ASD Essentials Set to Replace the Essential Eight, Ending the Single Maturity Score

The Australian Signals Directorate (ASD) has released ASD Essentials, the framework set to replace the nearly decade-old Essential Eight. It is likely to be a year or two before it becomes the new standard. The framework has come out of consultation with government, industry and regulators and now moves into implementation and adoption. Australian Cyber Security Centre head Stephanie Crowe told iTnews the response to consultation was overwhelmingly positive.

The biggest change is the end of a single rating. The Essential Eight scores organisations from Maturity Level Zero to Three. ASD Essentials instead has organisations report on areas such as identity services or internet-facing systems, with overall posture shown through effectiveness ratings backed by evidence, including independent testing and simulated exercises. The framework does include priority phases for implementation, but ASD says these are not maturity ratings and describe implementation scope, not how secure an organisation is.

When the new framework becomes mandatory is yet to be settled, as government policy agencies work on a transition timeframe. Meanwhile the Essential Eight will stay on ASD's website, and government agencies will be assessed against both next year. Crowe said there is no wasted investment for organisations aligned with the Essential Eight, since existing control maturity counts towards the new framework. ASD's guidance does advise checking those controls against the Essentials rather than assuming they are equivalent. A transition guide and workshops are planned.