ASD has announced it will retire the Essential Eight within the next two years and replace it with a new framework, the Essentials. The first chapter, “Essentials for Enterprise IT”, is open for consultation until 12 July. Deprecation is planned to start in about 12 months, with both frameworks running side by side during the transition, and later chapters are planned for cloud, operational technology and possibly agentic AI.
The shift is from prescriptive controls to outcomes. The ACSC’s Chris Horlyck put it this way: “The investment you’ve made under the Essential Eight will still be relevant under the Essentials.”
That’s the right reading for small businesses. MFA, patching, application control, backups and restricted admin privileges don’t stop mattering because the framework gets a new name. Keep working your maturity plan, and when the final Essentials chapters land, map what you’ve done across rather than starting again. Insurers and clients who ask for Essential Eight evidence today are likely to ask for Essentials evidence next.