55 Park Road, 
Article summary: ASD has released its Essentials series to replace the Essential Eight, but it hasn’t announced a timeline and the core controls aren’t going anywhere. Insurers and clients ask about MFA, backups, patching and admin rights, not framework names. Keep working on those now.
Has a client, insurer or broker asked you about the Essential Eight lately?
If so, you may also have heard it’s being replaced. That’s true, but it doesn’t mean you can stop, start again or wait and see.
Here’s what’s actually confirmed, what isn’t, and what Australian businesses will still be asked for.
What’s actually happening
In June 2026, the Australian Signals Directorate (ASD) opened consultation on its Essentials series. On 15 October 2026 it released the series: a framework with chapters for enterprise IT, cloud and operational technology, built on principles, actions and domains. ASD’s FAQ on the series is explicit that it is replacing the Essential Eight. ASD Essentials
| Status | What we know |
|---|---|
| Confirmed by ASD | ASD released the Essentials series on 15 October 2026, with chapters for enterprise IT, cloud and operational technology. Its FAQ says ASD is replacing the Essential Eight, that work already completed under the Essential Eight remains relevant, and that every Essential Eight strategy maps to at least one Essentials principle. Consultation closed on 12 July 2026. |
| Reported, not in an ASD document | Deprecation in about 12 months and retirement in about 24, from an ASD official in a June interview. That points to roughly mid-2027 and mid-2028. |
| Expected | More chapters over time, plus a strategy document on future work, which ASD says it will publish. |
| Not yet announced | The transition timeline. ASD says it has been talking to regulators and will advise on expectations in due course. |
In other words, the Essential Eight is being replaced, but not overnight and not by throwing away what you’ve done. ASD says work already completed under it remains relevant. Note that the Essentials series is written mainly for government, critical infrastructure and large organisations. Smaller businesses can use it where relevant, and ASD keeps separate small business guidance.
Insurers ask about controls, not frameworks
When you renew your cyber insurance, the proposal form won’t ask “are you Essentials compliant?” It asks practical questions. Commonly they cover: upcover
- multi-factor authentication on email, remote access, admin accounts, cloud apps and backups
- backups that are automated, stored separately and tested by restoring
- how quickly you patch operating systems and applications
- endpoint detection and response on every device
- email security such as SPF, DKIM and DMARC
- admin rights limited to the people who need them
- a written incident response plan
- staff training on phishing and email scams
Six of the Essential Eight strategies line up directly with those questions. Work you do on the Essential Eight now should carry over, because ASD says Essential Eight work remains relevant and supports alignment with the Essentials, and it counts at your next renewal. If you haven’t started, our plain-English guide to the Essential Eight is the place to begin.
Clients are asking too
Larger clients, government agencies and regulated industries increasingly send suppliers a security questionnaire before signing or renewing a contract.
These ask the same kinds of questions as insurers. The businesses that answer quickly and confidently tend to be the ones that keep the evidence in one place: policies, insurance certificate, MFA and backup reports, and the date of the last restore test.
If your turnover is over $3 million, you also have ransomware payment reporting obligations to know about.
One control many small businesses skip: admin rights
In many small offices, everyone is a local administrator on their own computer. It’s convenient. It’s also one of the easiest ways for malware to take full control of a machine.
Most staff don’t need admin rights for everyday work. Email, Microsoft 365, browsing, printing and business apps all work fine on a standard account.
When someone does need software installed, there are better options:
- your IT provider installs approved software
- software is deployed centrally to everyone who needs it
- temporary admin access is granted for a specific task
- IT staff use a separate admin account only when needed
Restricting admin rights is part of the Essential Eight now and it’s on insurers’ forms now. It’s a sound control whatever the framework is called.
What to do now
- Keep working to Essential Eight Maturity Level One as your baseline, and write down where you stand: your maturity, existing controls and key business functions. ASD calls this a transition baseline, and says not to slow or stop current uplift programs.
- Turn on MFA everywhere, including your backup system.
- Test a restore, and write down the date.
- Remove everyday admin rights from staff computers.
- Write a one-page incident plan with your insurer, broker and IT contacts.
- Keep a folder of evidence for insurers and client questionnaires.
- Check your AI tools are approved and covered by an AI policy. ASD has also published a document on AI considerations within the Essentials, so expect AI to get more attention.
We’ll update this post as ASD publishes more Essentials guidance. For ASD’s own advice written for smaller businesses, see its Small Business Hub.
Frequently asked questions
Is the Essential Eight being scrapped?
Eventually, yes. ASD says it is replacing the Essential Eight with the Essentials series, but it hasn’t announced a timeline, and work already done under the Essential Eight remains relevant.
Do we need to start again?
No. ASD says work done under the Essential Eight remains relevant, and that in most cases Essential Eight controls will directly satisfy or substantially contribute to an Essentials action. Your maturity rating won’t convert automatically into the new effectiveness ratings, though. MFA, patching, backups and restricted admin rights remain at the core.
When does the transition happen?
ASD hasn’t announced a timeline and says it will advise on expectations in due course. Media reports say an ASD official has indicated the Essential Eight will be deprecated in about 12 months and retired in about 24, which points to around mid-2027 and mid-2028.
Does meeting the Essential Eight guarantee cyber insurance?
No. Insurers set their own requirements. But the controls they ask about overlap heavily with the Essential Eight, so it puts you in a much stronger position.
Is the Essential Eight mandatory for small businesses?
Not for private businesses. It’s mandatory for many government agencies. For everyone else, insurers and clients are what make it matter.
Is the Essentials series written for small businesses?
ASD says it is written mainly for Commonwealth entities, critical infrastructure owners and operators, and large organisations. Small and medium businesses can still use it where relevant, and ASD publishes separate guidance for small businesses.
Straight answers on where you stand
Cyber security frameworks change. What matters is whether your business is protected, and whether you can show it.
At Sydney Technology Solutions, we’ll tell you plainly where you stand, what to fix first and what can wait. No jargon, no scare tactics. Book a chat with our team or read more about our cyber security services.
Adam Rippon, Founder, Sydney Technology Solutions
Adam’s love of tech started the Christmas Santa delivered a Commodore 64 down the chimney. He started working in IT in 1996 and founded Sydney Technology Solutions in 1999. More than 25 years on, he still gets a kick out of finding better ways for technology to help businesses grow.
Sources
- ASD: Essentials frequently asked questions (15 October 2026)
- ASD: Transitioning from the Essential Eight (15 October 2026)
- ASD: Consultation on evolution of Essential Eight (15 June 2026)
- Australian Cyber Security Magazine: ASD to retire Essential Eight within two years
- upcover: Cyber insurance requirements in Australia
