The Australian Signals Directorate (ASD) has released the first three chapters of ASD Essentials, a new framework that looks set to replace the tried-and-tested, but increasingly dated, Essential Eight.
The initial three chapters cover:
- Operational Technology (OT)
- Cloud
- Enterprise IT
ASD has also published supporting guidance documents for asset classification.
While the Essential Eight remains a useful starting point for smaller organisations, its coverage was becoming increasingly difficult to justify in today’s threat landscape. Having 25% of its mitigation strategies focused on Microsoft Office macros and application hardening, while lacking specific coverage for cloud environments and heavily targeted OT systems, highlighted the need for a broader approach.
ASD appears to be striking a good balance with Essentials: focusing on foundational security controls without overcomplicating the framework or turning it into another compliance exercise. Too often, frameworks such as NIST and ISO 27001 can become exercises in achieving a good score or demonstrating compliance, rather than genuinely improving an organisation’s security maturity.
How ASD Essentials is structured
Each chapter uses domains to describe where security actions should be applied. There are six technical domains that group systems, services and assets with similar cyber security risks:
- Boundary services
- Identity services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
Each chapter also includes two capability domains that apply across all six technical domains:
- Governance and culture
- Visibility and response
This structure provides a way to apply security controls across different technology environments while maintaining a focus on the capabilities needed to manage and respond to cyber threats.
Worth the effort?
Moving to ASD Essentials will likely require more effort than implementing the Essential Eight alone. However, the broader coverage appears to be a worthwhile step forward, particularly as organisations increasingly rely on cloud services and interconnected operational technology.
For Australian organisations, and potentially those in New Zealand looking for a practical approach to foundational cyber security, ASD Essentials looks like a development worth watching as further guidance becomes available.
