On 13 August, AfterDark founder Stephen Gibson joined Crayon as the special guest for a webinar for IT peers, The ASD Essential Eight Controls Are Changing: A Discussion. The session was led by Gino Barletta, cyber security consultant at Crayon (now part of SoftwareOne), alongside Scott Hagenus, Director of Cyber Security Solutions, and Matt Harris, Cyber Security Account Manager specialising in identity and data security.
Introduced as one of Crayon’s trusted and valued partners, Stephen was invited to bring the partner perspective, drawing on more than 25 years of founding and leading AfterDark, now a 50‑person managed service provider in Brisbane. You can watch the full recording on YouTube.
What’s changing
In June 2026, the Australian Signals Directorate (ASD) confirmed that the Essential Eight will be retired within roughly two years and replaced by a broader body of guidance called the Essentials series. The first chapter, Essentials for Enterprise IT, is the direct evolution of the current Essential Eight. The two frameworks are expected to run side by side for around 12 months before the Essential Eight begins to be deprecated, with full retirement at around the two‑year mark. ASD hasn’t committed to fixed dates, so treat these as a guide rather than a deadline.
“Every framework changes”
Asked for his first reaction to the change, Stephen kept it in perspective. AfterDark has been through this before, having watched its own ISO 27001 certification move from the 2013 to the 2022 standard.
“Every framework changes. My first thought is that this has to be business as usual. This is what we’re used to in IT.”
Stephen Gibson, AfterDark Technology
He welcomed the broader scope of the new series, including modern controls, AI and operational technology, while being candid about what it means for an MSP.
What it means for partners
MSPs like AfterDark have built managed services, projects and audits around the Essential Eight. Stephen explained that the transition means a lot of work behind the scenes:
“It means we’re going to be busy on a lot of things that aren’t directly billable to clients. We need to go back into product development mode and look at how we wrap these changes into something a customer understands, that’s palatable, fits their budget and meets their requirements.”
Stephen Gibson, AfterDark Technology
When Gino asked whether the Essential Eight would become the “Windows XP” of frameworks, with organisations staying on it until they’re comfortable to move, Stephen put the responsibility squarely with partners:
“It comes down to their managed services partner. It’s up to us to tell that story. Plenty of clients still don’t know what the Essential Eight is, and they rely on their partners to talk to them about these things.”
Stephen Gibson, AfterDark Technology
The Essential Eight is still the conversation
Asked what AfterDark talks to customers about day to day, Stephen was clear that the Essential Eight remains the starting point:
“The Essential Eight is probably the easiest way to have that conversation, so we’re going to continue on with it as we always have. This isn’t the AfterDark way; this is us adopting the government’s recommendations.”
Stephen Gibson, AfterDark Technology
That conversation flows through AfterDark’s account management team into audits, whether run by AfterDark or independently through a partner like Crayon, along with annual penetration tests, security training and the wider work that sits outside the eight strategies.
The rest of the panel agreed. Scott Hagenus described the Essential Eight controls as unbelievably effective and argued that organisations still need to get the basics, like patch management, right. His advice was not to drop the intent of the Essential Eight on the way through. Matt Harris noted that ASD’s approach of a single, well‑defined shift should give customers more certainty than a stream of small changes.
The biggest challenges for SMBs
On the biggest cyber security challenges facing small and medium businesses, Stephen pointed to three:
- The skills gap. Finding enough skilled people to deliver managed services. AfterDark addresses this by leveraging consultants like Crayon for audits and keeping a dedicated team focused on patching so other work doesn’t distract them.
- Education. Spending time with clients so they understand the risks before committing to a service, audit or product.
- Competing priorities. Clients want to talk about automation and AI, but security has to stay first.
“You’ve got to make sure security is still number one at the table, because nothing else is worth it without it.”
Stephen Gibson, AfterDark Technology
Why AfterDark works with Crayon
To close the panel, Gino asked Stephen why AfterDark chose Crayon. Stephen explained that, as a mid‑sized MSP that has grown from two founders, partners like Crayon let AfterDark augment its team, take on work it couldn’t resource alone and stretch into new areas, from cyber security and Essential Eight assessments to large mergers and complex Microsoft engagements. He also highlighted the trust in the relationship, noting that in a competitive industry, Crayon has always supported AfterDark as a partner rather than a competitor.
What we recommend now
- Stay the course on your Essential Eight maturity target. It remains the framework in force.
- Keep gathering evidence and reviewing your controls so your work maps across to the new series.
- Check your obligations. Supplier contracts, PSPF requirements and cyber insurance terms still reference the Essential Eight.
- Get the basics right. Patching, MFA, admin privileges and backups remain the foundation.
- Talk to your IT partner about how they’re preparing for the Essentials series.
Thank you to Crayon
Our thanks to Gino Barletta, Scott Hagenus and Matt Harris for a practical and candid discussion, and for inviting AfterDark to share the partner view. New to the framework? Start with our plain‑English guide, The Essential Eight explained.
AfterDark helps organisations assess their Essential Eight maturity, maintain evidence and prepare for the transition to the Essentials series. Our Virtual CISO service provides ongoing security leadership to keep you on track through the change.
To discuss what the changes mean for your organisation, contact our sales team on 1300 55 3101.
Quotes have been lightly edited for readability.
