What Is Changing?
The Australian Signals Directorate (ASD) is evolving the Essential Eight into a broader Australian Cyber Essentials framework. The Essential Eight isn’t disappearing overnight, but it will transition over the next two years into a more comprehensive set of guidance covering enterprise IT, operational technology (OT), cloud services, internet-facing infrastructure and small business environments. Organisations should continue implementing the Essential Eight while preparing for the broader security framework.
For more than a decade, the Essential Eight has been one of Australia’s most recognised cyber security frameworks. Organisations across government and industry have used it to strengthen endpoint security, improve resilience against ransomware and demonstrate a practical approach to cyber risk.
That hasn’t changed.
What has changed is the environment the framework was designed to protect.
Today’s organisations rely heavily on cloud platforms, SaaS applications, APIs, hybrid infrastructure, operational technology and increasingly, artificial intelligence. Security programmes are no longer centred around traditional Windows desktops operating inside a corporate network. Modern environments are distributed, interconnected and constantly evolving.
Recognising this shift, the Australian Signals Directorate (ASD) has announced plans to evolve the Essential Eight into a broader Australian Cyber Essentials framework. Rather than relying on a single set of mitigation strategies, ASD intends to provide security guidance tailored to different technology environments and organisational needs.
This isn’t a signal that organisations should abandon the Essential Eight.
It’s recognition that cyber security has become too complex for eight mitigation strategies alone to address every scenario.
Why ASD Is Expanding the Framework
When the Essential Eight was first introduced, it addressed some of the most common techniques attackers used to compromise enterprise environments. Application control, patch management, restricting administrative privileges and multi-factor authentication remain highly effective security controls today.
However, the threat landscape has evolved considerably.
Cloud adoption has accelerated.
Remote work has become standard.
Operational technology has become increasingly connected.
Organisations now manage identities across multiple cloud platforms while integrating third-party services and AI-powered applications into everyday operations.
These technologies introduce risks that extend well beyond traditional endpoint security.
Rather than replacing the Essential Eight, ASD is expanding its guidance to better reflect how Australian organisations operate today.
The proposed Australian Cyber Essentials framework will consist of multiple guidance documents, allowing organisations to apply recommendations that are relevant to their specific environments rather than relying on a single framework to cover every possible scenario.
This reflects an important shift in cyber security.
Security frameworks are becoming more contextual.
Instead of asking every organisation to implement exactly the same controls, guidance is increasingly being tailored to different technologies, operational requirements and levels of maturity.
The Essential Eight Isn’t Going Away Tomorrow
One of the biggest misconceptions following the announcement is that the Essential Eight is being retired immediately.
That’s not the case.
The Essential Eight remains ASD’s recommended baseline for enterprise endpoint security and will continue to be relevant throughout the transition period.
For organisations already investing in Essential Eight maturity, those efforts remain valuable.
Controls such as:
- Application Control
- Patch Applications
- Patch Operating Systems
- Restrict Administrative Privileges
- Multi-Factor Authentication
- Microsoft Office Macro Controls
- User Application Hardening
- Regular Backups
continue to provide strong protection against many of today’s most common attack techniques.
These controls aren’t becoming obsolete.
They’re becoming one component of a broader security programme.
Think of the Australian Cyber Essentials as an expansion rather than a replacement.
Instead of focusing almost exclusively on enterprise endpoints, future guidance will address additional technology environments that organisations increasingly depend on.
A More Practical Framework for Modern Organisations
One of the strengths of the new approach is that it better reflects how organisations actually operate.
Very few businesses rely exclusively on on-premises Windows environments today.
Instead, a typical Australian organisation may operate:
- Microsoft 365 and cloud identity platforms
- AWS, Microsoft Azure or Google Cloud workloads
- Internet-facing applications and APIs
- Operational Technology (OT) environments
- SaaS business applications
- Hybrid infrastructure
- AI-enabled business systems
Each environment introduces different risks.
The security controls that effectively protect a manufacturing control system aren’t necessarily the same controls required for cloud-native applications or AI services.
