On 15 October 2026 the Australian Signals Directorate (ASD) released the Essentials series, which it calls an evolution of the Essential Eight. If your business, your insurer or a client contract refers to the Essential Eight, this is the change to know about. This is a plain-English summary written two days after release, so check cyber.gov.au and your adviser for anything your obligations depend on.
The short version
- The Essential Eight has not been switched off. ASD says it will maintain both the Essential Eight and the Essentials on cyber.gov.au during the transition.
- No mandatory date to move across has been published. ASD says it will advise on transition expectations in due course, and that organisations should keep meeting their current regulatory obligations until regulators say otherwise.
- ASD's advice is to keep going with your current security uplift while you check how it lines up with the new framework.
What the Essentials are
The Essential Eight was a list of eight mitigation strategies, each with three maturity levels. The Essentials are organised differently, around three ideas:
- Principles: the security outcomes an organisation should achieve.
- Actions: what needs to be done to achieve them.
- Domains: the parts of the business the actions apply to, such as identity, user devices, business systems and governance.
The series is split into chapters for different kinds of environments. There is a chapter for enterprise I.T., one for cloud, and one for operational technology. An organisation uses the chapters that fit how it actually runs, and ASD says there is no requirement to use every chapter.
What changed for a small business
No more picking a maturity level
Under the Essential Eight, businesses chose a target such as Maturity Level One or Two. Under the Essentials, actions are assessed on how effective they are in each part of the business, and actions are grouped into priority phases that set an order of work. An existing Essential Eight maturity rating does not automatically carry over as a result under the new framework.
More than technical controls
The Essentials go wider than the original eight strategies. Governance and culture, and visibility and response, sit alongside the technical areas. In practice that means questions like who is accountable for cyber security, whether staff are trained, how suppliers are checked, and whether you would notice and respond to an attack.
Phishing-resistant MFA
Multi-factor authentication stays central, with an emphasis on phishing-resistant methods such as passkeys and security keys. Codes sent by SMS are the weakest option, and our guide to which kind of MFA to use covers the choices.
A chapter for cloud-only businesses
Many small businesses run almost entirely on Microsoft 365 or Google Workspace. The cloud chapter marks which actions are the customer's job, which are provider features the customer has to switch on, and which are the provider's own job. That split is useful, because a lot of Microsoft 365 security only works once someone turns it on and configures it.
Outsourcing doesn't move accountability
ASD's guidance makes the point that outsourcing a service does not transfer accountability for the security outcomes it is meant to achieve. If an I.T. provider looks after your systems, you still need evidence that the controls are in place and working. Ask your provider for it in writing.
Who the Essentials are written for
ASD says the series is written primarily for Commonwealth entities, critical infrastructure and large organisations, and that smaller businesses can use the guidance where it is relevant. For most small businesses the practical effect will come through others: government contracts, larger clients' supplier questionnaires, cyber insurers and industry regulators updating what they ask for over time.
What to do now
- Don't stop. MFA, patching, backups you have tested and limited admin rights matter under both frameworks.
- Don't start a project only to hit an old Essential Eight target unless a contract, insurer or regulator still requires it. Check what yours actually ask for.
- Work out which chapter fits. If your business runs on Microsoft 365 with few or no servers, start with the cloud chapter.
- Fix identity first. Move staff to phishing-resistant MFA, remove standing admin rights and review who has access to what.
- Write down who is accountable. Name the person responsible for cyber security, even in a five-person business, and record your decisions.
- Ask your I.T. provider for evidence, not a promise: reports that show the controls are working.
We are reviewing our plans and reports against the new framework and will update our clients as ASD and regulators publish transition dates. Until then, the free Cyber Risk Scorecard is still a quick way to find your biggest gaps, because the basics it checks matter under both.