ASD sunsets Essential Eight as consultation closes on Sunday

Digital Attitudes, 12 July 2026

The Sunday read is one cyber baseline the entire Australian public education sector benchmarks against reaching the last day of its retirement consultation, one Anthropic compute number that frames the Wednesday brief's Australian tender, one Children's Online Privacy Code sitting five months from registration with schools' student information systems inside its scope, and one TAFE NSW generative AI policy landing on the desk of the country's largest VET provider for review the same week Term 3 opens.

ASD's Essential Eight consultation closes tonight with a replacement waiting

The Australian Signals Directorate opened public consultation on the evolution of the Essential Eight cyber security framework on Monday 15 June, and that window shuts at 11:59pm tonight, Sunday 12 July. The proposed change: retire the current maturity model style Essential Eight and roll out an "Essentials" series, with "Essentials for enterprise IT" as chapter one and further chapters to follow for other technology environments. The stated fix is the "moving goalposts" problem, where an organisation appears to go backwards on its maturity score after each ASD update without any actual drop in its security posture. In 2025, ASD reported that only 22 per cent of federal entities had reached Maturity Level Two (iDM on ASD flagging the next generation Essential Eight, 19 June).

Why this matters: For every state Department of Education IT team, every university CISO reading the Essential Eight into their board risk pack, every TAFE cyber team, and every independent school running the framework because both cyber insurance and audit ask for it, the read is that the baseline the sector has benchmarked against for three years is being retired inside a live remediation program window, and the 2027 uplift plans that assumed the current maturity ladder now target a framework the ASD is about to publish. The question the next state Department cyber governance paper answers is whether the existing Maturity Level Two commitments stick through the Essentials transition, or whether the education tender clauses that cite the framework by name need rewriting before Term 4 renewals. And for the university CISO explaining the AUKUS clearance cyber posture to the vice chancellor after the Reynella East and University of Western Australia incidents flagged in earlier briefs, the read is that the Commonwealth cyber standard the sector's own ML2 attestations sit on is about to change, and the annual cyber posture line in the university risk register needs its next update to name the Essentials chapter rather than the E8 maturity level.

Anthropic locks in 401 MW of Kentucky compute while chasing 1.4 GW in Australia

Anthropic signed a 20 year, USD 19 billion lease with TeraWulf on Monday 6 July for a 401 megawatt site in Hawesville, Kentucky, built on a 790 acre former aluminium smelting facility with existing power transmission and fibre. Initial capacity comes online in the second half of 2027 and full capacity in early 2028. TeraWulf's own capital commitment sits at USD 3 billion to USD 4 billion, or less than a fifth of the lease value, with closed loop propylene glycol cooling in place of local water draw (SiliconAngle on Anthropic inking the USD 19 billion AI data centre lease with TeraWulf, 6 July).

Why this matters: Wednesday's brief flagged Anthropic's confidential tender for at least 1.4 gigawatts across Australia's five biggest data centre operators, worth as much as USD 15 billion, with a final decision expected inside six weeks. Kentucky is the frame for reading that call. Anthropic is building 401 MW of East Coast US compute over 20 years while asking Australian operators for three and a half times that footprint on a shorter timetable. For every Australian university CIO reading the Claude for Education contract against the ANU School of Computing embedded curriculum, the RMIT pilot and the Curtin AI teaching assistants, the read is that the Australian 1.4 GW tender is Anthropic's second track rather than a fallback, and the sovereign data residency line in the next Claude Enterprise renewal reads differently once the model traffic can route to either compute perimeter. For the state Department of Education AI procurement teams comparing Claude for Education against Copilot and ChatGPT Edu inside the AI Review Committee bar, the question the next vendor selection paper answers is what the tenant residency clause says the day the Aussie 1.4 GW split lands across mostly US parented hyperscalers rather than the local operators like NEXTDC, AirTrunk and CDC.

Children's Online Privacy Code sits five months from registration

The Office of the Australian Information Commissioner's phase 3 consultation on the exposure draft of the Children's Online Privacy Code closed on Friday 5 June, and the code must be finalised and registered by Thursday 10 December, leaving the sector five months to work out where its vendors land. In scope: designated internet services (cloud storage, content access sites, streaming platforms, consumer IoT), relevant electronic services (messaging apps, video calling, in game chat) and social media services, all where they are likely accessed by children or "primarily concerned with the activities of children". The OAIC's own examples of the last category name applications that track early childhood development and online school management systems that monitor student performance (OAIC on the Children's Online Privacy Code).

Why this matters: For every school running an LMS with a student chat surface (Canvas, Schoolbox, D2L Brightspace, Blackboard, Sentral with in app messaging, Compass with parent and student notifications), every AI marking or tutoring product with a student facing chat mode, and every parent communication platform that talks directly to Year 7 to Year 12 students, the read is that the OAIC's scope catches the tools schools actually use rather than only the consumer social media surface, and the December registration deadline puts vendor privacy by design commitments on the Term 4 procurement checklist. The question the next school council paper answers is whether the school's third party vendor register already lists the products that fall inside the code, whether the contracts already include the Australian Privacy Principle overlays the code will impose, and whether the vendor product roadmaps line up with a compliance date that arrives before the 2027 school year opens.

TAFE NSW Gen AI in Education Policy hits its review date on Sunday week

TAFE NSW's Generative Artificial Intelligence in Education Policy carries a review date of Sunday 19 July 2026. The policy governs staff and learner use of generative AI for teaching, learning, scholarly practice and assessment across Australia's largest VET provider, and any change to it flows through to the way tens of thousands of TAFE NSW students use ChatGPT, Copilot and Claude on assessments through Term 3 (TAFE NSW Gen AI in Education Policy).

Why this matters: For every private RTO running a version of the TAFE NSW policy as its own template, every state TAFE authority benchmarking its governance against the largest single cohort in the country, and every ASQA compliance officer preparing an audit against the VET Quality Framework, the read is that the largest single generative AI policy in Australian post secondary education lands on the desk for revision the same week Term 3 opens on Monday 21 July. The question the next state VET governance committee answers is whether the update carries yesterday's Time for Class 2026 tipping point figures (71 per cent weekly AI use among admins, 61 per cent among students, 52 per cent among instructors) into TAFE policy language, or whether it leaves the framework written for a smaller share of student and staff AI use than the 2026 baseline now shows.

Coffee is refilled. Term 3 opens next Monday against a retiring cyber baseline, a live compute race, a privacy code countdown and the country's largest VET provider revising its Gen AI policy in the same week. Everything else this Sunday can wait.