Australian organisations will no longer be able to summarise their cyber security posture with a single Essential Eight maturity level. The Australian Signals Directorate (ASD) has released a principles-based replacement that rates security area by area.
The ASD Essentials series, described as an evolution of the Essential Eight, is aimed at Commonwealth entities, critical infrastructure owners and operators, and large enterprise.
The framework is not limited to government. ASD's guidance for senior executives notes that cyber threats "affect organisations across all sectors, regardless of size or profile". It says the series is designed to help organisations "direct cyber security investment towards the areas of greatest need".
Australian Cyber Security Centre head Stephanie Crowe said the focus was on "helping Australian organisations keep pace with the evolving threat environment and strengthen their ability to withstand cyber incidents".
The first release has three chapters: enterprise IT, operational technology (OT) and cloud. The cloud chapter is for organisations whose technology is delivered entirely through software-as-a-service and platform-as-a-service. Separate guidance covers AI considerations across all three.
Each chapter is built from three layers. Principles describe the security outcome to achieve, actions describe what must be done, and domains describe the business functions and assets the actions apply to. The principles are drawn from the Information Security Manual (ISM).
ASD says the actions do not prescribe a particular vendor, product or architecture. Organisations can select controls that suit their environment and obligations, and the framework is designed to align with other recognised cyber security frameworks.
"Rather than prescribing a single way to implement cyber security, Essentials focuses on the outcomes organisations should aim to achieve," said ASD technical director Jayden Cooke. He said this gives organisations flexibility to reflect "their technology environments, operational needs, and risk profile".
In the enterprise IT chapter, the eight Essential Eight mitigation strategies give way to eight domains. They are identity services, boundary services, critical processes and services, privileged environments, business systems, user devices, governance and culture, and visibility and response.
Maturity levels are gone. Each action is rated in each domain it applies to as not assessed, not effective, partially effective or fully effective. According to ASD's transition guide, assessors weigh coverage, consistency, currency and evidence quality.
ASD pitches domain reporting as a governance tool. It says reporting posture by domain gives decision makers "clearer visibility of strengths, weaknesses and risk exposure" to guide investment and risk treatment. Its assessment guide describes a domain-level view suited to executive, board and regulator reporting.
Where to start
Priority phases set the order of work. ASD's executive guidance says a statement such as "we have reached priority phase 2" describes "implementation scope, not how secure the organisation is".
The implementation planning guide gives an example sequence. Boundary services and identity services come first, along with the governance and culture and the visibility and response capabilities that later phases depend on. Critical processes and privileged environments come next, then business systems and user devices.
ASD's reasoning is set out in its domain risk table. Internet-facing and boundary systems "are routinely exposed to adversary scanning and exploitation, making them common targets for initial access". Compromise of identity services can give an adversary persistent or privileged access across the enterprise.
AI is adding pressure. "Advances in technology, particularly artificial intelligence, are enabling malicious cyber actors to operate with greater scale, speed, and effectiveness," said Crowe. ASD's AI guidance says AI can help adversaries "conduct reconnaissance, identify vulnerabilities and develop exploits or malware more quickly".
Organisations already invested in the Essential Eight will have to meet a higher evidence bar. ASD's transition guide says Essential Eight maturity ratings "do not automatically translate into effectiveness ratings" because the two approaches assess different things.
Configuration records, policies and deployment records still show how a control was implemented. Where they prove deployment but not sustained effectiveness, organisations may need operational evidence. ASD lists control validation, testing, exercise results and monitoring records.
Maturity Level Two was the required baseline for Commonwealth entities and many critical infrastructure operators. The guide says those organisations can expect many existing controls to count towards early phases. They should not assume an action will be fully effective in every domain.
Even organisations at Maturity Level Three will need a gap analysis. The guide says that level "does not automatically produce fully effective ratings".
Some requirements have no direct Essential Eight equivalent. These include content filtering, cyber security awareness training and cyber supply chain security. The identity principle now also calls for scanning codebases, file shares and collaboration platforms for exposed keys, secrets and credentials.
Investment and accountability
ASD says existing Essential Eight investment "remains valuable". It adds that organisations "should assess those controls against the new framework rather than assume they are equivalent".
Asset identification has widened. Organisations must continuously identify and document infrastructure, operating systems, applications, identities, credentials and data as distinct assets.
The governance and culture domain covers executive cyber security accountability, resourcing, risk management assurance, supplier assurance, AI accountability and legacy system management. ASD's guidance for senior executives says the series puts more weight on formal board-level accountability.
AI systems are assets within scope. These include models, training and fine-tuning data, prompts, outputs, connectors and APIs, and the accounts and non-person identities used by AI agents.
Under the ISM, the board or executive committee is accountable for ensuring AI is "secure, controllable, human-supervised and used in an ethical and accountable manner".
ASD's AI guidance also cites indirect prompt injection through emails, documents or web content processed by AI agents with access to tools or data.
The Essentials has no regulatory standing of its own yet. "Until associated regulatory changes are communicated by regulators, organisations should continue to meet their current regulatory obligations," ASD said. Its assessment guide says it "does not replace any regulatory or compliance requirements".
ASD advises organisations facing a regulatory or contractual obligation for a specific environment to start with the chapter covering it. It adds that "an obligation establishes a floor, not a priority order".
ASD will keep both the Essential Eight and the Essentials on cyber.gov.au during the transition. When the Essentials becomes mandatory is yet to be settled, Crowe told iTnews.
Crowe said ASD is working with policy agencies on a transition timeframe over the next year or two. Government agencies will be assessed against both frameworks next year.