ASD Essentials is here. Here's how we're getting started (and you can too)!

Last week, the Australian Signals Directorate (ASD) launched ASD Essentials, an evolution of the Essential Eight covering enterprise IT, cloud and operational technology (OT).

The framework builds on the Essential Eight, bringing governance, supplier assurance, detection and response into a broader approach to security. For organisations already using the Essential Eight, it changes how they prioritise work, assess their controls and report progress.

What is ASD Essentials?

ASD Essentials takes a principles-based approach to cyber security. It starts with the outcomes an organisation needs to achieve, then connects those outcomes to specific actions and the parts of the business they protect. The principles come from ASD’s Information Security Manual (ISM).

Each environment-specific chapter uses three connected layers:

• Principles describe the security outcomes to achieve.

• Actions set out the administrative and technical requirements that support those outcomes.

• Domains group the business functions and assets where the actions apply.

A domain groups business functions and assets that face similar exposure and consequences if compromised, even when they sit across different departments, networks, suppliers or locations. That helps teams decide where an action applies and what it needs to cover.

The principles provide a common foundation across the chapters. The actions reflect the threats and operating constraints of each environment, giving teams room to choose an implementation that suits their business. Evidence then shows whether it’s achieving the intended outcome.

Why the Essential Eight is evolving

The Essential Eight gave organisations a focused foundation for reducing cyber risk. But let's be honest, it had gotten long in the tooth. Guidance needs to reach further as threats become more complex and business systems become ever more intertwined. As the Hachette cyber incident showed, disruption at one supplier can leave other businesses struggling to serve their customers, even when their own systems haven’t been attacked.⁠

Today, relatively simple business functions depend on enterprise systems, cloud services and equipment that controls physical processes. Each brings different security responsibilities and operating constraints. ASD Essentials brings a modern lens to these complexities and gives those environments their own guidance within a common framework.

ASD’s transition guidance is worth a look too, it covers executive accountability, supplier assurance, security awareness and response capabilities alongside familiar technical controls. Existing Essential Eight investment provides a foundation for this broader work.

What has changed from the Essential Eight?

Assessment and reporting change too. ASD Essentials assesses security area by area, so a report gives a more detailed picture of where controls are working and where there’s more to do.

ASD’s transition guide sets out four action ratings: not assessed, not effective, partially effective and fully effective. An action receives a rating in each domain where it applies.

The work done by your IT team aligning to E8 is still useful. Mapping existing controls and evidence to the new actions will help teams see what carries forward and where further work is needed. Previous maturity ratings will need to be reassessed against the new model.

Which parts apply to your organisation?

The first release has three chapters. Which ones apply depends on the technologies your business relies on. Some organisations will use one; others will draw on several across different parts of their environment. There’s no prescribed order between chapters.

For enterprise IT, familiar identity, internet-facing services and privileged access controls sit alongside broader governance and response requirements. Teams can map their existing Essential Eight work to these requirements to check coverage.

For cloud, the chapter covers customer-managed identities, data, configuration, integrations and provider assurance, helping organisations understand the responsibilities they retain when using cloud services. Microsoft 365 may be one part of that picture, with the organisation’s wider environment determining which chapters apply.

For OT, security decisions must account for safety, availability and operational continuity. Protecting systems tied to physical processes requires guidance suited to those constraints.

Our view: a better map for security decisions

Cyber security posture is more important than ever. Connecting security work to the business functions it protects should make it easier to explain where investment is needed and why. The emphasis on evidence also gives teams a reason to revisit controls and check how well they’re working.

We’ve developed Microsoft 365 security-configuration reports that review selected tenant settings and map relevant checks to Essential Eight and ASD Essentials guidance. They give customers a way to see what’s configured, discuss the findings and identify areas worth investigating.

These reports cover selected settings visible at the time of review. They contribute one piece of the evidence a broader ASD Essentials assessment would need, alongside other systems, people, processes and operational testing. Drawing conclusions about an action’s effectiveness across an organisation requires that wider view.

Our aim is to make clear what was checked, what the evidence shows and where further assessment would help, so customers can decide what to do next.

For ongoing security operations, our Lumara SecOps Cloud brings your existing security tools together with 24/7 monitoring, threat investigation and coordinated response from our Australian-based security operations centre (SOC).

We're also making some quick tune ups to Lumara vCOMP, our compliance specialist people extension, to keep our compliance playbooks, advice and expertise attuned to the times.

The road ahead

It’s still early days for ASD Essentials. There’s time to get familiar with the guidance and consider how it could shape your organisation’s security priorities.

For teams looking to get a head start, three things are worth exploring:

• Get familiar with the relevant chapters. Consider how the enterprise IT, cloud and OT guidance relates to the systems and services your business relies on.

• Build on your Essential Eight work. Use your existing controls, knowledge and evidence as a foundation, rather than starting again.

• Start the broader conversation. Bring supplier dependencies, governance and response capabilities into discussions about security, and consider where future investment could make the biggest difference.

At Secure ISS, we’re already taking steps in that direction. We’re rolling out major upgrades to Lumara, with threat intelligence at the centre of how we protect our customers and ASD Essentials already built in. The upgraded Lumara Fabric connects security findings, investigations, threat intelligence and reporting to give your team a clearer view of where your security stands. We’ll share more with our customers soon.