For years, the Essential Eight has been the benchmark Australian organisations use to measure cyber maturity. Boards ask about it, insurers ask about it, and government and enterprise buyers write it into tenders and supplier questionnaires. Now the Australian Signals Directorate (ASD) has confirmed the Essential Eight is being retired.
Under Horizon 2 of the 2023–2030 Australian Cyber Security Strategy, ASD will replace the Essential Eight with a broader, outcome-based ASD Essentials series covering enterprise IT, operational technology, cloud and, very likely, agentic AI. At Cyber Forte, we help organisations across Australia and New Zealand assess and uplift their Essential Eight maturity, and this change will affect almost every client we work with.
“The retirement of the Essential Eight is not a reason to pause your security program. The work you do now to reach Maturity Level 2 or 3 is the foundation for Essentials. The organisations that move early will be the ones that transition smoothly.” |
This guide explains what’s changing, why ASD is making the move, what applies right now under Horizon 2, and the practical steps your organisation should take today.
Not sure where to start? Talk to our team about an Essential Eight maturity assessment.
What Is Changing, and When?
On 24 June 2026, ASD confirmed it will retire the Essential Eight over roughly two years. Chris Horlyck, Head of Cyber Security Resilience at ASD’s Australian Cyber Security Centre, outlined a phased transition in comments reported by Cyber Daily.
The transition timeline
- Now: the Essential Eight and the new Essentials guidance run side by side as live documents. The Essential Eight remains in force.
- Around mid-2027 (12 months): ASD expects to begin deprecating the Essential Eight.
- Around mid-2028 (24 months): the Essential Eight is retired entirely, and Essentials becomes the standing framework.
There is no cliff edge. But two years passes quickly once you factor in budget cycles, tender requirements, board reporting and contracts that currently reference Essential Eight maturity levels. All of these will need to migrate to Essentials language during the transition window.
Why ASD Is Retiring the Essential Eight
The Essential Eight was first published in 2017, building on ASD’s Top Four mitigation strategies from 2012. It was designed for on-premises enterprise IT, at a time when cloud adoption was still emerging. Today’s environments look very different: SaaS, shared-responsibility cloud, BYOD, microservices, operational technology and AI agents operating inside business networks.
A structural mismatch with modern environments
Controls written for a traditional Windows domain do not translate cleanly to Microsoft 365, Azure, AWS or Google Workspace, where much of the control plane belongs to the provider. Organisations have struggled to apply prescriptive Essential Eight controls to environments the framework was never designed for.
The “going backwards” problem
Each time ASD tightened maturity requirements to keep pace with threats, organisations that had changed nothing appeared to drop a maturity level. Their actual security had not deteriorated, but reports to boards, regulators and customers suggested otherwise. The Essentials series is designed to separate threat-informed controls from a fixed maturity ladder, so a stable security posture no longer looks like it is regressing.
How the ASD Essentials Series Works
The biggest change is a shift from prescription to outcomes. Instead of specifying which controls to deploy and exactly how, Essentials describes the security outcome you must achieve. How you get there is up to you. Your existing tools and investments stay; the task is to point them at the right outcomes and demonstrate they work.
The guidance is grounded in ASD’s Information Security Manual (ISM), a risk-based control catalogue rather than a compliance checklist. It also draws on ASD’s Modern Defensible Architecture principles, which prioritise protecting your most critical assets over a thin perimeter. ASD has said it will publish practical implementation guidance and develop training standards to support the transition.
The three initial Essentials chapters
- Enterprise IT: the first chapter, with consultation already under way
- Operational Technology (OT): essential for utilities, manufacturing, energy and critical infrastructure
- Cloud: defining what shared responsibility with your cloud provider means in practice
Why a dedicated agentic AI chapter is expected
AI agents are non-person identities with their own access requirements, and they introduce new attack paths. Prompt injection, ranked first in the OWASP Top 10 for LLM Applications, can manipulate an agent into leaking data or taking unintended actions through instructions hidden in an email, document or web page. As organisations give AI agents access to files, systems and workflows, a dedicated Essentials chapter for agentic AI is a logical next step. Organisations managing AI risk can also look to ISO 42001 certification for a governance framework.
Essential Eight vs ASD Essentials: What's Actually Different?
