Australia is replacing the Essential Eight with a new cyber framework. Here’s how exposure management can help you get ahead of it.
Australia's ASD is replacing the Essential Eight with an outcomes-based Essentials series covering IT, cloud, OT and likely agentic AI, with deprecation from mid-2027.
The Australian Signals Directorate announced in June 2026 that the Essential Eight will be replaced by an outcomes-focused Essentials series structured as chapters covering enterprise IT (including identity and SaaS), cloud, OT, and likely agentic AI. Deprecation begins around mid-2027 with full retirement around mid-2028, though timelines are targets; the Essential Eight is mandatory for roughly 98 non-corporate Commonwealth entities but voluntary for private firms. Tenable argues the shift demands continuous security posture evidence via exposure management rather than point-in-time checklist assessments.
- ASD retiring Essential Eight for outcomes-based Essentials series with IT, cloud, OT chapters
- Deprecation starts around mid-2027; full retirement around mid-2028
- Essential Eight mandatory only for ~98 non-corporate Commonwealth entities
- New model requires continuous proof of security posture, not periodic assessments
From the original article
8 min read at tenable.com
Australia’s move from the Essential Eight to an outcomes-based cybersecurity model will push organizations from conducting periodic point-in-time, checklist compliance assessments to having continuous evidence of a solid security posture.
By Ben Mudie · tenable.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.