The End of Essential Eight? What Australian Signals Directorate’s New Essentials Series Means for Australian Businesses

For many Australian organisations, the Essential Eight has become one of the most recognised cybersecurity frameworks. It has helped businesses understand the baseline controls needed to reduce risk and strengthen resilience.

Now, the framework is entering a new phase.

The Australian Signals Directorate (ASD) has announced consultation on the evolution of the Essential Eight, introducing a broader Essentials series designed to better reflect modern technology environments. The proposed change aims to give organisations greater flexibility in how they implement cybersecurity, while still providing a clear path towards stronger cyber resilience.

For business leaders, this is an important moment.

It does not mean cybersecurity efforts should pause. It does not mean existing Essential Eight work has been wasted. And it certainly does not mean organisations can afford to wait until the new framework is fully established. According to ASD’s confirmation, the framework will be deprecated in roughly 12 months and fully retired within 24 months. However, existing compliance efforts (Maturity Levels 1-3) remain valid and form the foundation of the new system.

Instead, it is a timely reminder that cyber resilience is not a one-off compliance activity. It is an ongoing business discipline that needs to evolve as technology, threats and operating environments change.

Why Is the Essential Eight Changing?

The Essential Eight was originally designed to provide organisations with a practical set of baseline mitigation strategies. These controls have helped many businesses focus on key areas such as patching, multi-factor authentication, application control, restricting administrative privileges and regular backups.

However, the way organisations use technology has changed significantly.

Today’s businesses rely heavily on cloud platforms, SaaS applications, remote access, mobile devices, outsourced technology providers and increasingly, AI-enabled tools. Many organisations no longer operate within a clearly defined corporate network. Their people, devices, data and applications are spread across multiple environments.

This creates a different risk profile.

Cybersecurity guidance must now account for more than traditional on-premises IT environments. It needs to support cloud adoption, operational technology, modern identity models and emerging cyber risks. That is why ASD’s proposed Essentials series is designed to provide more flexible, threat-informed guidance for contemporary technology environments.

What Are the New Essentials Series?

The Essentials series is expected to expand the current Essential Eight framework into a broader set of guidance areas.

The first chapter will focus on Essentials for enterprise IT, with additional chapters expected to follow. This shift is designed to help organisations apply cybersecurity guidance in a way that better matches their actual technology environment.

Rather than treating cybersecurity as a static checklist, the new approach is expected to place greater emphasis on outcomes, intent and practical risk reduction.

That matters because different businesses have different environments. A professional services firm using Microsoft 365, cloud-based finance software and remote staff will not face the exact same challenges as a manufacturing business with operational technology systems. A broader framework allows guidance to better reflect these differences.

Does This Mean Essential Eight No Longer Matters?

No.

For now, the Essential Eight remains an important and widely recognised cybersecurity baseline. Organisations that have already invested in Essential Eight alignment should continue to build on that work.

The key message is not to STOP. The key message is to REVIEW.

Existing controls such as MFA, patching, backups, application hardening and privileged access management are still fundamental to reducing cyber risk. These are not becoming irrelevant simply because the framework is evolving.

In fact, the opposite is true.

Businesses that already understand their Essential Eight maturity will be in a stronger position to transition towards future guidance. They will have better visibility of their current controls, clearer evidence of what has been implemented, and a stronger foundation for ongoing improvement.

What should Australian businesses do now?

The most important step is to understand where your organisation currently stands.

Many businesses assume they are more secure than they actually are. They may have Microsoft 365 in place, but not all security settings are properly configured. They may have backups, but not regularly tested recovery processes. They may use MFA, but not consistently across all users, devices and privileged accounts.

The evolution of Essential Eight is a useful opportunity to ask practical questions:

• Do we know our current cybersecurity maturity?
• Are our core controls properly implemented and monitored?
• Are we relying on default settings across cloud platforms?
• Do we have visibility across users, devices, applications and data?
• Can we demonstrate our cyber readiness to customers, insurers or regulators?
• Do we have a roadmap for continuous improvement?

Cybersecurity is no longer just an IT issue. It is a business risk, a governance concern and increasingly, a competitive differentiator.

Customers, boards, insurers and partners are placing greater expectations on organisations to show that appropriate controls are in place. Being able to demonstrate a structured approach to cyber security can help build trust and support stronger business relationships.

Why This Matters for SMBs

Small and medium-sized businesses are often under significant pressure when it comes to cybersecurity. They face many of the same threats as larger organisations, but usually with fewer internal resources, smaller IT teams and tighter budgets.

This is exactly why practical frameworks matter.

The Essential Eight has helped make cybersecurity easier to understand by giving businesses a clear place to start. As the framework evolves, SMBs should avoid seeing this as added complexity. Instead, they should see it as an opportunity to modernise their cybersecurity approach and make sure their controls still match the way they operate today.

The goal is not to chase compliance for the sake of compliance.

The goal is to reduce risk, protect business operations, maintain customer trust and improve resilience when incidents occur.

Prepare for What Comes Next

The introduction of ASD’s new Essentials series marks a significant shift in Australia’s cybersecurity guidance. For business leaders, the message is clear: cyber resilience must keep pace with the way modern organisations operate.

The best approach is not to wait for the framework to change around you.

Start by understanding your current position. Review your existing controls. Identify your gaps. Build a roadmap. And make sure your cybersecurity strategy is ready for what comes next.

Speak with Fuse Technology about reviewing your cyber readiness and strengthening your organisation’s security posture.

At Fuse Technology, we help Australian businesses understand their current cybersecurity posture and build a practical roadmap for improvement.

Our approach is designed to make cybersecurity easier to understand and easier to manage. We work with businesses to assess their environment, identify gaps, prioritise actions and implement security controls that support real-world resilience.

Whether your organisation is already working towards Essential Eight alignment or simply wants to understand where it currently stands, this is the right time to review your cyber readiness.

The Essential Eight may be evolving, but the need for strong cybersecurity foundations has not changed.

If anything, it has become more important.