ASD is replacing the Essential Eight with a modular, risk-based Essentials series over the next two years. Nothing is in force yet, which makes now the planning window, not a reason to wait.
The question is shifting too. Today it is, what is your Essential Eight maturity level. A number. Soon it becomes, show me your risk-based position, and the evidence. For anyone who has treated the Eight as eight boxes to tick, that is a harder landing than a new checklist.
Delivered as a service. You come away with four things you can act on and put in front of a board.
Your posture today, evidenced, with the material gaps flagged.
Your baseline mapped to the risk-based model, as far as it is known.
A plain, defensible statement of where you stand and what the move means.
The prioritised plan to move, and a design of how your position will be managed from here.
Enterprise IT first, then cloud and operational technology. Once the review is done, we can keep your position current as each chapter publishes, so you are never caught mid-change. We scope that with you after the review, so the readiness review stands on its own.
Your risk intelligence stays here.
Cyber risk run as an operation, so a provable position is kept current, not rebuilt in a panic.
Evidence, not a score.
You get the senior judgement without the full-time hire.
Yes. ASD is moving to replace the Essential Eight with a modular, risk-based Essentials series. Nothing is in force yet, so now is the planning window. Keep maintaining the Essential Eight in the meantime, it still counts and the investment carries over.
It is the risk-based model ASD is developing to succeed the Essential Eight. Instead of asking for a maturity level, it asks you to show a risk-based position and the evidence behind it. It is expected to land in chapters over about two years, enterprise IT first, then cloud and operational technology.
It is a transition rather than a single date, expected to run over roughly two years as each chapter is published. Because nothing is in force yet, the sensible move now is to plan the transition, not wait for it.
Yes. The Essential Eight still applies and still counts. A readiness review builds on your current posture, so the work you do now carries over into the risk-based model rather than being wasted.
Related: RiskOps: GRC for energy & utilities and the 2027 SOCI dates.
We will scope the readiness review against your own position, the obligations you carry and where you stand on the Essential Eight today.
Book a readiness briefingRiskWatch is our monthly read on Australia's regulatory and cyber-risk clock: what is due, what is coming, and what it means for the teams that carry the obligations. No noise, no sales pitch.