Essentials is not simply the Essential Eight with a new name. Here is how the two approaches compare, based on what ASD has signalled so far.
| What changes | Essential Eight | ASD Essentials series |
|---|---|---|
| Approach | Prescriptive controls tied to specific technologies | Outcome-based: achieve the result with the tools that fit |
| Maturity model | Fixed maturity ladder (ML0–ML3) | Expected security outcomes, decoupled from a fixed ladder |
| Scope | Mainly on-premises enterprise IT | Separate domains for enterprise IT, OT, cloud and likely agentic AI |
| Foundation | Eight mitigation strategies | Grounded in the ISM and Modern Defensible Architecture |
| Cloud and SaaS | Limited, hard to apply to shared-responsibility models | Dedicated cloud chapter defining provider vs customer responsibility |
| Evidence | Often artefact-driven (screenshots, configuration exports) | Focused on demonstrated outcomes and effectiveness |
| Effect of threat updates | Organisations could appear to “go backwards” | Controls can evolve without making stable posture look worse |
| Existing investment | — | Carries across; ML1 and ML2 controls expected to map directly |
The final Essentials guidance is still being shaped through consultation, so details may change. The direction, however, is clear.
What Applies Right Now: ML2 and ML3 Under Horizon 2
The Essential Eight is still the live framework, and Horizon 2 is raising the bar on it today. Organisations should not wait for 2028.
- Maturity Level 2 is the new baseline. ML2 is now the recommended target for all Australian organisations, not just government. It requires controls to be applied consistently and verifiably across your environment, not in pockets.
- Maturity Level 3 for high-risk sectors. Critical infrastructure, energy, financial services and defence organisations should target ML3. That means controls resilient against sophisticated, targeted attacks, backed by evidence of continuous improvement.
Recent Essential Eight changes to check
The framework has also tightened since the November 2023 update. Check your environment against these requirements:
| Area | Current expectation |
|---|---|
| Critical vulnerabilities | Patch within 48 hours when the vendor rates a vulnerability critical or a working exploit exists |
| High-risk applications (browsers, email clients, PDF readers, Office, security software) | Patch within two weeks at ML1, tightened from one month |
| Multi-factor authentication | Phishing-resistant MFA (FIDO2 keys, Windows Hello for Business, smart cards) expected from ML2, including workstation authentication |
| Event logging | Centralised collection, protection and analysis of logs required from ML2 |
| Privileged access | Governance over privileged access to data repositories, including break-glass accounts, across ML1–ML3 |
The common thread is evidence. Asset and vulnerability management must be systematic, and patching, application control and macro restrictions must be documented, enforced and auditable. You need to demonstrate maturity, not simply assert it.
Find out where you stand against ML2 and ML3
Book a free 30-minute consultation with a Cyber Forte consultant. We’ll review your current Essential Eight posture, identify your biggest gaps and outline a practical path to ML2 or ML3.
What the Essentials Series Means for Your Organisation
ASD is still reviewing consultation feedback from government, industry and regulators, and final guidance has not yet been published. But the direction is clear enough to plan around:
- Outcomes will outweigh evidence artefacts. If your maturity rating relies on screenshots and configuration exports, without a clear understanding of which risk each control treats, expect a harder conversation. Essentials asks what you achieved, not what you installed.
- Cloud, SaaS and AI come properly into scope. Dedicated domain guidance will close gaps the Essential Eight never covered well, particularly where your cloud provider’s responsibilities end and yours begin.
- Your existing investment is protected. ASD has been explicit that work done under the Essential Eight stays relevant. Controls at ML1 and ML2 are expected to map directly into Essentials.
- Contracts and reporting will need updating. Tenders, supplier questionnaires, cyber insurance declarations and board reporting that reference Essential Eight levels will move to Essentials language over the transition.
- Compliance programs will connect more closely. Because Essentials is grounded in the ISM, organisations already aligning with ISO 27001, the SOCI Act or DISP will find more overlap and less duplicated effort.
When Should You Start Preparing for Essentials?
The short answer is now. As a practical guide, prioritise an Essential Eight review and Essentials readiness plan:
- Before your next budget cycle, so uplift to ML2 or ML3 is properly funded
- Before responding to government or enterprise tenders, where maturity evidence is increasingly scrutinised
- Before renewing cyber insurance, as insurers continue to tighten control requirements
- After significant change, such as a cloud migration, Microsoft 365 rollout, merger or acquisition
- Before deploying AI agents, to set access and monitoring guardrails from day one
- If you operate critical infrastructure, where ML3 and SOCI Act obligations raise the stakes
7 Questions to Ask About Your Essentials Readiness
Use these questions to test how prepared your organisation is. If you can’t answer them confidently, that’s where to focus first.
- What is our current maturity, based on evidence? Your least mature strategy sets your overall rating, so find the weak link.
