The links provided by @RedNectar provide some excellent reading on pros/cons and things to consider between "network centric" and "application centric". As to what is needed to move to an application centric design - a clear accounting of all the servers (virtual or bare metal), applications, and their connectivity requirements. Both of these can be very difficult to obtain with any level of accuracy but this is the data you need so that you can understand how to group servers and applications with similar security requirements into EPGs and then develop the appropriate contracts (think abstracted ACLs) between EPGs to allow the East-West traffic flows that your servers and applications require. That is one of (if not the) most challenging part of a data center as that level of visibility is not often know or easily determined and that is true with or without ACI.
This is why you have tools like Tetration and others. to help with that understanding of all the flows into and out of your applications.
