For nine years, Australian businesses have measured their cyber defences against the Essential Eight and its maturity levels. That yardstick is now being replaced, and the scores businesses have built up under it will not carry across.
The Australian Signals Directorate (ASD) has launched ASD Essentials, an evolution of the Essential Eight framework first released in 2017. The original set out eight security practices, including application and operating system patching, multi-factor authentication and restricting administrative privileges.
The new framework drops that fixed list in favour of a risk-based approach. It is organised into chapters, initially covering enterprise IT, operational technology and cloud. The OT chapter lands as losses from attacks on operational environments in Australia and New Zealand average US$2.04 million per incident, almost double the global average, according to Claroty.
Each chapter is built around principles, actions and domains. Principles describe the security outcomes an organisation should achieve. Actions, many mapped against known attack techniques in the MITRE ATT&CK database, describe what needs to be done. Domains are the business functions and assets the actions apply to, grouped by similar risk, with separate maturity ratings for each.
"Good cyber security does not have to be complicated," Australian Cyber Security Centre head Stephanie Crowe said. She described the framework as "practical, prioritised guidance that Australian organisations can use to reduce risk, protect critical systems and strengthen their defences against real-world threats."
The change does not take effect overnight. ASD will maintain both the Essential Eight and Essentials on cyber.gov.au during a transition period, and no mandatory changeover date has been set. However, ASD's transition guidance says Essential Eight maturity ratings do not convert into Essentials ratings. A business that has reached a given maturity level under the old model will need to be assessed again under the new one.
That reassessment rests on judgement rather than a checklist, and the Australian Computer Society (ACS) has warned that the assessor workforce is thin. The government's Infosec Registered Assessors Program has more than 400 registered assessors, but they are focused on government and large businesses.
"For nine years, the question was simple: did you tick the box? Now the question is whether your security actually works," ACS chief executive Dr Prins Ralston said. "Get this wrong and boards will be handed reports full of 'fully effective' ratings that nobody can stand behind."
Essentials is designed for Commonwealth entities, critical infrastructure owners and operators, and large organisations, and it offers little for SMEs. For smaller businesses, ASD this month published a Small Business Cyber Security Handbook that prioritises four actions: multi-factor authentication, rapid updates, regular backups and staff training. ASD responded to 220 small business cyber incidents last year.
For brokers, the split is practical. Large clients holding Essential Eight assessments can keep relying on them while contracts and regulators still reference the old framework, but those ratings will not translate when requirements move to Essentials. For SME clients, the four handbook actions are now ASD's own priority list, and they are the controls to confirm before the next cyber renewal.
