For almost a decade, the Essential Eight has been the reference point for cyber security maturity in Australia. Boards cite it, insurers ask about it, and tenders reference it by maturity level. That is about to change.
In June 2026, the Australian Signals Directorate (ASD) and the Australian Cyber Security Centre (ACSC) confirmed the evolution of the Essential Eight into a new body of guidance called the Essentials series. For organisations that have spent years building programs around the familiar eight mitigation strategies, this is a significant shift, but it is not a reason to panic. The new series is intended to give organisations greater flexibility in how they implement cyber security while maintaining a clear path towards stronger cyber resilience.
Here is what is actually changing, why it is happening, and what Intrix recommends doing now.
Why Retire Something That Has Worked?
The Essential Eight was first published in 2017, building on ASD’s earlier “Top Four” strategies. It was designed for a world of organisation-owned, on-premises Windows environments. For most businesses today, that world no longer exists.
The Essential Eight was designed primarily to protect internet-connected information technology networks. While its principles can be applied across different environments, the technology landscape has changed significantly since the framework was first introduced. Cloud platforms, software-as-a-service, remote work, mobile devices and identity-centric environments have fundamentally changed how organisations operate and secure their infrastructure.
An organisation running entirely on cloud and SaaS platforms does not map cleanly onto controls that assume you own and can see your infrastructure. Identity-centric, cloud-first environments have had to reason by analogy to assess themselves against several of the eight strategies. That is a workaround, rather than a natural fit.
There is also what ACSC has described as a “moving goalposts” problem. As new threat tradecraft emerged, it was incorporated into existing maturity levels rather than assessed separately. This meant organisations could appear to regress in maturity even though their actual security posture had not changed.
The Essential Eight has continued to evolve in response to changes in the threat environment. For organisations looking to understand their existing position, the Essential Eight maturity model remains an important reference during the transition.
Add in the rise of software-as-a-service, bring-your-own-device policies, microservices architectures, and increasingly, AI agents operating inside business environments, and the case for an update becomes difficult to argue against.
What Is Actually Changing?
The new Essentials series is intended to expand the current framework and provide organisations with greater flexibility in how they implement cyber security. ASD says the new guidance will be grounded in the Information Security Manual and provide prioritised, threat-informed mitigations for contemporary technology environments, supported by practical tools and implementation guidance.
In practice, that means:
A staged rollout. The first chapter, Essentials for enterprise IT, was open for public consultation until 12 July 2026. Additional chapters covering areas such as operational technology and cloud are expected to follow.
A transition period. The existing Essential Eight will remain an important reference while the new Essentials guidance is developed and introduced.
A threat-informed philosophy. The new guidance is designed around prioritised, threat-informed mitigations rather than relying solely on a fixed set of maturity requirements.
An open question on maturity levels. Whether Maturity Levels One, Two and Three will survive in their current form under the Essentials series has not yet been confirmed. Until ASD publishes the new assessment model, the existing Essential Eight maturity model remains an important reference point.
The consultation process is also significant. ASD stated that feedback from government, industry, regulators and organisations already using the Essential Eight would help shape the future development of the Essentials series.
For organisations already investing in the framework, ASD has also indicated that there should be strong alignment between existing Essential Eight controls and the new guidance.
What Isn’t Changing Yet
It is worth being clear about what this announcement does not mean. The Essential Eight is not being scrapped overnight, and nothing your organisation has already implemented is wasted effort.
Existing Essential Eight controls remain valuable. Organisations should continue to maintain and improve their current security controls rather than pause their security programs while waiting for the new framework.
The existing maturity model remains relevant. ASD continues to provide guidance for assessing organisations against the current Essential Eight maturity levels through its Essential Eight assessment process.
Existing controls and evidence still have value. Every control, policy, and piece of evidence you have built to support your current maturity level provides a useful baseline for future gap analysis. Organisations that have tied their controls to documented risk, rather than treating maturity levels as a box-ticking exercise, are best placed to transition smoothly.
For organisations that need help determining where they currently stand, an Essential Eight Assessment & Implementation can provide a practical starting point for identifying gaps, prioritising remediation and building a roadmap towards the required maturity level.
The key point is that organisations should not stop their existing cyber security uplift programs simply because the framework is changing.
