Government ditches Essential Eight cyber security standard after decade of
An audit found 78 per cent of agencies failed. The government will replace its Essential Eight cyber standard.
For nearly ten years, federal departments and agencies have fallen short on cyber security. A 2025 audit revealed 78 per cent failed to meet the mandatory baseline.
This baseline covers all eight key threat areas. The requirement has been in place since July 2022.
Parliament House itself was in that group. Cyber Security Minister Tony Burke announced the new framework.
The Australian Signals Directorate developed it. It moves away from a numerical checklist system.
Instead it uses principles-based guidance. This covers IT, cloud and operational technology.
It includes specific advice for managing artificial intelligence. Agencies will now face independent testing and simulated exercises.
This replaces self-assessed ratings. The shift reflects rising threats.
In 2024-25, the federal government was the most targeted sector in Australia. It accounted for nearly one third (32 per cent) of cyber security incidents.
The security agency responded to these incidents.
- 78 per cent
- Agencies that failed 2025 audit
- 32 per cent
- Federal share of cyber incidents
- more than 1200
- Incidents responded to
- 83 per cent
- Rise in notifications
Why it mattersGovernment agencies hold citizens' data. They run critical services. Weak cyber defences expose Australians to data breaches, identity theft and service disruption.
AustraliaAustralians' tax records, Medicare details and other personal information held by federal agencies are safer if this new stricter framework closes security gaps and forces real accountability.
✓ Claims checked against the source and corrected before publish. checked 1 h ago
Open this story in InSnip →
