announced on 24 June 2026 that the will be retired and replaced by the . Since then the same handful of dates has been quoted in different ways, often without saying which have already passed and which are still approximate. This page keeps every date in one table and says what each one means for a business with a contract, an insurer or a tender asking about its .
Current at 29 September 2026. ASD has not published the final Essentials series. We update this page when that changes.
The timeline in one table
| Date | What happens | Status | What it means for you |
|---|---|---|---|
| 24 June 2026 | ASD confirms the Essential Eight will be retired. Chris Horlyck, ASD's Head of Cyber Security Resilience, gives the timeline as deprecation in roughly 12 months and full retirement in roughly 24. | Happened | Nothing about your obligations changed that day. Start finding where the framework is named in your contracts. |
| Late June 2026 | Draft Essentials series released for public consultation, with three chapters: Essentials for Enterprise IT, Essentials for Cloud and Essentials for Operational Technology. | Happened | The draft is still the best guide to where the requirements are heading. |
| 12 July 2026 | Consultation on the draft closes. | Happened | ASD is working through submissions. There is nothing to submit now. |
| No date given | Final Essentials series published. | Not yet | Expected before deprecation. Until it lands, the Essential Eight is the only current standard and a mapping exercise against the draft is provisional. |
| Around mid-2027 | Essential Eight deprecated. ASD keeps publishing it, but it stops being the primary framework and the Essentials series runs alongside it. | Announced, approximate | A clause that names Essential Eight Maturity Level 2 still binds you. Have current evidence of the level you hold before this point. |
| Around mid-2028 | Essential Eight fully retired. | Announced, approximate | Any contract, tender or insurance attestation that names the Essential Eight now points at a retired standard. |
| Not announced | PSPF Policy 14, which requires Commonwealth entities to reach Maturity Level 2, updated to reference the Essentials series. | Pending | Government suppliers should expect the requirement to be re-expressed, not dropped. |
What has already happened
Three things are done. The retirement was announced, the draft replacement went out for consultation, and the consultation closed. ASD's announcement put the change on a 12-to-24 month track with the caveat that the timing could shift while the replacement is finalised, and nothing since has moved either date.
The announcement itself is covered in our piece on what the Essential Eight retirement means for businesses, and the shape of the replacement in the guide to Essentials for Enterprise IT.
What is still to come
Two dates are approximate and one has no date at all. Deprecation around mid-2027 and retirement around mid-2028 are ASD's own words, and both should be read as roughly 12 and 24 months from the June 2026 announcement rather than as fixed days on a calendar. The final Essentials series has no published date. ASD has said only that it is working through consultation responses, and the sensible assumption is that the final version arrives before deprecation so organisations can see where their existing work sits before anything expires.
The one that catches people is the PSPF. Policy 14 still requires Commonwealth entities to reach Maturity Level 2, and the 2025 Commonwealth Cyber Security Posture report found only 22 per cent of them had. That policy will need to be re-expressed against the Essentials series, and nobody has said when.
What each date means if you hold an obligation
If the Essential Eight only ever lived in your security program, the timeline is easy: keep implementing the controls, because they carry across to the Essentials series, and map them once the final version is out.
If it also lives in a signed document, the dates matter more. Deprecation and retirement are decisions about a document ASD maintains. They do nothing to a clause in your contract, which stays as binding on the day after retirement as the day before, except that the thing it refers to has stopped being maintained. We set out where those clauses hide and what to do about them in Your contracts still say Essential Eight Maturity Level 2.
The practical deadline is mid-2027. An assessment completed against the Essential Eight while it is still the current standard is evidence against the standard your contracts actually name. The same assessment done after retirement is evidence against a framework your counterparty never agreed to.
Frequently asked questions
Is the Essential Eight still current?
Yes. It remains the active standard until deprecation begins around mid-2027, and ASD is keeping both it and the Essentials series live through the transition. If a contract, insurer or funder asks for Essential Eight progress today, the requirement is real and current.
When exactly is the Essential Eight retired?
ASD has not given a day. The announced timeline is deprecation in roughly 12 months from June 2026 and full retirement in roughly 24, which puts them around mid-2027 and mid-2028.
Could the dates move?
Yes. ASD said at the announcement that the timeline could shift while the replacement is being finalised. Treat both dates as approximate until ASD publishes the final Essentials series and confirms them.
What replaces it?
The Essentials series, a set of domain-specific frameworks rather than one universal checklist. The confirmed chapters are Essentials for Enterprise IT, Essentials for Cloud and Essentials for Operational Technology. Agentic AI was mentioned in the consultation material as a possible fourth.
Does the Cyber Security Act 2024 change any of this?
No. The Act does not mention the Essential Eight anywhere in its text. Its payment reporting obligation, which commenced on 30 May 2025, runs on a separate track and is unaffected by the framework retiring.
Where this leaves you
Nothing expires this year. The dates that matter are mid-2027 for deprecation and mid-2028 for retirement, both approximate, with the final Essentials series due somewhere before the first of them. If you need evidence of where you stand while the Essential Eight is still current, we run fixed-price Essential Eight assessments with a board-ready report and a remediation roadmap.
