ASD Aims to Phased Out Key Eight Cybersecurity Framework in the Next Two Years
We independently review everything we recommend. When you buy through our links, we may earn a commission which is paid directly to our Australia-based writers, editors, and support staff. Thank you for your support!
Brief Overview
- The Australian Signals Directorate (ASD) intends to phase out the Essential Eight cybersecurity framework within the next two years.
- A novel “Essentials” series will take its place, encompassing IT, cloud, operational technology, and agentic AI.
- This change is designed to overcome structural constraints and offer more adaptable, outcome-oriented guidance.
- Feedback on the initial chapter for enterprise IT is welcome until July 12, 2026.
Shift from Essential Eight to the Updated Essentials Series
The Australian Signals Directorate (ASD) has revealed its intention to phase out the Essential Eight guidance framework in the next two years. This transition is driven by the changing landscape of cybersecurity threats and the necessity for a more holistic approach that addresses contemporary technological scenarios.
The Rationale for Change
Chris Horlyck, who leads cybersecurity resilience at the Australian Cyber Security Centre (ACSC) within ASD, indicated that the Essential Eight was initially crafted for traditional IT environments and does not adequately extend to cloud-based and shared-responsibility models. As cloud usage has become commonplace, the framework’s deficiencies in these contexts required a move toward more versatile and outcome-focused guidelines.
Presenting the Essentials Series
The upcoming “Essentials” series will fill these voids by concentrating on specific security areas such as enterprise IT, operational technology, cloud, and potentially agentic artificial intelligence (AI). The innovative framework will offer organisations the agility to implement security strategies that correspond with their unique operational demands.
Emphasis on Contemporary Defensible Architecture
The new Essentials series is shaped by ASD’s Modern Defensible Architecture document, highlighting a layered defense method and the safeguarding of crucial assets over a simple perimeter-based strategy. This initiative is intended to help organisations sustain strong cybersecurity frameworks against evolving threats.
Tackling Previous Concerns
The transition to the Essentials series also aims to resolve ongoing issues regarding the maturity level demands of the Essential Eight, which have been regarded as variable. By separating threat-informed controls from a rigid maturity structure, the new framework seeks to offer more consistent and foreseeable guidance.
Next Steps and Stakeholder Engagement
ASD has initiated a consultation process for the Essentials series, beginning with the first chapter that concentrates on enterprise IT. Stakeholders are encouraged to share their perspectives via the ACSC Partner Portal by July 12, 2026, making sure that the new framework meets the diverse requirements of the cybersecurity sector.
Conclusion
The discontinuation of the Essential Eight framework signifies a major evolution in Australia’s cybersecurity strategy, introducing a more adaptive Essentials series. By addressing earlier limitations and emphasizing flexible security results, ASD aims to better prepare organisations to handle the complexities of modern cyber threats.
Reader questions
Frequently asked questions
Fast answers to the questions readers ask most about ASD Aims to Phased Out Key Eight Cybersecurity Framework in the Next Two Years.
What led to the shift from the Essential Eight to the Essentials series?
The transition was prompted by the necessity of addressing the structural shortcomings of the Essential Eight, specifically its limited applicability to cloud and shared-responsibility contexts.
What areas will the new Essentials series encompass?
The Essentials series will focus on distinct security areas such as enterprise IT, operational technology, cloud, and potentially agentic AI.
In what way will the new framework offer enhanced flexibility?
The Essentials series will prioritize outcomes and intent over rigid controls, enabling organisations to select tools that best suit their particular environments.
Will existing investments in Essential Eight compliance be disregarded?
No, the current investments in Essential Eight compliance will still hold relevance under the new Essentials framework.
What is the timeline for the phase-out of the Essential Eight?
The Essential Eight will stay in effect during a transition phase, with deprecation commencing in 12 months and complete cessation within 24 months.
How can organisations give their input on the new Essentials series?
Organisations can submit feedback on the initial chapter of the Essentials series through the ACSC Partner Portal by July 12, 2026.
