If you’ve talked to us about cyber security, you’ve probably heard us mention the Essential Eight. It’s the list of eight security basics the Australian Signals Directorate (ASD) has recommended for years, and most Australian businesses have used it as their checklist.
On 15 October, ASD released its replacement, called ASD Essentials. Here’s what that means for you, without the jargon.
What’s changed?
The Essential Eight was a fixed list: eight things to do, and three maturity levels to measure how well you’d done them. It was simple, which is a big part of why it caught on.
The problem is that most businesses don’t look the way they did when it was written. Plenty now run almost entirely on Microsoft 365 and other online services, and a checklist built around office computers and servers doesn’t fit them as neatly.
ASD Essentials takes a different approach. Instead of one list, it’s a series of guides for different kinds of setups:
- Enterprise IT, which is the direct successor to the Essential Eight
- Cloud, for organisations that run entirely on online services
- Operational technology, for industrial systems like power and water
The new framework also asks a different question. Instead of “have you turned this setting on?”, it asks “is your security actually working?”, starting with the systems your business can’t run without.
The maturity levels are gone too. Each part is now rated as not effective, partially effective or fully effective.
Do I need to do anything right now?
Probably not. ASD has been clear on three points:
- Keep meeting your current obligations. If a contract or a regulator asks for a particular Essential Eight maturity level, that still applies until they tell you otherwise.
- There’s no deadline yet. ASD is working through timeframes with regulators and will announce them later. Both frameworks stay available in the meantime.
- Don’t stop work that’s already under way. ASD specifically says not to slow down security improvements you’ve already planned.
It’s also worth knowing who the new framework is written for. ASD Essentials is aimed mainly at government, critical infrastructure and large organisations. Smaller businesses can use it where it’s relevant, but it wasn’t designed around a ten-person office.
Was our Essential Eight work wasted?
No. Every part of the Essential Eight maps to something in the new framework, and ASD says most existing work will directly meet, or go a long way towards meeting, the new requirements.
Multi-factor authentication, backups and keeping software up to date are still the foundations. They’ve just been reorganised.
The one thing that doesn’t carry across is your maturity level. The two frameworks measure different things, so the old ratings don’t convert automatically. If you’ve been quoting a maturity level to clients, your board or your insurer, expect that to change once the transition timeline is announced.
Who should pay closer attention?
For most businesses, day-to-day life won’t change much. A few should keep an eye on it:
- Government suppliers, and anyone whose contracts mention the Essential Eight by name. Those requirements will be rewritten at some point.
- Law firms and other professional services. Client files and trust money make you a target, and clients are asking more often how their information is protected.
- Businesses that run entirely in the cloud. The new cloud guide is written with setups like yours in mind, and it’s a better fit than the Essential Eight ever was.
How we can help
We’re working through the new framework now. If you’re one of our managed IT clients and you’ve got questions, give us a call.
If you’re not a client and want to know where your business stands, get in touch and we’ll take a look. You can also read more about our cyber security services, or go straight to ASD’s guidance on cyber.gov.au.