The Essential Eight Is Changing: What Your Business Should Do Now
On 15 June 2026, the Australian Signals Directorate opened consultation on the evolution of the Essential Eight. The proposed change would introduce a broader Essentials series, beginning with Essentials for enterprise IT. Nothing is retiring yet. But the direction is set, and it changes what businesses should be doing right now.
What ASD Actually Announced
The proposed replacement is a new Essentials series, grounded in the same Information Security Manual, designed to give organisations more flexibility in how they meet strong cyber security outcomes.
The Transition Timeline
The first chapter is Essentials for enterprise IT. Operational technology and cloud chapters are expected to follow. ASD has said both the Essential Eight and the new Essentials guidance will stay live during the transition. Industry reporting on the consultation has cited ASD comments pointing to deprecation of the Essential Eight around 12 months from now, with full retirement around 24 months after that. Those figures come from ASD commentary reported by iTnews, not from a published retirement date. Treat these as indicative timeframes reported from ASD commentary, not as a confirmed retirement schedule.
Why the Change Is Happening
None of this is dramatic. ASD commentary reported by iTnews indicates the Essential Eight was designed in an earlier, more on-premises-oriented technology environment. The proposed Essentials series is intended to provide guidance that better reflects cloud, SaaS, hybrid, and other contemporary environments.
Why Many Businesses Moved to SMB1001 Instead
Here is the part most coverage of this story skips. Not every business has fully implemented the Essential Eight, particularly where the organisation lacks dedicated security resources or faces competing operational priorities.
Where the Essential Eight Fell Short
Maturity Level 2 asked a lot of organisations that did not have a dedicated security function. ASD acknowledged that changing requirements could create the impression that organisations were going backwards, even when their underlying security posture had not deteriorated. Some smaller organisations have found the maturity model difficult to implement proportionately.
How SMB1001 Filled the Gap
SMB1001 filled that gap. It uses five progressive levels, Bronze, Silver, Gold, Platinum, and Diamond, so a business can select a level that reflects its current context and risk posture. The appropriate level depends on the information the supplier handles, the access it holds, and how critical its services are. These three factors map to confidentiality, integrity, and availability in DSI’s Supplier Categorisation Matrix. Certification is issued by an authorised Dynamic Standard Certifier, currently CyberCert, rather than by DSI directly, so businesses should confirm current assessment and verification requirements for the level they are considering.
Essential Eight vs. SMB1001. What Is the Difference?
These are not two versions of the same thing, and this is not a case of choosing the winner.
What the Essential Eight Covers
What SMB1001 Covers
Choosing the Right Starting Point
A business at the smaller end of the market is not choosing between the two as competitors. For many, SMB1001 is the more achievable near-term step. Alignment with the Essential Eight, and later the published Essentials guidance, may become a direction they grow into if their size, sector, or client base demands it.
The proposed Essentials series appears to be moving toward more flexible, threat-informed guidance and away from relying solely on fixed maturity levels. That is a reason to keep watching this space, not a reason to wait before doing anything.
What Happens to Your Existing Work?
Nothing you have already implemented becomes wasted effort.
ASD has confirmed the Essentials series evolves from the Essential Eight and stays grounded in the same ISM. Patching, multi-factor authentication, backups, and application control remain valuable security practices and are expected to stay relevant, not a legacy approach being phased out.
What is not yet confirmed is exactly how the current maturity model maps onto the new structure. ASD has not published the final control mapping. That detail sits inside the guidance still to come. Anyone telling you the final mapping right now is guessing.
What Should Your Business Do Right Now?
Do not wait for final guidance to arrive before doing anything. There is genuinely useful action available today, regardless of where you currently sit.
- Keep going with whatever security improvement work is already under way. Pausing to wait for the Essentials series to finalise achieves nothing and costs you months.
- If you have never attempted the Essential Eight, SMB1001 Bronze or Silver is a practical starting point. The right level depends on your customers, sector, data, and service criticality.
- If you are sitting at Maturity Level 2, keep an eye on the consultation outcome and plan to reassess your posture once the published guidance lands.
- If your governance framework has not been reviewed in the past year, this transition is a sensible trigger to do it.
Where an Independent Assessment Fits
Assessing Where You Stand
That is where an Essential Eight assessment still has value. Not as a compliance exercise, but as a clear picture of your gaps against the framework that matters to your business, government contract, or insurer. ASD publishes its own assessment guidance for organisations assessing themselves against the framework. For organisations managing broader risk and governance obligations alongside it, an ICT governance review puts the policy and documentation side on the same footing. An ICT risk management engagement addresses exposure beyond the eight controls the framework covers.
Getting Ongoing Support Through the Transition
If you are not sure where to start, an IT health check is typically the entry point. It gives leadership a whole-of-business baseline before committing to any specific framework, and often surfaces the governance gaps this transition is a good moment to close. For organisations wanting ongoing strategic oversight through the transition rather than a single point-in-time review, that is the role a vCIO engagement plays.
For organisations that need ongoing visibility across their risk and compliance posture, AgendisRISK, built by our Agendis team, provides a single platform for tracking controls, evidence, and obligations. It runs inside your existing Microsoft 365 environment.
Frequently asked questions
Simon Cohen
Written by Simon Cohen, Founder, Cohesis. Simon has over two decades of experience working with Australian SMEs and local government organisations on technology strategy, governance, and implementation.
Strategic IT leadership without the full-time cost. Find out if it is the right fit.
We will learn about your current technology environment, show you what the first 90 days looks like in practice, and give you a clear picture of whether a vCIO engagement is the right fit.
