Australia’s baseline cyber framework is being replaced over the next two years. The shift from a score to a provable position is the part to plan for.

TL;DR

  • ASD has opened consultation on replacing the Essential Eight with a new modular Essentials series. Officials indicate the Eight will be deprecated in about a year and retired in about two, though nothing is in force yet.
  • The structural change matters more than the controls. The Essentials series is grounded in the ISM and is risk-based, so the question moves from what is your maturity level to show me your risk-based position and the evidence.
  • Every obligation that names the Essential Eight, from the PSPF to DISP to critical infrastructure and countless contracts and insurance questions, will have to re-point. The planning window is now.

The quiet announcement

On 15 June 2026, ASD opened a consultation on evolving the Essential Eight into a new body of guidance it is calling the Essentials series. ACSC officials have since indicated the Eight will begin to be deprecated in about twelve months and retired at around twenty-four. It is the biggest change to Australia’s baseline cyber guidance since the Eight replaced the Top Four in 2017, and it deserves more attention than it has had.

Be clear on one thing first. Nothing is in force yet. The November 2023 Essential Eight Maturity Model remains the current, published framework, and every obligation still points at it. The deprecation clock has not started, and the timeline comes from official interviews rather than a signed date. So this is a planning matter, not a fire drill.

What is changing

The Essential Eight was a single checklist, scored on a maturity ladder of one to three. The Essentials series is being built as a modular set of chapters instead. The first, Essentials for enterprise IT, is the direct evolution of the Eight. Further chapters are planned for cloud and operational technology, with agentic AI flagged as a likely addition. The reason is straightforward. The Eight was built for on-premises IT in a pre-cloud era, and it has not kept pace with cloud, operational technology, and faster, AI-enabled threats.

What is really changing

The controls are not the story. The Essentials series is grounded in the Information Security Manual, which is a risk-based control catalogue rather than a checklist with a score. It moves away from the rigid maturity ladder toward prioritised, threat-informed mitigations.

So the question changes. Today it is, what is your Essential Eight maturity level. A number. Under Essentials it becomes, show me your risk-based position and the evidence behind it. The ladder produced a score you could attest to. The new model asks for judgement and proof. For any organisation that has run the Eight as eight boxes to tick, that is a harder landing than a new list of controls.

Who this touches

Almost everyone with a cyber baseline obligation. Every place the Essential Eight is named today will have to re-point to the Essentials series over time. That includes the Protective Security Policy Framework for Commonwealth entities, the Defence Industry Security Program for defence suppliers, and critical infrastructure work that leans on the Eight. It also includes the large private tail pulled in indirectly, through government contracts, cyber insurance questionnaires, and supply-chain requirements that use the Eight as their measure. Most of these organisations have not started planning the move.

The window

The gap between now and deprecation is the planning window. It is too early to remediate against a final standard that is not published, and too late to do nothing. The sensible work now is to understand your current position, see how it maps to a risk-based model, and hold a plan that updates as each chapter lands. The worst position is to still be scoring maturity levels the month the standard retires.

One caution. Anyone offering Essentials compliance today is offering something that does not exist. The standard is still being written. What you can do is get ready to move, and stay ready as it firms up.

What to do now

Three steps, and none is dramatic. Keep maintaining the Essential Eight. It still counts, and ASD has been clear the investment carries over rather than being made redundant. Watch each Essentials chapter as it publishes, starting with enterprise IT, then cloud and operational technology. And treat the transition as a risk exercise rather than a compliance scramble: a current position, a mapping to where the standard is heading, and a plan you keep alive.

The deeper shift

Underneath the framework names, this is a change in how Australia measures cyber. We are moving from a number you can attest to, toward a position you have to prove and keep current as the ground shifts. That is the direction good risk practice was already heading, and it rewards organisations that treat their security posture as an operation rather than a form completed once a year.

That is the work we do at BayRisk. We keep a current, evidenced risk position and run the discipline around it, so that when the baseline moves you are ready to prove where you stand rather than scrambling to rebuild a score. The Essential Eight gave you a number. What replaces it asks for a position. The organisations that plan for that now will find the transition a running start, not a reset.

References

  • ASD, Consultation on the evolution of the Essential Eight, 15 June 2026.
  • ASD, Information Security Manual, June 2026 release.
  • ASD, Essential Eight Maturity Model, November 2023 (the current framework at the time of writing).
  • ACSC officials via industry press, June 2026, for the indicative deprecation and retirement timeline.