ASD Essentials?

Yes, but on no fixed date. On 15 October 2026 the Australian Signals Directorate launched ASD Essentials, which it describes as an evolution of the Essential Eight, with separate chapters for enterprise IT, cloud and operational technology. ASD will keep both frameworks available during a transition it has not yet dated, and says organisations should keep meeting their current regulatory obligations, such as DISP's Essential Eight Maturity Level 2, until their regulator says otherwise.

What ASD launched on 15 October 2026

ASD Essentials is a series of chapters, each written for a different kind of technology environment. The first three are:

Essentials for enterprise IT: traditional networks with servers, an on-premises or hybrid directory and managed workstations. This is the direct evolution of the Essential Eight.

Essentials for cloud: organisations whose technology is delivered entirely through software-as-a-service and platform-as-a-service, such as a business running wholly on Microsoft 365. See does ASD Essentials for cloud apply to a Microsoft 365 Business Premium business?

Essentials for operational technology: industrial and control systems run by critical infrastructure operators.

Alongside the chapters, ASD published a transition guide for existing Essential Eight users, an implementation planning guide, an assessment process guide, guidance for senior executives, and a publication on AI considerations within the Essentials. AI arrived as cross-cutting guidance rather than as its own chapter: ASD treats AI as another asset to scope into each chapter, and the governance actions now include executive accountability for AI. Read ASD's launch announcement and the ASD Essentials home page.

How ASD Essentials differs from the Essential Eight

The Essential Eight was a list of eight mitigation strategies with prescriptive requirements at maturity levels 1 to 3. ASD Essentials replaces that with three layers. Principles describe the security outcome to achieve, drawn from the Information Security Manual. Actions describe what must be done to achieve it. Domains group the business functions and assets an action applies to: six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems and User devices) and two capability domains (Governance and culture, and Visibility and response) that apply throughout.

Maturity levels are gone. In their place are three priority phases that set the recommended order to work through the technical domains: phase 1 is Boundary services and Identity services, phase 2 is Critical processes and services and Privileged environments, and phase 3 is Business systems and User devices. ASD is explicit that phases describe sequence, not how secure you are. Assessment changes too: each action is rated not assessed, not effective, partially effective or fully effective for the assets in each domain, and a principle's rating is set by its weakest applicable action.

Two practical shifts stand out. First, the fixed patching windows of the Essential Eight (48 hours, two weeks, one month) give way to defined risk-based timeframes, set according to exploitation, exposure, criticality and impact, although ASD notes that applicable ISM, regulatory and other mandatory timeframes still apply. Second, the Essentials cover ground the Essential Eight never assessed: executive accountability, supplier and supply chain assurance, content filtering, security awareness training, legacy system management, and a dedicated Visibility and response domain for logging, detection and incident response.

Does your Essential Eight maturity level carry across?

Your controls do; your rating does not. ASD's Essentials FAQ says "Every Essential Eight mitigation strategy maps to at least one principle in the Essentials series", but also that "Maturity level ratings under the Essential Eight maturity model do not automatically convert into effectiveness outcomes under the Essentials series."

ASD's transitioning from the Essential Eight guide is specific about what to expect. Organisations at Maturity Level 2 can expect many existing controls to contribute to the early priority phases, and ASD names phishing-resistant MFA, patching internet-facing services, privileged access, application control and centralised logging. The common areas needing more work are extending controls to assets or domains not previously covered, the Governance and culture domain, Visibility and response, and producing evidence of sustained effectiveness rather than deployment alone. Organisations at Maturity Level 1 can use the same transition approach but should expect a greater proportion of actions to need additional implementation. Even Maturity Level 3, ASD says, does not automatically produce fully effective ratings.

The timeline

There is no published retirement date. ASD's FAQ says it has been talking to regulators about expected timeframes and "will advise on expectations for transitioning to the new framework in due course". During the transition, ASD will maintain both the Essential Eight and the Essentials on cyber.gov.au, and the Essential Eight maturity model itself is unchanged since 27 November 2023.

