Essential Eight retirement: what ASD has actually said — and what it hasn’t

What is actually changing — and what is not

It is easy to read ‘Essential Eight retirement’ as a switch being flipped. That is not what the signals suggest. The Essential Eight remains the ASD’s recommended baseline of mitigation strategies, and the Maturity Model that grades them (Maturity Level One through Three) is still the reference organisations are measured against in 2026. What has been signalled is a direction of travel: the ASD has indicated it intends to broaden its prioritised-mitigation guidance into an ‘Essentials’ series that reflects how modern organisations actually operate. The current Essential Eight was designed around a Microsoft Windows internet-connected network; that assumption no longer fits most Australian businesses.

Until the ASD publishes finalised replacement guidance, the honest position is this: nothing you have built against the Essential Eight is wasted, and no organisation should stop applying application control, patching, MFA or backups because a successor is being discussed. The maturity model is not deprecated today. Anyone telling you the Essential Eight is already gone is ahead of the published record. You can follow the primary source directly at cyber.gov.au.

Why the ASD is moving toward an ‘Essentials’ series

The Essential Eight was built for a world of managed desktops and a defined network perimeter. Three shifts have stretched that model to breaking point, and each maps to an area the successor guidance is commonly expected to address.

Read these as the problems the ASD is trying to solve, not as confirmed chapter headings. The scope, naming and structure of any Essentials series should be treated as proposed until the ASD releases it.

The current Essential Eight, for reference

Whatever succeeds it will almost certainly build on these strategies rather than discard them, so they remain the right thing to invest in now.

If you are still building your evidence base for these, our walkthrough of Maturity Level Two evidence is the most efficient place to start.

The timeline: what we know, and what is speculation

There is no published, dated deprecation schedule for the Essential Eight as of July 2026. What exists is two different kinds of statement, and they should not be conflated. ASD has published a consultation on the evolution of the Essential Eight into ‘Essentials for enterprise IT’, the proposed first chapter of the series; that consultation closed on 12 July 2026. Separately, Chris Horlyck, the ACSC’s Head of Cyber Security Resilience, told iTnews on 24 June 2026 that ASD would look to begin deprecating the Essential Eight in about 12 months and retire it as a whole in about 24 months — an intention stated in a trade interview, not a published schedule. Any ‘Essential Eight deprecation 2026’ date you see quoted should be treated with caution unless it links to an ASD source. What is reasonable to expect, based on how the ASD has handled prior guidance changes:

• Consultation before change. The ASD typically signals direction and invites feedback before finalising major guidance. Expect draft or discussion material rather than an overnight switch.
• A transition window. When the successor lands, organisations will not be expected to re-baseline instantly; the Essential Eight and any Essentials series are likely to co-exist during a handover.
• Continuity of intent. MFA, backups, patching and privilege restriction are foundational. The strategies most likely to be reframed — not removed — are the ones tied tightly to Windows and on-premises assumptions.

Our advice: assign someone to monitor cyber.gov.au for the release, and do not pause current Essential Eight work in anticipation of it.

How to prepare now without betting on unpublished detail

The strongest position going into any framework change is a well-organised, evidence-backed control environment — because good evidence is portable across frameworks. Practical steps that pay off regardless of the final shape of the Essentials series:

This is where CyberSentien is designed to help. We assess readiness and organise the underlying evidence for the Essential Eight today — and because our approach is evidence-led rather than checkbox-led, controls without supporting evidence read ‘manual assessment required’ rather than a misleading green. When the Essentials series is published, a clean evidence base is what makes re-mapping cheap. We provide readiness and evidence assessment; we do not certify, and no software substitutes for accredited assessment where a scheme requires it.

Try it on sample docs

What this means for small and mid-sized businesses

For most Australian SMBs, the practical takeaway is reassuring. The fundamentals the ASD has long recommended — MFA everywhere, tested backups, timely patching, least-privilege access — are exactly the controls expected to carry forward. If you are a smaller organisation weighing where to spend limited security effort, the answer does not change because a successor framework is being discussed: get the basics evidenced and repeatable. Our small-business guidance walks through doing that proportionately. Businesses also juggling a tiered small-business cyber certification should note that the same underlying evidence — MFA logs, backup records, patch reports — supports multiple frameworks at once, which is the whole point of building the evidence base rather than the checklist. When accredited certification against a small-business certification scheme is required, that certificate is issued by an accredited provider, not by CyberSentien; our role is to prepare the readiness and evidence behind it.

Frequently asked