The Essential Eight is Being Retired — What Replaces It?

In June 2026, the Australian Signals Directorate (ASD) confirmed what many in the industry had anticipated: the Essential Eight framework — Australia's cornerstone cyber security guidance since 2017 — will be retired within the next two years and replaced by a broader “Essentials series.”

“The new Essentials series will offer prioritised, threat-informed mitigations for contemporary technology environments, supported by practical tools and clear implementation guidance.”— Australian Signals Directorate, June 2026

Why Is It Changing?

The Essential Eight was designed for traditional on-premise enterprise IT environments. But the threat landscape has shifted dramatically. Cloud-first architectures, operational technology (OT), hybrid workforces, and now agentic AI have created attack surfaces the original eight strategies simply weren't built to address.

As ASD technical expert Jayden Cooke explained, the framework had become a “static compliance ladder” rather than a living, threat-informed defence posture. The new series is designed around four core principles: flexibility, threat-informed insights, prioritisation and risk management, and compatibility and future focus.

What Is the “Essentials Series”?

The replacement will be a modular set of guidance covering distinct security domains:

• Enterprise IT — the direct successor to the current Essential Eight
• Cloud Environments — dedicated guidance for cloud-native and hybrid architectures
• Operational Technology — covering SCADA, ICS, and critical infrastructure systems
• Agentic AI — emerging guidance for AI-driven systems and autonomous agents

Instead of rigid maturity levels (ML1, ML2, ML3), the new series will offer prioritised mitigations that businesses can adopt based on their actual risk profile — a more realistic and achievable approach for SMBs.

“Replacing Essential Eight will be a broader Essentials series designed to cover enterprise IT, cloud, operational technology, and potentially agentic artificial intelligence as distinct security domains.”— iTnews, reporting on ASD announcement

What Should You Do Right Now?

Despite the retirement announcement, the Essential Eight remains the current standard. Insurers, procurement panels, and regulators still require evidence of maturity. The ASD has been clear: the transition will take two years, and existing Essential Eight implementations will map directly to the new framework.

Businesses that invest in Essential Eight now are not wasting effort — they're building the foundation the Essentials series will build upon. Australia's 2026–2028 Cyber Security Strategy still positions ML2 as the recommended baseline for every sector.