---
title: "ASD Essentials series: the Essential Eight replacement | CCP"
description: "ASD is replacing the Essential Eight with its Essentials series. What ASD has announced, what changes, and what Perth businesses should do in the meantime."
url: "https://ccp.com.au/essential-eight/essentials-series/"
datePublished: "2026-09-25"
dateModified: "2026-09-27"
author: "Computer Consultant Professionals"
---

# ASD Essentials series explained

## The Essential Eight is being replaced. Here’s what comes next.

The Australian Signals Directorate (ASD) is consulting on a new Essentials series. Its first chapter evolves today’s Essential Eight, with chapters for operational technology and cloud planned.

Updated September 2026

The short version

-   Keep your Essential Eight work going Both documents stay live during the transition, closely aligned.
-   A two-year plan, no fixed dates yet ASD plans to retire the Essential Eight but hasn’t set dates.
-   More flexibility in how you comply Outcomes to meet, rather than product settings to tick.

## Essential Eight retirement timeline

### From 2017 to the Essentials.

1.  2017

    #### Essential Eight published

    The strategies in February, the maturity model in June.

2.  Consultation

    #### Essentials for enterprise IT

    ASD consults its partners on the first chapter.

3.  Now

    #### Transition

    The Essential Eight and the Essentials are both live.

4.  Within two years

    #### Retirement planned

    The Essential Eight retires. No fixed dates yet.

## Essentials for enterprise IT, OT and cloud

### One framework, several chapters.

Grounded in ASD’s Information Security Manual (ISM), with prioritised mitigations for each environment.

![A laptop, an industrial controller on a DIN rail and a small network switch side by side on an office desk.](https://ccp.com.au/_astro/essentials-series-feature.D9ChSyEy_16n4oz.webp)

-   Chapter 1 · First

    #### Essentials for enterprise IT

    The evolution of today’s Essential Eight, now in consultation.

-   Planned

    #### Operational technology

    Industrial control systems and connected plant.

-   Planned

    #### Cloud

    Your shared responsibility with a cloud provider, and cloud-native controls.

-   Possible

    #### Agentic AI

    Identity and access for AI agents, and defences against prompt injection.

## What the Essentials change for your controls

### Evolution, not a restart.

-   #### What’s changing

    -   Outcomes in place of product-specific settings such as Office macros
    -   Separate chapters for enterprise IT, operational technology and cloud
    -   Practical tools and implementation guidance alongside the controls
-   #### What’s staying

    -   A prioritised baseline from ASD, grounded in the Information Security Manual (ISM)
    -   Strong alignment with existing Essential Eight controls and investment
    -   MFA, patching, admin privileges, application control, hardening and backups as fundamentals

> “The investment you’ve made under the Essential Eight will still be relevant under the Essentials.”

Chris Horlyck, Head of Cyber Security Resilience, ASD, speaking to iTnews

## What to do before the Essential Eight retires

### Keep going, and prepare for outcomes.

Today’s controls stay useful. These steps make the move straightforward.

1.  [01#### Keep building Essential Eight maturity

    Insurers and clients still ask for it, and the work carries across. ](https://ccp.com.au/essential-eight/#controls)
2.  02

    #### Record evidence by outcome

    Write down what each control achieves, not only which setting is on.

3.  03

    #### Map your cloud responsibilities

    For Microsoft 365 and each key SaaS platform: what they secure, what you do.

4.  04

    #### Identify your crown jewels

    The systems and data you can’t afford to lose.

## Essential Eight replacement FAQs

### Transition questions.

Details may change as ASD finalises the series.

### When will the Essential Eight be retired?

ASD has advertised a two-year plan to retire it in favour of the Essentials series, without fixed dates yet. Until then, it stays the current guidance, and both documents are live during the transition.

### Will our Essential Eight work be wasted?

No. ASD has said organisations already using the Essential Eight can expect strong alignment with their existing controls and investments.

### Should we wait for the new framework before starting?

No. The weaknesses attackers exploit haven’t changed, and ASD expects MFA, patching and tested backups to stay foundational. [Start with the eight controls](https://ccp.com.au/essential-eight/).

Sources

1.  [ASD, “Consultation on evolution of Essential Eight”, 15 June 2026](https://www.cyber.gov.au/about-us/view-all-content/news/consultation-on-evolution-of-essential-eight)
2.  [iTnews, “ASD to retire Essential Eight cyber security framework within next two years”, interview with Chris Horlyck, ASD, 24 June 2026](https://www.itnews.com.au/news/asd-to-retire-essential-eight-cyber-security-framework-within-next-two-years-626851)
3.  [ASD, Essential Eight explained (first published February 2017) and Essential Eight maturity model (June 2017)](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-explained)