Key points
- ASD Essentials replaces the Essential Eight with a principles-based approach.
- The new framework covers enterprise IT, operational technology and cloud environments.
- Organisations must adjust how they measure security progress and focus effort.
The Australian Signals Directorate has introduced ASD Essentials as the successor to the Essential Eight. This new cyber security framework expands guidance to include enterprise IT, operational technology and cloud environments.
What happened
The Australian Signals Directorate has launched ASD Essentials, a new framework that replaces the long-standing Essential Eight checklist. According to The Cyber Express, this shift addresses increasingly sophisticated threats identified in the 2024-2025 Annual Cyber Threat Report. Modern technology environments have grown complex, spanning on-premises systems, hybrid cloud and emerging technologies.
The original fixed list of controls struggled to keep pace with this variety. ASD Essentials adopts a threat-informed, principles-based approach. This allows organisations flexibility to achieve security outcomes without being tied to specific technologies. The change affects how Australian organisations measure progress and handle environments the original framework never designed.
Why it matters
The transition represents more than a simple rebranding of existing advice. It fundamentally changes where security teams focus their effort and how they validate controls. The Essential Eight was designed for a different technological landscape. Today’s environments require guidance that spans hybrid cloud and operational technology. A rigid checklist cannot adequately address the breadth of modern infrastructure. By moving to a principles-based model, the ASD aims to provide more adaptable guidance. Organisations must now align their security postures with broader outcomes rather than specific control counts. This requires a strategic shift in how compliance and maturity are assessed.
What happens next
- Review current security controls against the new ASD Essentials principles.
- Identify gaps in coverage for cloud and operational technology environments.
- Adjust measurement metrics to reflect the broader framework requirements.
- Plan for phased implementation of the new priorities.
Patch priority
Security teams should immediately audit their environments to determine which assets fall under the new framework’s scope. Prioritise systems that operate in hybrid cloud or operational technology sectors, as these were least covered by the previous model. Verify that current controls align with the principles-based outcomes rather than just checking boxes. Test any new configuration changes in isolated environments before wider deployment. Ensure that documentation reflects the shift from a fixed checklist to a flexible, threat-informed approach. Back up critical configurations before making structural changes to security policies.
What to do and how to stay safe: Australian Signals Directorate
- Review internal security policies to ensure they align with the broader ASD Essentials principles.
- Assess current coverage for operational technology and cloud assets that were previously outside the Essential Eight scope.
- Update maturity measurement tools to track outcomes rather than specific control implementations.
- Monitor official ASD channels for further detailed guidance on the phased priorities.
Step-by-step guide: How MFA Secures Cloud Accounts: Mechanisms and Trade-offs
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is replacing the Essential Eight framework?
The Australian Signals Directorate has launched ASD Essentials, a new cyber security framework that replaces the Essential Eight.
Why is ASD replacing the Essential Eight?
The shift addresses increasingly sophisticated threats and the complexity of modern technology environments spanning cloud and operational technology.
How does ASD Essentials differ from the Essential Eight?
ASD Essentials uses a threat-informed, principles-based approach, offering flexibility to achieve security outcomes without tying organisations to specific technologies.
