The Essential Eight has evolved: ASD launches the Essentials series

The Australian Signals Directorate (ASD) has released ASD Essentials, expanding the Essential Eight into a broader series covering enterprise information technology (IT), operational technology (OT) and cloud environments.

The framework is aimed primarily at Commonwealth entities, critical infrastructure owners and operators, and large organisations. Smaller businesses can apply the guidance where relevant to their operations and customer requirements.

For Defence primes and their suppliers, it provides a common basis for protecting sensitive information and the systems supporting contract delivery, with application guided by risk and contractual obligations.

The framework emphasises board and executive accountability for cyber security, including risk management, governance and adequate resourcing.

The series launches with three chapters:

• Essentials for enterprise IT — the direct evolution of the Essential Eight, covering endpoints, identity, email, servers and business applications.
• Essentials for operational technology — guidance for industrial environments, where security controls must account for operational constraints and the consequences of disruption.
• Essentials for cloud — guidance for organisations using software as a service and platform as a service, where security responsibilities are shared with providers.

Supporting guidance also explains how artificial intelligence (AI) systems should be considered within these environments. AI systems, their data, identities and integrations need to be included in scope.

Essential Eight – What changes

The Essential Eight was developed for predominantly Windows-based enterprise networks. Organisations now operate across on-premises systems, cloud services and industrial environments, with different risks and degrees of control.

The Essentials series addresses this in four ways:

1. Guidance suited to the environment. Each chapter addresses a different technology environment, drawing on the Information Security Manual.
2. Greater emphasis on outcomes. Principles and actions focus assessment on whether security controls achieve their intended outcomes, with flexibility in how organisations implement them. Each domain, such as identity services or business systems, is assessed separately, with evidence showing where controls are effective and where gaps remain.
3. Priorities based on risk. Phased priorities replace maturity levels, directing effort towards business functions and assets where it can achieve the greatest reduction in risk. For enterprise IT, the first phase focuses on boundary and identity services, supported by governance and culture, and visibility and response. Completing a phase shows which areas have been addressed; effectiveness still needs to be demonstrated. Existing maturity ratings do not automatically translate into effectiveness under the new framework.
4. Defence in depth. Layered protection extends across systems and information, supported by governance, visibility and response capabilities.

Essentials Series - Implications

Existing Essential Eight investment carries forward. Controls for authentication, patching, privileged access, application control, hardening and backups remain relevant.

Organisations will need to establish how those controls apply to the assets in scope, extend coverage where needed and demonstrate effectiveness through testing, operational records and measured outcomes.

For Defence primes and their suppliers, the task is to identify the systems and information supporting Defence work, review applicable customer requirements and establish what evidence demonstrates effective protection. Where services are provided by third parties, their responsibilities and contribution to those outcomes need to be understood.

The release itself does not amend existing regulatory or contractual requirements. Organisations should check the obligations that apply to them as transition arrangements develop.

Record the current position, identify the relevant chapters and plan what to retain, where further work is needed and how to sequence it.

SecureSupply can help Defence suppliers interpret the relevant guidance, identify gaps and plan proportionate security uplift against their operational needs and customer requirements. Contact SecureSupply to discuss how your current controls and evidence support that position.