ASD’s Essential Eight replacement moves away from maturity ladder

The Australian Signals Directorate (ASD) is moving ahead with replacing its Essential Eight cyber security framework, but it will likely be a year or two before the guidance released today becomes the new standard.

iTnews reported in late June plans to retire the nearly decade-old Essential Eight in favour of a cyber security framework with a principles-based approach.

The biggest change is that ASD Essentials does not sum up an organisation’s security in a single rating, as the Essential Eight does.

Under the Essential Eight, organisations are rated from Maturity Level Zero to Three, with the requirements to reach each level changing over time, in line with the threat landscape.

ASD Essentials instead has organisations report their security area by area, such as identity services or internet-facing systems, with overall posture expressed through effectiveness ratings backed by evidence, such as independent testing and simulated exercises.

The framework sets out priority phases for implementation, but ASD said these are not maturity ratings, and that reaching a phase "describes implementation scope, not how secure the organisation is".

ASD Essentials has now emerged from consultation with government, industry and regulators, and moves into implementation and adoption.

"The overwhelming response from the consultation process was positive," Australian Cyber Security Centre head Stephanie Crowe told iTnews.

When the Essentials becomes mandatory is yet to be settled.

"What we are working on now with policy agencies in government is an appropriate timeframe for transition from a regulatory perspective," Crowe said, adding that the work would run over the next year or two.

In the meantime, the Essential Eight will stay on ASD's website alongside the new framework, and government agencies will be assessed against both next year.

Crowe said there was "no wasted investment" for organisations that remain aligned with the Essential Eight, as existing control maturity count towards the new framework.

ASD's own guidance, however, adds that organisations should check those controls against the Essentials "rather than assume they are equivalent".

A transition guide is being released alongside the framework, and ASD plans workshops for organisations working through the change.

"We recognise this might take some organisations some time if they haven't invested heavily in the Essential Eight," Crowe said.

Outcomes, not controls

ASD Essentials framework also stops prescribing specific controls.

It sets out the security outcomes to achieve and leaves organisations to choose how they do so, though ASD's examples are still specific, such as requiring phishing-resistant multi-factor authentication.

It also tells organisations where to start: identity services and edge devices that connect networks to the internet come first, ahead of business systems and staff laptops, Crowe said.

"So if those devices aren't secure, you're allowing threat actors into the network quite easily," Crowe said.

ASD had been warning about attacks on edge devices for three or four years, she said, and frontier AI is now speeding up how quickly adversaries could find and exploit them.

"Every organisation that's connected to the internet is at risk," Crowe said.

In its initial version, the Essentials covers cloud and operational technology as well as enterprise IT.

ASD Essentials also calls on organisations to formally define executive and board-level accountability for cyber security.