At a glance
The ASD Essentials builds on the Essential Eight, by taking a broader, principles-based approach to cyber security risk. This blog introduces the three parts of the guidance and explains how domains, actions and assessment help organisations protect the systems and services they depend on. It also outlines where to start, including for organisations transitioning from the Essential Eight.
Evolving the Essential Eight for today’s cyber risks
The ASD Essentials series is an evolution of the Essential Eight, with a broader approach to helping Australian organisations manage cyber security risk.
The Essential Eight gave organisations a focused set of steps to strengthen their defences. That focus was useful, but a fixed list couldn’t cover every environment. We wanted to design a framework that could keep pace with emerging threats while remaining flexible enough to support advances in technology.
The Essentials takes a principles-based approach. This means starting with the risks to your organisation and applying the guidance to the systems and services you need to protect.
Here’s how it works and where to begin.
Three parts to help you get started
The guidance comes in three parts, so you can find the information you need.
The overview material explains what the Essentials is, why the guidance has changed and which parts apply to you. These documents are deliberately short.
The chapters cover different environments, including enterprise IT, operational technology and cloud. Start with the chapter that matches your environment. If your organisation runs a mix of environments, more than one may be relevant.
The supplemental guidance helps you put the Essentials into practice. It covers implementation planning, transition from the Essential Eight and assessment. It’s designed for the people planning, carrying out and checking the work.
Connecting security to what your organisation does
Within each chapter, you’ll find two other key concepts: domains and actions.
A domain groups assets according to the business functions they support. This connects your security work to the things your organisation needs to do, helping you consider assets in the context of the services they deliver.
Actions describe what you should do to protect those assets. They aren’t tied to particular products or technologies, so you can apply them to your environment.
Together, domains and actions help you consider how well you’re protecting the assets your organisation depends on, beyond compliance with a fixed set of measures.
Checking that protection works
Assessment looks at how effective your security measures are.
Having a measure in place is only part of the picture. It also needs to work as intended, be applied consistently and kept up to date.
The assessment guidance provides a defined scale and explains how ratings are combined. This helps organisations assess their protection consistently, produce comparable results and identify strengths and areas for improvement.
Where to start
Read the overview first, then choose the chapter that fits your environment: enterprise IT for traditional corporate systems, operational technology for industrial or control systems, or cloud.
Next, use the supplemental guidance to plan your work, including AI-focused guidance for applying the guidance to AI-enabled systems.
If you already use the Essential Eight, start with the transition guidance. Much of what you’ve built carries across, giving you a foundation for applying the Essentials.
The purpose remains familiar: helping you protect your organisation, with broader coverage and a clearer view of how well your defences work.
Jayden Cooke