Essential Eight is heading for retirement as ASD readies broader cyber guidance

The Australian Signals Directorate plans to retire the Essential Eight cyber security framework within two years, according to reporting by iTnews on June 24, with the agency preparing a broader “Essentials” series for modern technology environments.

Chris Horlyck, head of cyber security resilience at the Australian Cyber Security Centre within ASD, told iTnews the existing framework would remain active during a transition. He said ASD expected to keep both the Essential Eight and the new Essentials guidance live for a period, then begin depreciating the Essential Eight after about 12 months and retire it as a whole after about 24 months.

The move is not a small branding exercise. The Essential Eight has become a familiar baseline for Australian organisations, especially in government, since it was first published in 2017 after evolving from ASD’s Top Four mandatory controls from 2012. Its core advice includes restricting administrator privileges, patching applications and operating systems, controlling which software can run, hardening systems, restricting Microsoft Office macros, using multi-factor authentication and maintaining backups.

ASD’s argument, as reported across iTnews, Information Age and Australian Cyber Security Magazine, is that the model no longer maps neatly onto how technology is actually run. Horlyck told iTnews the Essential Eight was designed for on-premises enterprise IT before cloud became commonplace, and that its controls do not translate cleanly to shared-responsibility cloud models or SaaS environments.

The first chapter of the replacement is “Essentials for enterprise IT”. Further chapters are expected for operational technology and cloud. Horlyck also flagged to iTnews that agentic AI could become its own chapter, given the distinct identity, access and prompt-injection risks associated with non-human entities operating on networks.

Information Age reported on June 25 that ASD technical expert Jayden Cooke described the new series as moving away from relying only on prescriptive technical controls from the Information Security Manual. Cooke said the Essentials approach is intended to be principles-based, threat-informed and compatible with existing Essential Eight programs.

That last point matters. ASD has said organisations that have already invested in Essential Eight implementation should not see that work become redundant. Australian Cyber Security Magazine similarly reported that the new series is expected to align closely with existing controls while moving away from a static compliance ladder.

There is a hard reality behind the redesign. Horlyck acknowledged to iTnews that organisations have long complained the Essential Eight maturity requirements shifted under them, creating the impression of cyber regression even where security had not actually deteriorated. The new model is meant to separate changing threat-informed controls from a fixed maturity ladder.

Analysis: flexibility may be necessary, but it is not automatically easier. Information Age pointed to repeated audit findings of weak Essential Eight compliance across Commonwealth entities, including “partly effective” controls and agencies falling short of required maturity levels. If organisations struggled to meet a clearer checklist, a more principles-based framework could become either a better fit for modern systems or a new target to miss.

Consultation on Essentials for enterprise IT was opened with feedback due via the ACSC Partner Portal by July 12, 2026.