What Intrix Recommends Now
1. Keep Implementing the Essential Eight
The Essential Eight remains an important ASD framework and continues to provide a practical baseline for reducing common cyber security risks.
If your organisation has not yet reached its target maturity level, there is little value in waiting for the new framework before addressing known gaps. Continue implementing the controls that are relevant to your environment and risk profile.
Intrix can help organisations assess their current maturity and develop a practical implementation roadmap through its Essential Eight Assessment & Implementation services. This can help organisations understand their current position, identify gaps and prioritise the work required to strengthen their security posture.
2. Document Your Current Maturity as a Baseline
Maintain a clear record of where your organisation stands today.
This should include your current maturity level, implemented controls, policies, exceptions, compensating controls, outstanding remediation activities and supporting evidence. A documented baseline will make it significantly easier to identify gaps when the new Essentials framework is fully published.
This is also where broader cyber security governance and risk advisory can play an important role. A structured governance approach helps organisations align security initiatives with business objectives, document accountability and build a roadmap that can adapt as regulatory and framework requirements evolve.
3. Audit Your Contractual References
List every contract, insurance policy, tender response and customer security questionnaire that references a specific Essential Eight maturity level.
Multi-year commitments to a framework that is being phased out deserve a second look now, rather than after it has been retired.
This is particularly important for organisations that regularly respond to government or enterprise procurement processes. Knowing exactly where Essential Eight requirements appear in your contractual and commercial obligations will help you manage the transition without creating unnecessary compliance risk.
A broader cyber security governance and compliance assessment can also help organisations review how their existing security obligations align with business risk, regulatory requirements and internal policies.
4. Start Strengthening Cloud and Identity Controls
The shift towards cloud-first and identity-centric environments means organisations should not wait for the final Essentials framework before addressing these areas.
Conditional access, strong multi-factor authentication, blocking legacy authentication, privileged access controls and OAuth application governance are sensible investments regardless of which framework your organisation is ultimately assessed against.
Cloud security should also be considered as part of the wider security architecture rather than treated as a separate compliance exercise. Intrix’s cloud security assessments and architecture services cover areas including cloud security strategy, governance, IaaS, PaaS and SaaS security assessments, identity and access management, and cloud security architecture.
These controls can help address attack paths increasingly associated with identity compromise, phishing and abuse of legitimate cloud services.
5. Validate That Your Controls Actually Work
Implementing a control is only part of the process. Organisations also need confidence that those controls are operating as intended and can withstand realistic attack scenarios.
This is where security testing can complement an Essential Eight implementation program. Intrix’s penetration testing services simulate controlled cyber attacks against networks and applications to identify vulnerabilities, validate security controls and provide actionable remediation guidance.
Testing can be particularly valuable when organisations have invested heavily in security controls but need independent assurance that those controls are actually reducing exploitable risk.
6. Watch the Consultation Process
Feedback on the Essentials for enterprise IT chapter closed on 12 July 2026, with additional chapters still to come. The detail of the final framework, including how assessments will work and whether the existing maturity model will remain, is still being shaped.
Organisations should therefore avoid making major strategic decisions based on assumptions about the final framework. Instead, use the transition period to understand your existing exposure, document your security posture and strengthen controls that are already clearly aligned with your risk profile.
The Bottom Line
This is an evolution, not a repudiation.
The Essential Eight did its job for the environment it was built for. That environment has changed, and the guidance is catching up.
Organisations with mature governance, a documented implementation roadmap, and evidence tied to actual risk, rather than maturity levels treated as an end in themselves, will be best positioned to move through this transition with the least friction.
The organisations that come out ahead will not necessarily be those that wait for every detail of the new framework to be finalised. They will be the ones that use the transition period to understand their current maturity, address known gaps, strengthen cloud and identity security, and establish evidence that demonstrates their controls are working.
Intrix can support organisations across this process, from Essential Eight assessment and implementation through to cyber security governance and risk advisory, cloud security assessments and penetration testing.
If you would like to understand what the transition means for your organisation, including your current security posture, compliance obligations, contractual exposure and areas requiring attention, speak with the Intrix Cyber Security team.
This article reflects publicly available information on the ASD/ACSC Essentials series as at August 2026. The final framework, including its assessment model, has not yet been published. Intrix will update clients as further detail is released.
