The Australian Signals Directorate (ASD) is developing a new Essentials series to expand its cyber security guidance beyond the Essential Eight. For organisations that use Essential Eight maturity to set investment priorities, assess suppliers and report to the board, the transition has implications well beyond a change in terminology.
Security leaders need to prepare for the new guidance while continuing to address current exposure. Existing controls and assessment evidence provide the starting point, but the transition also creates an opportunity to check whether that evidence reflects the systems and services the business relies on.
What is changing?
ASD’s published consultation describes an Essentials series grounded in the Information Security Manual (ISM), with prioritised, threat-informed mitigations for contemporary technology environments. The proposed approach gives organisations greater flexibility in implementation while retaining strong alignment with existing Essential Eight controls and investment.
- Enterprise IT comes first: Essentials for enterprise IT is the first chapter, evolving the existing Essential Eight guidance. The consultation period ended on 12 July 2026.
- A staged transition is planned: In a June interview with iTnews, ASD’s Chris Horlyck anticipated keeping both documents active, beginning Essential Eight deprecation after around 12 months and retiring it after around 24 months.
- Broader coverage follows: In the same interview, Horlyck identified operational technology and cloud as the next chapters.
The reported timetable is indicative. Organisations should use ASD’s published releases and the requirements that apply to them to determine when changes are needed.
Why does this matter?
The Essential Eight has given organisations a common language for cyber security uplift. A maturity level helps communicate progress, but it also depends on the version assessed, the systems included and the evidence supporting the result.
Those details become critical when guidance changes. Replacing a framework reference in a dashboard does not establish that controls cover a broader environment or achieve the new requirements. Existing assessments need to be mapped and reviewed before they support a claim against the Essentials series.
There is also unfinished work under the current model. ASD’s Commonwealth Cyber Security Posture in 2025 report found that 22 per cent of surveyed government entities achieved overall Maturity Level 2 or higher, compared with 15 per cent in 2024. These figures describe government entities, rather than Australian organisations generally.
For CISOs, the investment decision remains tied to exposure. Work that reduces compromised-account risk, addresses vulnerable systems or improves recovery should continue while the new guidance develops.
How does this impact your organisation?
The transition can affect security planning, executive reporting and the commitments an organisation makes to customers and suppliers. Three areas deserve particular attention:
- Assessment scope: A maturity result for an assessed IT environment does not establish equivalent protection across cloud services or operational technology. Identify which business services sit outside current assessments and who owns the associated risk.
- Reporting continuity: A change in guidance, scope or assessment method can change a reported result without a corresponding change in security. Boards need to understand whether movement reflects stronger controls, wider coverage or a different benchmark.
- External commitments: Procurement criteria, customer contracts and insurance questionnaires may refer to a particular Essential Eight maturity level. Record those references and confirm how each requirement will be handled through the transition.
Preparation should therefore involve technology owners, procurement and risk teams alongside security. The objective is to maintain a reliable view of exposure while assessment and reporting requirements evolve.
What can organisations do?
Organisations can make useful progress before every chapter is available. The following actions can help organisations assess their exposure and prioritise improvements as the new guidance develops:
1. Continue Essential Eight uplift against current risks
Keep funded remediation moving where it addresses known exposure. Prioritise gaps in identity, privileged access, patching and recovery according to the systems and business services at risk. Document exceptions, compensating controls and treatment owners so unresolved issues remain visible throughout the transition.
2. Establish a control baseline that can be carried forward
Record the framework version, assessed systems, control owners and evidence behind the current position. Validate key controls through restoration tests, privileged access reviews and configuration checks. Separate evidence of deployment from evidence that the control works across its stated scope. This gives the team a basis for mapping existing capability to the final Essentials guidance.
3. Map cloud and operational technology responsibilities
Identify critical services, their dependencies and the division of responsibility between internal teams and providers. Confirm who manages identity, patching, logging and recovery for each service. In operational technology environments, involve engineering and operations teams so planned changes account for safety, availability and maintenance constraints.
4. Prepare governance and reporting for the transition
Assign an owner to track ASD releases, assess changes and coordinate updates to policies, assessment plans and external commitments. Keep current maturity reporting alongside measures of coverage, exceptions and control effectiveness. Once final guidance is available, map the differences and prioritise the additional work rather than assuming existing results transfer unchanged.
The value of this preparation is a clearer connection between security investment and business risk. Organisations that understand their control coverage and can demonstrate effectiveness will have a stronger basis for navigating the transition.
How Meridian Cyber can help
At Meridian Cyber, we help organisations align security governance, risk management and assurance with their business requirements. Our work supports a clear understanding of current capability, the controls that need attention and the evidence required to demonstrate progress. Our services include:
- ASD Essential Eight to assess current maturity, identify gaps and prioritise improvements towards your target maturity.
- Information Security Manual (ISM) to assess alignment with applicable ISM requirements and identify security controls requiring improvement.
- Information Security Management System (ISMS) to develop and maintain the governance, policies, processes and controls needed to manage information security risk and support continual improvement.
Security guidance will continue to evolve as technology and threats change. Meridian Cyber helps organisations maintain a consistent approach to governance and assurance, supporting informed decisions throughout the security lifecycle.