ESSENTIAL EIGHT
TO ESSENTIALS:
WHAT DISP MEMBERS NEED TO KNOW
On 24 June 2026, the ACSC publicly set out a staged plan to retire the Essential Eight and replace it with the Essentials series. Nothing changes today — your DSPF obligation is still E8 ML2, and the work you've done carries forward.
WHAT ASD ANNOUNCED
The Essential Eight is not disappearing overnight — it is being absorbed into a broader, ISM-grounded series.
On 15 June 2026, the Australian Signals Directorate opened national consultation on evolving the Essential Eight into the Essentials series — guidance grounded in the Information Security Manual (ISM) and delivered as domain chapters rather than a single maturity model. Consultation ran through the ASD Cyber Security Partnership Program portal and closed on 12 July 2026.
On 24 June 2026, the ACSC's head of cyber security resilience set out the staged timeline publicly: deprecation roughly 12 months after the announcement and full retirement roughly 24 months after — indicatively mid-2027 and mid-2028. That timeline comes from a public interview, not an ASD publication, and no fixed retirement date has been published. The November 2023 Essential Eight Maturity Model remains the current release.
The first chapter will be "Essentials for enterprise IT" — the direct successor to the Essential Eight. ASD has confirmed future chapters for cloud and operational technology, and flagged agentic AI as a likely chapter: the September 2026 ISM added AI-agent controls ISM-2124 to ISM-2167, and ASD published agentic AI harness guidance on 11 September 2026.
Critically, ASD has said existing Essential Eight controls and investments are expected to align strongly with the new guidance. Patching, multi-factor authentication, application control, privileged access, and backups all carry forward. The uplift work DISP members have done since September 2024 is the foundation, not sunk cost.
CONFIRMED VS NOT CONFIRMED
Most of what you'll hear about this transition is speculation. This is the line between what ASD has actually said and what is still unknown.
Confirmed
15 June 2026 — ASD opened national consultation on evolving the Essential Eight into the 'Essentials series', grounded in the Information Security Manual (ISM), via the ASD Cyber Security Partnership Program portal.
24 June 2026 — the ACSC's head of cyber security resilience set out the staged timeline publicly: deprecation roughly 12 months after announcement, full retirement roughly 24 months (indicatively mid-2027 / mid-2028). From a public interview, not an ASD publication.
12 July 2026 — consultation closed.
The series is delivered as domain chapters, starting with 'Essentials for enterprise IT' — the direct Essential Eight successor. Cloud and operational technology chapters are confirmed; agentic AI is flagged as a likely chapter.
ASD has said existing Essential Eight controls and investments are expected to align strongly with the new guidance — patching, MFA, application control, privileged access, and backups carry forward.
The November 2023 Essential Eight Maturity Model remains the current release. No fixed retirement date has been published.
For DISP members, the DSPF requirement today remains Essential Eight ML2 (in force since 30 September 2024). Defence has announced no change.
Not yet confirmed
The final control set for the Essentials series.
Whether maturity levels ML0–ML3 carry over into the new guidance.
Assessment and evidence mechanics under the Essentials series.
Publication dates for any chapter, including 'Essentials for enterprise IT'.
How PSPF, DISP, and contracts will re-reference the Essential Eight.
Anyone claiming to know the final control set, the maturity model, or a fixed retirement date is guessing. Plan against what is confirmed.
THE INDICATIVE TIMELINE
Every forward date below is indicative. The staged timeline comes from a public interview on 24 June 2026 — ASD has published no fixed retirement date.
ASD opens national consultation on the Essentials series via the Cyber Security Partnership Program portal.
ACSC's head of cyber security resilience sets out the staged timeline in a public interview — not an ASD publication.
Consultation closes. ASD begins working feedback into the new guidance.
Indicative parallel-running period: the November 2023 Maturity Model remains current while Essentials chapters are prepared.
Indicative deprecation of the Essential Eight — roughly 12 months after the announcement, per the public interview.
Indicative full retirement — roughly 24 months after the announcement. No fixed retirement date has been published.
THE CHAPTERS
The Essentials series is delivered as domain chapters grounded in the ISM — not a single replacement maturity model.
Essentials for enterprise IT
The direct Essential Eight successor. Covers the corporate ICT environment today's E8 applies to — the systems DISP members run ML2 across.
Essentials for cloud
A dedicated chapter for cloud environments. Confirmed as forthcoming; scope and publication date not yet announced.
Essentials for operational technology
A dedicated chapter for OT environments. Confirmed as forthcoming; scope and publication date not yet announced.
Essentials for agentic AI
Flagged as a likely chapter. The September 2026 ISM added AI-agent controls ISM-2124 to ISM-2167, and ASD published agentic AI harness guidance on 11 September 2026.
WHAT THIS MEANS FOR DISP MEMBERS
Defence changes its requirements through the DSPF, with notice — not automatically when ASD updates its guidance.
ML2 stands
The DSPF has required Essential Eight ML2 for every DISP member since 30 September 2024. Defence has announced no change. Until the DSPF is updated, your obligations stand as written.
