Is the Essential Eight still worth doing for your ArcGIS environment?

The Essential Eight is being retired as the Australian Signals Directorate (ASD) transitions to its new Essentials series. The work already underway in ArcGIS environments remains relevant, which means there is little reason to stop or pause current efforts.

At Onneer, we spend a lot of time helping organisations interpret cyber security requirements in ArcGIS. Since ASD announced the change, we've had more conversations than usual with organisations trying to work out what it means for their ArcGIS environment: if the framework is changing, does the work completed so far still matter? For ArcGIS owners, the answer is a straightforward yes.

What is actually changing?

ASD opened consultation on the transition from the Essential Eight to the Essentials series on 15 June 2026, with consultation on the first chapter, Essentials for enterprise IT, closing on 12 July 2026.

The Essentials series is intended to provide guidance across a broader range of technology environments than the Essential Eight was originally designed for. Enterprise IT is the first chapter, with cloud and operational technology chapters expected to follow.

For now, the most useful approach is to focus on what has been published rather than what might come next. The content of future chapters hasn’t yet been confirmed.

Does the work we have already done still count?

Yes. 

That may be the most important message for organisations that have invested considerable effort in their security programs over recent years.

The Essential Eight will remain in effect as an active and supported framework. ASD has confirmed that a transitional arrangement will allow both the current Essential Eight framework and the new Essentials series to coexist for a period of time. In practical terms, this means organisations are building on work already completed rather than revisiting work already done.

For ArcGIS environments, that's important. Many of the improvements made under the Essential Eight were never just about compliance, because they addressed genuine operational and security risks that continue to exist regardless of how the framework evolves.

What does this mean for ArcGIS specifically?

For ArcGIS environments, this is where the implications become clearer, and where the change may prove more helpful than it first appears.

The Essential Eight emerged from a technology landscape that looked very different from many ArcGIS environments today. The intent behind the controls has always been relevant but applying them to ArcGIS has rarely been a straightforward exercise.

Most ArcGIS environments sit across multiple technologies and multiple ownership boundaries. Infrastructure teams manage some components while identity teams manage others. Then you’ve got cloud services, databases, integrations and managed services which introduce additional responsibility layers. Organisations that have assessed ArcGIS against the Essential Eight will recognise this challenge.

That is why ArcGIS assessments have always involved interpretation.

Applying the Essential Eight to ArcGIS has typically involved understanding the security outcome behind a control and then determining how that outcome applies across the platform.

Consider patching. A prescriptive requirement may appear relatively straightforward when viewed through the lens of traditional enterprise IT. In an ArcGIS environment, however, vulnerabilities may sit across Esri software, operating systems, databases, web adaptors and supporting infrastructure, all with different release cycles and ownership arrangements. The outcome organisations are ultimately seeking is much clearer: understanding where vulnerabilities exist and managing them appropriately across the platform.

From our perspective, that is why the shift towards outcomes and intent feels significant. ArcGIS has always required translation between security frameworks and operational reality. A framework built around outcomes may align more naturally with the way spatial platforms are actually assessed and managed.

What should we do now?

For most organisations, there is little value in pausing security improvement work while the transition unfolds. Existing investments continue to support stronger security outcomes today.

Just as importantly, take the opportunity to understand your current position. Knowing what has been implemented, where responsibilities sit and which risks remain unresolved will make future decisions easier when additional guidance is released.

The cloud chapter is likely to be worth following closely. As ArcGIS environments continue to span on-premises and cloud services, that guidance is likely to be particularly relevant for many organisations.

Onneer's role is to help organisations interpret what these changes mean in the context of ArcGIS. If you're trying to understand how the transition applies to your environment, we're happy to share what we're seeing across the industry.