ASD to Retire Essential Eight Cyber Security Framework in Two Years

The Australian Signals Directorate (ASD) announced plans to retire the Essential Eight framework within two years, replacing it with a new 'Essentials' series. This change aims to address the evolving cyber security landscape, particularly with the rise of cloud computing and operational technology. Chris Horlyck from the ASD stated that the Essential Eight would remain active during the transition, with a phased retirement expected over 24 months. The new framework will focus on outcomes rather than prescriptive controls, allowing organizations greater flexibility in their security measures. Initial chapters will cover enterprise IT, operational technology, and cloud, with potential inclusion of agentic AI. The shift is partly in response to criticisms that the Essential Eight's maturity level requirements have become misaligned with current security practices. The transition aims to provide clearer guidance on shared responsibilities in cloud environments.

Key Points: • ASD plans to retire the Essential Eight framework within two years. • The new 'Essentials' series will focus on outcomes and flexibility in security measures. • Initial chapters will address enterprise IT, operational technology, and cloud security.