Change comes via the DSPF
Defence updates its requirements through the Defence Security Principles Framework, with notice to members. ASD retiring the Essential Eight does not, by itself, change what DISP asks of you.
Your ASR cycle continues
Every Annual Security Report must continue to reflect full E8 ML2 compliance across all eight strategies. Plan your next ASR exactly as you would have before the announcement.
Current evidence remains evidence
Configuration baselines, patch records, MFA logs, backup test results, privileged access reviews — ASD says these controls carry forward, so the evidence behind them does too.
SERIOUS DEFENCE IS READY — AND SO IS DISPulse
The transition should be a configuration exercise, not a rebuild.
DISPulse: mapped today, remapped on release
DISPulse maps your controls to Essential Eight ML2 today. When the final Essentials guidance lands, we will map to the new series — so for DISPulse customers, the transition is a configuration exercise, not a rebuild. Your control data, evidence, and maturity history move with you.
See DISPulse →DISPath: aligned to the current DSPF
DISPath keeps your DISP application and ongoing compliance aligned to the DSPF requirements in force today — and tracks Defence's updates as the DSPF evolves to reference the Essentials series. You comply with what is written, and you're ready for what comes next.
See DISPath →WHAT TO DO NOW
Five concrete steps that hold value regardless of how the final guidance lands.
Keep building ML2
The DSPF requirement is unchanged. Every control you implement now — patching, MFA, application control, privileged access, backups — is a control ASD says carries forward.
Document your current maturity as a dated baseline
Record your assessed maturity per control, with evidence, as at a specific date. Whatever structure the Essentials series takes, a dated baseline is your starting point for mapping across.
List everything that references the Essential Eight
Contracts, policies, tender responses, customer questionnaires, and your DISP documentation. When re-referencing begins, this register tells you exactly what needs updating.
Strengthen cloud and identity controls
Cloud is a confirmed future chapter and identity sits at the centre of where the new series aims. MFA, privileged access management, and cloud configuration hygiene are safe investments.
Assign someone to watch the transition
Essentials chapters, DSPF updates, and Defence guidance will land over the next 24 months. Nominate an owner — or let us watch it for you. We can watch it for you.
E8 TO ESSENTIALS TRANSITION — FAQs
5 key questions about the Essential Eight retirement and what DISP members should do.
Is the Essential Eight being replaced?
Yes. On 15 June 2026, the Australian Signals Directorate (ASD) opened national consultation on evolving the Essential Eight into the 'Essentials series' — a new set of guidance grounded in the Information Security Manual (ISM) and delivered as domain chapters, starting with 'Essentials for enterprise IT' as the direct Essential Eight successor. On 24 June 2026, the ACSC's head of cyber security resilience set out a staged timeline publicly: deprecation roughly 12 months after announcement and full retirement roughly 24 months after announcement — indicatively mid-2027 and mid-2028. That timeline comes from a public interview, not an ASD publication, and no fixed retirement date has been published. Consultation closed on 12 July 2026. Until the Essentials series is finalised, the November 2023 Essential Eight Maturity Model remains the current release.
Should we stop our Essential Eight uplift work?
No. Stopping now would leave you non-compliant with a requirement that is still in force: the DSPF has required Essential Eight ML2 for all DISP members since 30 September 2024, and Defence has announced no change. ASD has also said existing Essential Eight controls and investments are expected to align strongly with the new guidance — patching, multi-factor authentication, application control, privileged access, and backups all carry forward. Work you do today is the foundation the Essentials series builds on, not wasted effort.
What happens to our Essential Eight ML2 rating?
That is not yet confirmed. ASD has not said whether the maturity levels ML0–ML3 carry over into the Essentials series, nor how assessment and evidence mechanics will work under the new guidance. What is certain is that your current ML2 posture — and the evidence behind it — remains your compliance baseline until Defence updates the DSPF. Documenting your maturity now, as a dated baseline, puts you in the strongest position whatever the final structure looks like.
When does the Essentials series publish?
No publication dates have been confirmed. Consultation closed on 12 July 2026, and the only public timing guidance is the staged timeline given in a 24 June 2026 interview: deprecation of the Essential Eight roughly 12 months after the announcement (indicatively mid-2027) and full retirement roughly 24 months after (indicatively mid-2028), with a parallel-running period in between. All of these dates are indicative — ASD has published no fixed retirement date.
Does this change DISP requirements?
Not today. The DSPF requirement remains Essential Eight Maturity Level 2, as it has since 30 September 2024, and Defence has announced no change. Defence changes its requirements through the Defence Security Principles Framework (DSPF) with notice to members — not automatically when ASD updates its guidance. Until the DSPF is updated, your existing obligations stand as written, and every Annual Security Report must continue to reflect full E8 ML2 compliance across all eight strategies. How PSPF, DISP, and contracts will re-reference the Essential Eight is one of the questions the transition still has to answer.
COMPLIANT TODAY.
READY FOR
WHAT'S NEXT.
We'll assess your current E8 ML2 posture, document it as a dated baseline, and keep you ahead of the Essentials transition as final guidance lands — so the switch is a configuration exercise, not a rebuild.