So what, Essential Nine?
It is a common reaction when news of the Essential Eight retirement surfaces, and an understandable one. When a compliance framework your organisation has invested years working toward is announced as retired, the instinct is to assume they have simply tacked another item onto the list.
The Australian Signals Directorate (ASD) announced that the Essential Eight is being retired and replaced with the Essentials series, a broader multi-chapter framework covering cloud environments, operational technology, artificial intelligence and more, built for the way businesses actually use technology today.
What did the ASD announce?
The Essential Eight has been the benchmark for cybersecurity compliance in Australia for years, designed around on-premises IT environments at a time when that was where most organisations lived.
The way businesses use technology has shifted considerably since then, with cloud adoption, software-as-a-service, hybrid environments, operational technology and AI tools embedded into everyday workflows now standard across Australian mid-market organisations. The ASD acknowledged the Essential Eight was never built to account for any of them.
The Essentials series addresses that through a multi-chapter framework, where each chapter covers a distinct technology domain. The first chapter, Essentials for Enterprise IT, is the direct evolution of the Essential Eight and was in public consultation until 12 July 2026, with additional chapters covering cloud, operational technology and potentially AI expected to follow.
Is your Essential Eight work wasted?
No. The ASD has been clear that existing compliance work is the foundation of the new framework, which means organisations that have reached Maturity Level 1 (ML1) or Maturity Level 2 (ML2) are already ahead, with their existing controls carrying over into the Essentials series directly.
The core controls already in place, patch management, multi-factor authentication and application controls, remain central to the new framework, sitting within a broader and more current structure rather than being left behind.
What does the timeline look like?
Both frameworks will run in parallel during the transition period, with the ASD planning to begin deprecating the Essential Eight in approximately 12 months and retire it fully within 24, giving organisations time to understand the new requirements and close any gaps without a hard deadline forcing their hand.
Consultation on Essentials for Enterprise IT closed 12 July 2026, with ASD Cyber Security Partners having submitted feedback via the Partner Portal during that window.
On 15 June 2026, the ASD announced that the Essential Eight framework will be retired and replaced.
Public consultation on the first chapter, Essentials for Enterprise IT, is now open and will close on 12 July 2026.
The ASD will begin retiring the Essential Eight framework in 2027, approximately 12 months from now.
The Essential Eight is expected to be fully retired by 2028, approximately 24 months after the announcement.
Frequently Asked Questions (FAQs)
Is the Essential Eight being replaced?
Yes. The ASD has announced it will be deprecated in around 12 months and fully retired within 24 months. The replacement is the Essentials series, a multi-chapter framework covering enterprise IT, cloud, operational technology and AI.
What is the ASD Essentials series?
The Essentials series is the ASD’s new cybersecurity compliance framework for Australia. It covers multiple technology domains and moves from technology-specific controls to outcomes-based guidance. The first chapter, Essentials for Enterprise IT, is the direct successor to the Essential Eight.
Does my Essential Eight compliance still count?
Yes. The ASD has confirmed that existing compliance work is the foundation of the new framework. Organisations at ML1 or ML2 are well placed for the transition.
When does the Essential Eight get retired?
Deprecation is expected in approximately 12 months, with full retirement within 24 months. Both frameworks will run in parallel during that period.
When does consultation on the new framework close?
Consultation on the first chapter, Essentials for Enterprise IT, closed 12 July 2026.
Stay informed as the framework develops
The Essentials series is still taking shape. As the ASD releases further guidance, we will publish practical information on what the changes mean and what organisations should be doing to prepare.
Sign up below to receive updates directly.
Receive updates on the Essentials series
We will share guidance on the new framework as it develops. No noise, just what matters for your organisation.