An earlier version of this page cited indicative dates of mid-2027 for deprecation and mid-2028 for retirement, based on ASD's consultation-stage wording, which put deprecation about 12 months and retirement about 24 months after consultation concluded. Consultation ran from 15 June to 12 July 2026; the launch materials do not repeat those figures, and ASD's consultation page no longer carries them. Treat any specific retirement date you see quoted as unconfirmed until ASD or your regulator publishes one.

What to do now

Keep going with work already approved. ASD's FAQ says it "does not recommend slowing or stopping the roll-out of pre-approved cyber security initiatives", and that organisations should continue their current uplift programs while assessing alignment with the new framework.

Be more careful with new work. ASD's transition guide says: "Do not initiate work solely to achieve a superseded Essential Eight target unless it remains required by a regulator or other obligation or continues to address material cyber security risk." In practice, most Essential Eight controls still address material risk, and DISP and many contracts still require them, so this rarely stops a project, but it is a good reason to check that each new piece of work is justified by risk or obligation rather than by the label.

Then follow ASD's recommended transition pathway: record your current Essential Eight position (latest assessment, controls, exception and risk registers, planned work); scope the assets in the phase 1 domains plus the two capability domains; run a gap analysis classifying each action as already effectively addressed, partially addressed or not addressed; and plan implementation from there.

What it means for DISP members

Nothing changes yet. Under DSPF Principle 16, Control 16.1, Annex A, DISP requires the full Essential Eight at Maturity Level 2 across the ICT systems used to correspond with Defence. As at 19 October 2026, Defence's DISP cyber and assurance page still states that all members "are now required to achieve and maintain compliance with the full E8 Maturity Level 2 standard" and does not mention ASD Essentials. ASD's own guidance is that "Until associated regulatory changes are communicated by regulators, organisations should continue to meet their current regulatory obligations." Keep building to ML2 and keep the Cyber Security Questionnaire evidence current. We keep Defence-industry clients across changes as Defence announces them. See our DISP IT support in Canberra.

How Blue Arc IT Solutions helps

We build and maintain controls tied to your actual risks, with evidence that shows they keep working, which is what both the Essential Eight and ASD Essentials assess. For clients with an Essential Eight obligation we keep that on track; for the rest, we help work out which Essentials chapter fits and what the gap looks like. See our managed services or get in touch.

Last reviewed: 19 October 2026, against ASD's Essentials launch announcement, Essentials FAQ and transitioning from the Essential Eight guide (all published 15 October 2026), the Essential Eight maturity model (unchanged since 27 November 2023) and Defence's DISP cyber and assurance page. We will refresh this page when ASD publishes transition timeframes or Defence updates DISP.

Frequently asked questions

Is the Essential Eight still worth doing?

Yes, where a regulator, contract or DISP requires it, and wherever the work still addresses a real risk. ASD will maintain the Essential Eight alongside ASD Essentials during the transition, does not recommend slowing or stopping approved uplift programs, and says every Essential Eight mitigation strategy maps to at least one Essentials principle.

When will the Essential Eight be retired?

ASD has not set a date. Its Essentials FAQ says it has been talking to regulators about expected timeframes and will advise on transition expectations in due course. Until regulators communicate changes, organisations should keep meeting their current obligations.

What replaces the Essential Eight?

ASD Essentials, launched on 15 October 2026: a principles-based series with chapters for enterprise IT, cloud and operational technology, plus supporting guidance on transition, implementation, assessment and AI. Essentials for enterprise IT is the direct evolution of the Essential Eight.

Does our Essential Eight maturity level carry across to ASD Essentials?

Not as a rating. ASD says maturity levels do not automatically convert into Essentials effectiveness ratings, because the two measure different things. Your existing controls and evidence carry forward as the starting point for a gap analysis, and ASD expects organisations at Maturity Level 2 to find many controls contributing to the early priority phases.