For years, the Essential Eight has been the go-to checklist for Australian organisations defending against cyber attacks. That is now changing. The Australian Signals Directorate (ASD) has launched ASD Essentials, a new cyber security framework that evolves the Essential Eight into a broader set of guidance covering enterprise IT, operational technology and cloud environments.
The shift is more than a rebrand. It changes how organisations measure progress, where they focus effort and how they handle environments the original framework was never designed for.
Why ASD Essentials Is Replacing the Essential Eight
ASD points to its Annual Cyber Threat Report 2024-2025, which shows Australian organisations facing increasingly sophisticated threats. At the same time, modern technology environments have grown more complex, spanning on-premises systems, hybrid cloud and emerging technologies.
A fixed list of controls struggles to keep up with that variety. The new framework takes a threat-informed, principles-based approach, giving organisations flexibility to achieve security outcomes without being tied to specific technologies.
5 Key Changes Under ASD Essentials
1. Phased priorities replace maturity levels. Instead of climbing maturity levels, organisations will work through phased priorities, directing effort to their highest-risk assets first.
2. Outcomes over checklists. The framework moves away from prescriptive security requirements toward principles and actions that help organisations assess whether intended security outcomes are actually being achieved.
3. New building blocks. It introduces cyber security principles, actions and domains, focusing uplift efforts on critical business functions and systems.
4. Environment-specific chapters. Each chapter applies the same underlying model but accounts for the threats, risks and operational realities of the environment it covers.
5. Risk-informed decisions. There is a stronger emphasis on decision-making supported by threat intelligence and each organisation’s own context.
The First Three ASD Essentials Chapters
The series launches with three chapters:
- Essentials for enterprise IT is the direct evolution of the Essential Eight.
- Essentials for operational technology (OT) supports Australian critical infrastructure operators protecting their operational technology environments from cyber threats.
- Essentials for cloud supports organisations whose technology environment is delivered entirely through software-as-a-service (SaaS) and platform-as-a-service (PaaS).
ASD has also made AI-focused guidance available, helping organisations consider AI-enabled systems within their technology environments. The framework includes overview publications and supplemental publications alongside the chapters.
Who Should Pay Attention
The guidance is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations. Small and medium-sized businesses that do not operate at enterprise scale can still apply it where relevant.
ASD says the framework remains consistent with its best-practice advice and the Australian Government Information Security Manual. Industry consultation played a central role in its development, and ASD plans to keep engaging with industry, government and critical infrastructure stakeholders as technologies and threats change.
What ASD Essentials Means for Compliance Today
For now, nothing changes on the compliance front. Organisations should continue meeting their current regulatory obligations until regulators communicate any associated changes.
ASD is in discussions with regulatory bodies about the impact and expected timeframes of the transition and says it will advise on expectations in due course. During the transition period, both the Essential Eight and ASD Essentials will remain available on cyber.gov.au, along with supporting resources and implementation guidance.
For security teams, the practical takeaway is to start reviewing the new chapters now, map current Essential Eight controls against the new principles, and identify which critical business functions and systems would sit at the top of a phased priority plan.