By creating dedicated guidance for different technology environments, ASD is recognising that cyber security is no longer one-size-fits-all.
This should ultimately make the guidance more practical and easier for organisations to apply.
What Should Organisations Be Doing Now?
One question we’ve heard repeatedly since the announcement is whether organisations should pause their Essential Eight programmes until the new framework is released.
The answer is no.
If your organisation is already working towards Essential Eight maturity, continue that work.
The controls remain highly effective and continue to address many of the techniques used by attackers today.
Instead, organisations should use this transition period to broaden the conversation beyond endpoint security.
Some practical steps include:
- Continue improving Essential Eight maturity.
- Review cloud security alongside endpoint security.
- Assess identity and privileged access controls.
- Understand internet-facing assets and APIs.
- Review third-party and supply chain risks.
- Incorporate security into AI adoption initiatives.
- Align governance with emerging ASD guidance as it becomes available.
The organisations that will benefit most from Australian Cyber Essentials won’t necessarily be those starting from scratch.
They’ll be those that already have strong security fundamentals and are prepared to extend them into new technology environments.
What This Means for Security Teams
For security practitioners, the transition to Australian Cyber Essentials shouldn’t be viewed as another framework to implement from scratch. Instead, it’s an opportunity to reassess whether existing security programmes reflect the way the organisation actually operates today.
Many cyber security strategies are still heavily focused on endpoints. While endpoint protection remains critical, it represents only one part of the modern attack surface.
Today’s organisations are managing identities across multiple cloud platforms, deploying internet-facing APIs, integrating third-party SaaS platforms and increasingly adopting AI-powered services. Attackers are adapting to those changes, targeting cloud identities, exploiting application vulnerabilities and abusing trusted relationships rather than relying solely on traditional malware.
The proposed Australian Cyber Essentials framework recognises this evolution.
Rather than expecting organisations to apply the same guidance regardless of their technology environment, the framework aims to provide recommendations that are relevant to specific environments such as enterprise IT, cloud services and operational technology.
For security teams, that’s a positive development.
It means guidance is becoming more aligned with real-world architecture rather than assuming every organisation operates the same way.
Security Maturity Is About More Than Compliance
One concern whenever a framework changes is that organisations become focused on compliance rather than security outcomes.
The Essential Eight has sometimes been treated as a checklist.
Complete the eight controls.
Achieve a maturity level.
Move on to the next audit.
While achieving Essential Eight maturity is valuable, cyber resilience has never been solely about completing a checklist.
A business might achieve strong endpoint security while still having:
- Poor visibility across cloud environments.
- Weak API security.
- Internet-facing applications that haven’t been independently tested.
- Excessive privileged access.
- Limited third-party risk management.
- AI platforms operating without appropriate governance.
None of these issues are addressed simply by achieving an Essential Eight maturity level.
The broader Australian Cyber Essentials framework encourages organisations to think more holistically about cyber security by considering the technologies that support modern business operations.
That’s a healthier way to approach cyber resilience.
Security should be driven by business risk, not just framework alignment.
Common Misconceptions About the Transition
As with any significant change, a number of misconceptions have emerged since ASD announced the consultation.
“We should stop working towards Essential Eight.”
No.
If your organisation is implementing the Essential Eight today, continue doing so.
The controls remain highly effective against many common attack techniques and will continue to form an important foundation within Australian Cyber Essentials.
“Australian Cyber Essentials replaces the Essential Eight immediately.”
Again, no.
The transition is expected to occur over approximately two years. During this period, the Essential Eight remains current guidance while ASD develops and consults on the broader framework.
There is no requirement for organisations to abandon existing programmes or restart their security strategy.
“We’ll need an entirely new security programme.”
Not necessarily.
Most organisations won’t need to replace existing controls.
Instead, they’ll likely expand their security programmes to address additional areas such as cloud security, operational technology, identity management, application security and emerging technologies.
For organisations with mature cyber security programmes, this evolution should feel like a natural progression rather than a disruptive change.
Preparing for Australian Cyber Essentials
While the framework continues to evolve, organisations can begin preparing today by taking a broader view of their security posture.