- Have we reached ML2 consistently across the whole environment? Controls applied in pockets do not meet the new baseline.
- Can we patch critical vulnerabilities within 48 hours? Many organisations discover their patching process is slower than they thought.
- Is our MFA phishing-resistant? SMS codes and push notifications without number matching won’t meet ML2 expectations.
- Do we know which risk each control treats? This is the mindset Essentials will reward.
- Have we documented our cloud shared-responsibility model? Know what Microsoft, AWS or Google secures, and what you must.
- Do we know where AI agents have access to our data? Inventory them, apply least privilege and monitor their activity.
Not sure how you’d answer? Ask our team all seven questions.
Why Australian Organisations Choose Cyber Forte
Cyber Forte is an Australian-owned cybersecurity company founded in Melbourne, supporting organisations across Australia and New Zealand. Our team brings more than 25 years of combined cybersecurity experience and has worked with organisations including ANZ Bank, CPA Australia, Origin Energy, Australia Post and Accenture.
For Essential Eight and Essentials readiness, we offer:
- Evidence-based Essential Eight maturity assessments that show where you genuinely stand
- Prioritised uplift roadmaps to ML2 or ML3, focused on the gaps that matter most
- CREST ANZ Approved Company Member status, with CREST-certified testers who validate that controls actually work
- Security-cleared professionals experienced across government, defence and critical infrastructure
- Cloud and Microsoft 365 security expertise to address shared-responsibility gaps
- Board-ready reporting that explains your maturity in plain English
- Integrated compliance support mapped to ISO 27001, SOC 2, PCI DSS, the ISM and the SOCI Act
- A long-term security partner guiding you through the transition from Essential Eight to Essentials, not a one-off report
The result is a security program that satisfies today’s Essential Eight requirements and positions you for Essentials tomorrow.
From Essential Eight to End-to-End Cybersecurity
Reaching ML2 or ML3 rarely happens in isolation. Most organisations need broader support across testing, governance and monitoring to sustain their maturity.
Our broader capabilities include:
- Essential Eight compliance
- CREST penetration testing
- ISO 27001 certification and consulting
- ISO 42001 certification
- SOC 2 compliance
- PCI DSS
- SOCI Act compliance
- Security monitoring
- Security awareness as a service
- Digital forensics and incident response
This means you can work with one cybersecurity partner for maturity assessment, technical validation, compliance and ongoing security operations.
Explore Cyber Forte’s cybersecurity and compliance services.
Prepare for Essentials Without Losing Momentum
The retirement of the Essential Eight is the most significant change to Australian cyber security guidance in years. But it doesn’t have to be disruptive. ASD has made clear that the work you do now still counts.
The organisations that transition smoothly will be the ones that reach ML2 or ML3 today, understand the risk behind every control, and build evidence that proves their security works.
Start your Essentials journey with confidence.
Request a consultation with Cyber Forte about your Essential Eight maturity.
Frequently Asked Questions
Yes. On 24 June 2026, ASD confirmed it will retire the Essential Eight over approximately two years and replace it with the ASD Essentials series. ASD expects to begin deprecating the Essential Eight around mid-2027 and retire it fully around mid-2028.
Yes. The Essential Eight remains the live framework during the transition and runs alongside the new Essentials guidance. Organisations should continue working towards their target maturity level.
Essentials is ASD's new outcome-based cyber security guidance, grounded in the Information Security Manual (ISM). It will cover separate domains, starting with enterprise IT, operational technology and cloud, with agentic AI widely expected to follow.
No. ASD has been explicit that work done under the Essential Eight remains relevant under Essentials. Controls at Maturity Level 1 and 2 are expected to map directly across.
ML2 is now the recommended baseline for all Australian organisations. Critical infrastructure, energy, financial services and defence organisations should target ML3.
ASD is still reviewing consultation submissions. The Enterprise IT chapter is first, followed by operational technology and cloud. Keep an eye on cyber.gov.au for official releases.
A dedicated cloud chapter is expected to define what shared responsibility looks like in practice, closing gaps the Essential Eight never addressed well for SaaS and cloud platforms.
Yes. Cyber Forte provides evidence-based Essential Eight maturity assessments, prioritised uplift roadmaps to ML2 or ML3, CREST penetration testing to validate controls, and ongoing support through the transition to Essentials.
Get your Essential Eight maturity assessed before Essentials arrives
Don’t wait for an auditor, a tender panel or an attacker to find the gaps first. Book a free 30-minute consultation with a Cyber Forte consultant. You’ll get a clear view of your current maturity and a practical path to ML2 or ML3, with no obligation.
