The Essential Eight is evolving and ASD wants your view

Source

The consultation is published on cyber.gov.au under the news category, and the consultation pack is hosted on the ASD Cyber Security Partnership Program portal. Partnership Program members and the public could submit views until the close date.

Why now

The current Essential Eight maturity model has not changed materially since the November 2023 release. ASD has signalled that the framework needs to evolve to address enterprise-scale environments, cloud-first identity, and the operational realities of mature organisations that already meet the controls but want clearer accountability for outcomes.

What stays the same

The eight mitigation strategies (application control, patch applications, configure Microsoft Office macros, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, regular backups) remain the foundation. Australian SMBs working toward ML1 to ML3 should continue to do so. The successor framework is not a reset.

Consultation closed 12 July 2026

ASD accepted views on enterprise scalability, cloud-native identity, OT environments, and how outcomes should be measured beyond the existing maturity levels. The consultation has now closed and ASD will work through submissions before publishing the final framework.

ML1 to ML3 work continues to be valuable

Maturity Level 1, 2, and 3 work delivered today maps cleanly onto the practical security controls every Australian business should have in place. Cyber insurers, government procurement, and boards all continue to reference Essential Eight maturity in 2026.

Your provider should translate it for you

Whoever runs your security programme should be reading the framework as it lands and telling you what actually changes for your environment. Real Bytes will publish a Real Bytes view on transition once the consultation feedback is reflected in the final framework.

Procurement language will lag the framework

Expect Australian Government and insurer procurement language to continue referencing Essential Eight ML1 to ML3 for at least 12 to 18 months after any new framework is published. Plan for both being in use simultaneously.

What to defer

Defer any net-new cybersecurity programme that depends on the new framework's specific outcome wording. Do not defer programme work on MFA, patching, backups, administrative privilege restriction, or any other Essential Eight control.

Outcome-based language

Likely shift from prescriptive maturity-level checkboxes toward outcome statements that organisations can demonstrate they have achieved. Reduces tick-box behaviour, increases the requirement for operational evidence.

Enterprise scalability

Likely additional guidance for organisations with thousands of endpoints, federated identity, multiple business units, and complex change-management environments. Today's ML2 and ML3 guidance is sometimes difficult to scale operationally.

Identity as a first-class layer

Identity (Entra ID, Okta) has become the new perimeter. The successor framework is likely to improve identity controls beyond the current MFA strategy, covering conditional access, identity threat detection and response (ITDR), and privileged access management (PAM) as core expectations.

Cloud-first operational reality

Today's Essential Eight assumes Windows server fleets and on-premises Active Directory in many places. The successor framework is likely to acknowledge that most Australian SMBs and mid-market organisations now operate Microsoft 365, Intune-managed endpoints, and SaaS-first architectures.

Measurement and reporting

Likely additional guidance on how to evidence the controls to insurers, boards and auditors. The current ML self-assessment process is not consistent across organisations and the successor framework is expected to address this.

Consultation has closed

The public consultation on Essentials for enterprise IT closed on 12 July 2026. ASD will now work through submissions before publishing the final framework. If you missed the window, your priorities are still best captured in a written Essential Eight maturity assessment with evidence, ready for when the successor framework lands.

Document current Essential Eight maturity

Have a current, written ML self-assessment with evidence per control. Most organisations have a verbal understanding of where they sit. Write it down. The successor framework will refer back to today's maturity model for transition purposes.

Move identity to the centre

Whatever the final framework says, identity will be elevated. Enforce conditional access, deploy ITDR, document privileged access procedures, and rationalise admin accounts. This is the single highest-leverage area.

Build outcome evidence, not just configuration evidence

Start logging the outcomes the framework is likely to ask for. Examples: number of credential-stuffing attempts blocked per quarter, mean time to patch by criticality, percentage of administrative actions performed from PAW devices, percentage of OT assets visible to your asset inventory.

Clean up your backup posture

Backups remain critical. Verify the 3-2-1 minimum, test restorations quarterly, document RTO and RPO per system, and confirm Microsoft 365 backups are in place. The successor framework is likely to be stricter on testing.

Line up who bridges the two frameworks

Decide now who is accountable for translating between the current Essential Eight and the successor framework as it lands, so the mapping work does not stall. Real Bytes will publish a Real Bytes view on transition once ASD publishes the consultation outcome.