The Essential Eight is becoming the Essentials series

Grounded in the ISM

ASD has confirmed the new Essentials guidance will be grounded in the Information Security Manual (ISM). This means the series inherits the ISM's threat-informed mitigation philosophy but packages it into prioritised, practical guidance for contemporary technology environments.

Threat-informed and outcome-focused

The Essential Eight was built around prescriptive controls and specific technologies. The Essentials series moves toward a more outcomes-focused approach, giving organisations flexibility to achieve security objectives using the technologies and architectures that best suit their environment.

Multiple chapters, multiple domains

The first chapter is Essentials for enterprise IT. ASD has indicated future chapters will address areas such as cloud environments and operational technology. Emerging technologies including AI may also be considered in future guidance. Each chapter targets a specific technology domain rather than a one-size-fits-all model.

Practical tools and implementation guidance

ASD has stated the new Essentials guidance will offer prioritised, threat-informed mitigations supported by practical tools and clear implementation guidance. The intent is to make the framework easier to operationalise than the current maturity-level self-assessment process.

Existing controls carry over

ASD has explicitly stated that organisations already using the Essential Eight can expect strong alignment with their existing controls and investments. Your MFA deployment, patch management, backup strategy and application control work all remain directly relevant.

New adopters benefit too

New adopters will benefit from established best-practice guidance. The Essentials series does not raise the barrier to entry — it restructures the guidance so it is clearer and more adaptable to modern architectures.

Procurement and insurance still reference E8

Australian Government procurement, supply chain requirements and cyber insurance questionnaires will continue to reference Essential Eight maturity levels for at least 12 to 18 months after the new framework is published. Plan for both frameworks being referenced simultaneously during the transition.

SMB1001 maps cleanly

SMB1001 already maps to the Essential Eight controls and will be updated to map to the Essentials series as each chapter lands. Businesses holding or working toward SMB1001 certification are well positioned for the transition.

Chapter 1: Essentials for enterprise IT

The first chapter, built directly on the Essential Eight. Public consultation closed on 12 July 2026. This chapter will address enterprise-scale environments, cloud-native identity and outcome-based measurement.

Future: Cloud environments

ASD has signalled that cloud environments will be addressed in a future chapter. Today's Essential Eight assumes on-premises Active Directory and Windows server fleets in many places. A dedicated cloud chapter would acknowledge that most Australian organisations now operate Microsoft 365, Intune-managed endpoints and SaaS-first architectures.

Future: Operational technology

Operational technology (OT) — SCADA, ICS, PLCs and industrial control systems — is expected to get its own chapter. The current Essential Eight does not adequately address OT environments. A dedicated chapter would align with AS IEC 62443 and the SOCI Act obligations for critical infrastructure operators.

Potentially: AI and emerging tech

ASD has indicated that emerging technologies such as AI may be considered in future guidance. This aligns with ASD's separate Agentic AI Harnesses publication and the broader Australian Government approach to AI governance.

Timeline: 12 months to deprecation, 24 to retirement

ASD expects to begin deprecating the Essential Eight at roughly 12 months after the new framework is introduced and retire it at around 24 months. Expect at least 12 to 18 months of dual-running where both frameworks are referenced in parallel.

Continue your Essential Eight programme

Do not pause MFA rollout, patching cycles, backup testing or admin privilege restriction. The mitigation strategies behind the Essential Eight remain best practice and will form the foundation of the first chapter.

Document current maturity with evidence

Have a current, written ML self-assessment with evidence per control. Most organisations have a verbal understanding of where they sit. Write it down. The successor framework will refer back to today's maturity model for transition purposes.

Move identity to the centre

Whatever the final framework says, identity will be elevated. Enforce conditional access, deploy ITDR, document privileged access procedures and rationalise admin accounts. This is the single highest-leverage area.

Build outcome evidence, not just configuration evidence

Start logging the outcomes the framework is likely to ask for: credential-stuffing attempts blocked per quarter, mean time to patch by criticality, percentage of admin actions from PAW devices, percentage of OT assets visible to your inventory.

Line up who bridges the two frameworks

Decide now who is accountable for translating between the current Essential Eight and the successor framework as it lands, so the mapping work does not stall.

Get a gap assessment

A no-obligation baseline across all eight controls tells you where you stand today, what it takes to reach your target maturity level, and which quick wins move the needle most for cyber insurance, tenders and procurement.

The 'moved goalposts' problem

ASD acknowledged a complaint that has persisted for years: maturity level requirements for the Essential Eight have shifted under organisations' feet, creating the impression of organisations and agencies going backwards on cyber security without any actual deterioration in their security posture. Horlyck confirmed the phenomenon was real, attributing it to ASD absorbing new threat tradecraft into existing maturity levels rather than having a structure flexible enough to accommodate evolving controls separately. The Essentials series is designed to fix this by decoupling threat-informed controls from a fixed maturity ladder.

Cloud changed everything

Horlyck told iTnews: 'Essential Eight started before cloud was really a big thing in the sector. Now, if you don't have cloud, that would be a really surprising architecture to have.' The Essential Eight's controls do not translate cleanly to shared-responsibility models or SaaS environments. Separating cloud into its own chapter lets ASD give organisations clearer guidance on what their shared responsibility with a cloud provider actually looks like in practice.

Influenced by Modern Defensible Architecture

ASD's Modern Defensible Architecture publication is a key influence on the Essentials series. The series aims for a stronger emphasis on defence in depth and protecting crown jewels rather than a thin perimeter layer around IT environments. This is a philosophical shift from prescriptive technical controls toward architectural resilience.

From the Top Four (2012) to Essential Eight (2017) to Essentials (2026+)

The Essential Eight was first published in 2017, evolving from ASD's Top Four mandatory controls from 2012. The Essentials series is the next evolution in that lineage. Each generation has broadened the scope: four controls for government, to eight controls for enterprise IT, to a multi-chapter series for enterprise IT, cloud, OT and potentially AI.

Agentic AI may get its own chapter

Horlyck flagged that agentic AI could become a dedicated chapter, citing the distinct identity and access requirements for non-person entities operating on networks and the threat posed by prompt injection as sufficiently different from conventional controls to warrant its own treatment. This aligns with ASD's separate Agentic AI Harnesses publication.