ASD’s Essential Eight is heading for retirement

Australia’s Essential Eight cyber security framework is on the way out, but not overnight.

According to iTnews, reporting on 24 June 2026, the Australian Signals Directorate plans to retire the Essential Eight within two years and replace it with a broader “Essentials” series. The new guidance is expected to cover enterprise IT, cloud, operational technology and potentially agentic AI as separate security domains.

That is a big shift for a framework that has become the default yardstick for many Australian organisations asking a blunt question: are we secure enough?

iTnews reported that Chris Horlyck, head of cyber security resilience at the Australian Cyber Security Centre within ASD, said the current Essential Eight would remain live during the transition. He said ASD expected to start deprecating it in about 12 months, then retire it as a whole in 24 months.

The reason is simple. The Essential Eight was built for a different world.

It was first published in 2017, after evolving from ASD’s earlier Top Four mitigation strategies. Its controls cover areas including application control, patching applications and operating systems, configuring macro settings, hardening user applications, restricting administrative privileges, multi-factor authentication and regular backups.

Those ideas are not being tossed in the bin. The issue is structure.

Horlyck told iTnews the Essential Eight was designed for on-premises enterprise IT when cloud was still emerging. That makes it harder to apply cleanly to SaaS, cloud shared-responsibility models and modern hybrid environments.

Information Age, published by the Australian Computer Society, reported on 25 June 2026 that ASD had released the new Essentials standard for comment by industry and security partners. It said the new series would provide “prioritised, threat-informed mitigations for contemporary technology environments” backed by practical tools and implementation guidance.

Information Age also reported comments from ASD technical expert Jayden Cooke, who said the approach moves away from relying only on prescriptive technical controls from the Information Security Manual. Instead, it takes a more principles-based approach to stronger cyber security outcomes.

That matters because the attack surface has changed fast. Cloud services, identity platforms, unmanaged devices, browser-based SaaS and AI tools now sit at the centre of many organisations’ risk profiles.

A 29 September 2026 opinion piece in GovTech Review by Vinayak Sreedhar, A/NZ country head at ManageEngine, argued the replacement must address blind spots including identity governance, shadow IT, bring-your-own-device environments, third-party risk and agentic AI. That is vendor commentary, not ASD policy, but it reflects the pressure on the new framework to deal with real-world operating models rather than just expand the checklist.

Nano Solutions, in a transition tracker, also described the change as an evolution into an Essentials series starting with Essentials for enterprise IT. That is a secondary vendor account, but it lines up with the direction reported elsewhere.

The practical takeaway is less dramatic than the headline. Organisations should not pause Essential Eight uplift while waiting for the next thing. GovTech Review said ASD’s position is that the eight mitigation strategies remain a sound foundation, and iTnews reported the old and new guidance will run side by side during the transition.

So, yes, the Essential Eight is being retired. But for now it is still alive, still relevant and still the baseline many teams will be judged against.

The real test is whether Essentials can keep pace with the messy reality of modern IT. Cloud, SaaS, identity and AI do not behave like a tidy Windows fleet behind a firewall. Australia’s next cyber framework will need to recognise that from day one.