The ASD Essentials Transition: The Opportunity to Build Better Cyber Resilience
Over the past few weeks the Australian Signals Directorate has confirmed where Australian cyber compliance is heading. The Essential Eight will retire within roughly two years, replaced by a broader Essentials series beginning with Essentials for enterprise IT.
Consultation on that first chapter is open until 12 July 2026, and as an ASD partner, Constant will be helping to shape the future of the new framework. ASD has been explicit that the work organisations have already invested in Essential Eight maturity will not be made redundant.
For the businesses being assessed against the Essential Eight today, this is a significant moment, and we wanted to share our views on the opportunity here to build a stronger, more resilient and commercially advantageous Australian economy.
We Back The Direction ASD Is Taking
ASD has been clear that the Essential Eight was built for a technology shape that no longer matches how most organisations work, and we agree with that assessment. The change to Essentials means a shift from prescriptive controls toward principles-based guidance, which are better aligned to the cloud and SaaS environments most Australian organisations now operate within. It also allows for flexibility of principle application versus the “one size fits all” of Essential 8 as it is today.
The new framework also addresses a real source of friction in Essential Eight work. Previously, maturity scores have shifted when nothing changed at the organisation’s end, which has cost teams credibility with their boards even though their security work was holding firm. The ASD Essentials will separate the framework from those updates, so the work organisations have done will not be silently undone with any future revisions to the ASD’s guidance.
We Were Built For A Dynamic Threat Landscape.
Our Essentials product, Constant, was designed with security legislative evolution in mind. From day one, we built Constant so that our users can manage their compliance with always-on evidence, not assumptions, while adhering to the dynamic threat and legislative landscape. We’re cyber practitioners who know what it means to be accountable for delivering security and compliance in environments where failure has consequences, and standing still is not an option.
That is why we are moving with the framework. Constant will continue supporting customers who need to demonstrate Essential Eight compliance during the transition period, and the evidence your organisation has already built up stays in the platform for as long as you need it.
That is why we are moving with the framework. Constant will keep Essential Eight live in the platform throughout the transition period. Where possible, we will also map Essential Eight controls into the new Essentials framework, which means our users will get an instant view of where they sit against the new framework without needing to rebuild their compliance program from scratch.
The Changes We Have Already Started To Make
Our team has already begun expanding Constant’s framework infrastructure, and will soon be launching modules for NIST and more, which will sit alongside the Essential principles in the platform. That work was planned before ASD’s announcement and is continuing now with a clearer line of sight to where the guidance is heading, and we’re thrilled the ASD is taking a proactive approach.
We will track the consultation through to the close on 12 July 2026, and engage through the ASD Cyber Security Partnership Program where it is useful, and we’re approaching the work with the same seriousness that is being asked of Australian organisations who will have to adapt to the changes. We’re committed to ensuring it is as smooth, and seamless, as possible for our users.
What This Means For Your Essential Eight Work
ASD has confirmed it directly: the investment your organisation has made under the Essential Eight remains relevant under the Essentials. The Essential Eight is still the active framework, and both will run as live documents during the transition period. Constant as a platform is still supporting Australian organisations to deliver their Essential Eight compliance requirements, with ease and speed, as usual.
For the businesses we work with, whether you have mandatory compliance requirements or are operating in high-trust industries, the practical answer is unchanged. Continue the maturity work and hold the controls you have implemented, and we will support the 24/7 audit compliance as usual. The shift will extend on the foundation you have built rather than replacing them.
We will continue sharing our insights through each phase of the rollout, from now through to the final framework release, so that our customers will not be left to interpret the change alone. The product will evolve with the framework, and our team is already laying the groundwork.
We’re Here To Help
If your organisation wants to talk about your Essential Eight program in the context of where the Essentials series is heading and stay ahead of the curve, book a conversation with our team.