Essential Eight Retiring — What Essentials Means for DISP

What ASD Actually Announced

On 24 June 2026, the Australian Signals Directorate confirmed what the industry had been circling for months: the Essential Eight will be systematically retired over approximately the next two years. In its place comes the Essentials series — a broader, modular baseline grounded in the Information Security Manual, beginning with a first chapter titled Essentials for enterprise IT. ASD opened national consultation on the evolution on 15 June 2026; that consultation closed on 12 July 2026.

The indicative timeline, as reported across industry: the Essential Eight and the Essentials series run side by side as live documents for roughly 12 months; ASD expects to begin deprecating the Essential Eight around mid-2027 and retire it entirely around mid-2028. Critically, ASD has published no fixed retirement date — every date beyond the announcement is indicative.

What the Essentials Series Is

The Essential Eight was designed as a baseline for internet-connected IT networks — eight mitigation strategies, four maturity levels. It was never designed for enterprise mobility, operational technology, or AI-era data flows, and ASD's own guidance acknowledged those limits. The Essentials series restructures the baseline around distinct domains rather than eight strategies, aiming at a more comprehensive, outcomes-focused model that can absorb OT, IoT and AI concerns.

What we do not yet know matters as much as what we do: the final guidance has not been published, maturity-level mechanics are undetermined, and the mapping between E8 maturity levels and Essentials outcomes is not yet defined. Any vendor claiming detailed Essentials knowledge today is speculating.

For DISP Members: Nothing Changes Yet

This is the point most coverage buries. The DISP cyber requirement is set by the DSPF — and the DSPF requirement today remains the Essential Eight at Maturity Level 2, unchanged since 30 September 2024. Defence has not announced any change to DISP's ICT and cyber security domain requirements, and Defence's eligibility guidance continues to reference E8 ML2 across systems used to correspond with Defence.

If and when Defence transitions the DISP requirement to the Essentials series, it will move through the DSPF — with industry notice. DISP members will not wake up to a surprise requirement change.

Why Starting ML2 Now Still Pays

The worst reading of the announcement is "wait for Essentials." That reading misunderstands how frameworks transition. The capabilities the Essential Eight forces you to build — application control, patching discipline, MFA enforcement, privilege restriction, tested backups, logging and evidence — do not disappear in the new model; they are the foundation the Essentials series builds on. Organisations with a working ML2 posture will map into Essentials quickly. Organisations that waited will start from zero against a framework with more surface area, not less.

There is also a practical DISP reality: your Annual Security Report cycle does not pause for a framework transition. Evidence collected now — configuration baselines, patch records, MFA logs — remains evidence next year, whatever the framework is called.

What to Do This Quarter

Keep building ML2. It is the current DISP requirement and the bridge into whatever comes next.

Instrument for evidence, not documents. Continuous evidence collection survives framework changes; policy documents written for one framework's language do not.

Watch Defence, not commentary. The DISP requirement changes when the DSPF changes — follow defence.gov.au and your Contract Manager, not vendor blogs (including ours).

Plan the mapping. When the final Essentials guidance publishes, the first task is a control-by-control map from your ML2 posture to the new domains. Organisations with current E8 evidence will do that in days.

How Serious Defence Helps

Serious Defence tracks the DSPF and ASD guidance so your compliance program reflects current requirements — not last year's. DISPulse maintains your Essential Eight ML2 evidence continuously today and will map to the Essentials series when final guidance lands, so the transition is a configuration exercise rather than a rebuild. DISPath keeps DISP applications aligned to whatever the DSPF requires at submission time. Our E8 ML2 guide remains the current-requirement reference, and the E8 to Essentials transition guide tracks every confirmed development as ASD moves.