Some practical areas to focus on include:
Review Your Current Security Baseline
Understand where your organisation currently sits.
If you’ve completed an Essential Eight maturity assessment, use it as a starting point rather than an endpoint.
Identify areas outside endpoint security that may require additional attention.
Strengthen Identity Security
Identity has become one of the most frequently targeted components of modern cyber attacks.
Review privileged accounts, conditional access policies, multi-factor authentication and identity governance processes to ensure they reflect current business requirements.
Assess Cloud Security
Cloud adoption has accelerated significantly since the Essential Eight was first introduced.
Review cloud configurations, storage permissions, identity integrations and monitoring capabilities to ensure cloud workloads are appropriately secured.
Understand Your Internet-Facing Attack Surface
Websites, APIs, customer portals and externally accessible applications should be regularly reviewed.
Application security testing and external attack surface assessments help identify exploitable weaknesses before attackers do.
Prepare for Continuous Improvement
Cyber security frameworks will continue evolving because technology continues evolving.
Rather than treating each framework update as a separate compliance exercise, organisations should build security programmes capable of adapting as new guidance emerges.
Continuous improvement has always been one of the strongest indicators of cyber maturity.
Frequently Asked Questions
Is the Essential Eight being discontinued?
No. The Essential Eight is not being withdrawn immediately. ASD has announced plans to transition towards a broader Australian Cyber Essentials framework over the coming years. During this period, the Essential Eight remains relevant guidance and organisations should continue implementing its recommended controls.
Should organisations continue investing in Essential Eight maturity?
Yes. Organisations already working towards Essential Eight maturity should continue those programmes. The controls remain effective and are expected to form part of the broader Australian Cyber Essentials framework rather than being discarded.
What is Australian Cyber Essentials?
Australian Cyber Essentials is ASD’s proposed evolution of the Essential Eight. Instead of focusing primarily on enterprise endpoints, it aims to provide practical cyber security guidance across a broader range of technology environments, including cloud services, operational technology, internet-facing infrastructure and small business environments.
Will Australian Cyber Essentials affect compliance requirements?
Over time, organisations may see customers, regulators and procurement processes begin referencing the new framework as it matures. However, the transition will occur progressively, and organisations with strong security fundamentals and existing Essential Eight programmes are likely to be well positioned for future requirements.
Conclusion
The Essential Eight has played a significant role in improving cyber security across Australia, providing organisations with a practical and effective baseline for reducing common cyber risks.
The move towards Australian Cyber Essentials doesn’t diminish that contribution. Instead, it reflects the reality that technology has evolved. Organisations now operate across cloud platforms, SaaS applications, internet-facing services, operational technology and AI-enabled environments that require broader security guidance than a single framework can provide.
For most organisations, the right approach is straightforward. Continue strengthening your Essential Eight maturity while expanding your focus to include identity, cloud, application security and emerging technologies. Organisations that view this transition as an opportunity to mature their overall security programme, rather than simply another compliance requirement, will be better positioned to respond to both evolving threats and future regulatory expectations.
How Intrix Can Help
At Intrix, we help Australian organisations move beyond compliance by building practical cyber security programmes aligned with business risk, operational requirements and evolving regulatory expectations.
Whether you’re beginning your Essential Eight journey or preparing for the transition towards Australian Cyber Essentials, our consultants can help assess your current maturity, identify gaps and develop a roadmap that reflects your technology environment rather than a generic checklist.
Our services include:
- Essential Eight Maturity Assessments
- Security Risk Assessments
- Penetration Testing
- Cloud Security Assessments
- Application Security Testing
- Governance, Risk and Compliance Advisory
- Virtual CISO (vCISO) Services
Cyber security frameworks will continue to evolve as technology changes. The organisations that benefit most won’t be those chasing compliance alone, but those building adaptable security programmes that can respond to new threats, new technologies and new expectations. At Intrix, we work alongside organisations to turn evolving guidance into practical, measurable improvements that strengthen resilience both today and into the future. Contact us now.
