ASD Essentials: the Essential Eight now needs governance as well as controls.

For most Australian businesses, the Essential Eight has been a technical checklist. Eight controls, a maturity level for each, and a target of Maturity Level 2 that most of our clients know by heart. This week the Australian Signals Directorate released the ASD Essentials series, and the framework that replaces it works in a very different way.

We have been reading the new guidance closely, including ASD's Implementation planning guide. Our view is simple. ASD Essentials is much less about which controls you have switched on and much more about whether you can prove, year after year, that they work. That is a governance problem as much as a technical one.

What has changed

The Essential Eight told you what to implement. ASD Essentials describes security outcomes through principles, the actions needed to achieve them, and the domains where those actions apply. Each chapter of the series (the first being ASD Essentials for enterprise IT) applies the framework to a particular kind of environment.

Instead of eight controls, your environment is divided into six technical domains based on what each system does:

• Boundary services
• Identity services
• Critical processes and services
• Privileged environments
• Business systems
• End user devices

Two capability domains sit across all of them: Governance and culture, and Visibility and response.

Several other shifts matter for business owners:

• Maturity levels are no longer a target. ASD is explicit that there is no level to settle at. Coverage of the principles across every domain is the end state for every organisation, approached through three priority phases.
• Executive accountability is now assessed. Under the framework, the board or executive's accountability for cyber security, including setting risk appetite and resourcing the program, is part of what gets assessed in the Governance and culture domain. This is a framework expectation rather than a new legal duty, but it puts leadership firmly in the picture.
• Deployment is not effectiveness. Each action is rated as fully effective, partially effective, not effective or not assessed, based on evidence. ASD's guidance states plainly that deployment evidence alone is not enough to support an effective rating.
• There is no finish line. In ASD's own words, cyber security implementation "does not have a definitive completion date". Once you have worked through the phases, you move into ongoing reassessment.

Your existing Essential Eight work is not wasted. Every Essential Eight mitigation strategy maps to at least one ASD Essentials principle, and ASD has published a separate Transitioning from the Essential Eight guide. But the work around those controls is now much larger.

In the meantime, keep meeting the requirements you have today. If a contract, your insurer or your DISP membership calls for a particular Essential Eight maturity level, our advice is to treat that as still in force until the body that set it formally changes it.

It looks a lot like GRC

When we read ASD's implementation guidance, it looked very familiar. Securing executive commitment. A version-controlled scope statement for each domain, with exclusions justified in writing. A gap analysis that classifies every action as addressed, partially addressed or not addressed. An evidence register. An exception register with named owners and expiry dates. A risk-based reassessment cadence. Resourcing reviewed against changes in the threat environment.

That is governance, risk and compliance. It is very close to the approach our cyber security team already takes with enterprise customers, and to the way an ISO 27001 information security management system is built and maintained.

ASD also assesses each control on four dimensions: coverage, consistency, currency and evidence quality. Can you show the control applies to every asset in scope? Is it deployed from one approved baseline? Who reviews it, and when? Is the evidence system-generated, or is someone asserting it? Anyone who has sat through an ISO 27001 surveillance audit will recognise those questions.

ASD's advice is to design for assessment from day one, because rebuilding evidence at assessment time "often results in avoidable rework". In our experience that is exactly right. When controls are built to record what they do, the evidence is already there when an assessor asks for it. When they aren't, someone ends up digging through logs and screenshots the week before, and the result is rarely convincing.

That does not make ASD Essentials a paperwork exercise. A policy does not put MFA on every account, restrict privileged access or catch a compromised credential. The framework needs the technical work and the governance around it to run as one operating model: controls are built, operated and monitored, and the evidence that they work comes out of that operation. Neither half gets a business there on its own.

Who runs the program?

ASD Essentials needs someone to own it. Someone has to brief the board, agree the reporting format, keep the scope statements current, run the validation program, chase exception owners and decide when a reassessment should be brought forward. Most small and mid-sized businesses do not have a CISO, and the IT manager already has a full-time job.

We expect more businesses to fill that gap with a virtual CISO. A vCISO can own the ASD Essentials program, report posture to the executive in the standard format ASD recommends, and govern the ongoing validation work so ratings stay current after the initial project ends.

A vCISO does not replace the people who run the controls. It works best alongside them, so the advice, the implementation and the evidence come from the same plan. That is how our vCISO service already works with our own technical teams for clients working towards ISO 27001 and other frameworks, and ASD Essentials fits the same model.

Why you need both

This is where we think businesses need to be careful about who they choose to help.

Many small IT providers are good at the technical side of the Essential Eight. They can roll out MFA, configure application control and patch on time. That work still matters. But ASD Essentials asks for more than configuration. It asks for scoping decisions that will stand up to an assessor, a risk register the board actually uses, evidence models designed into each control, and a reassessment cycle that keeps running for years.

We believe providers without real GRC experience will find this hard to get right, in the same way a governance consultancy without hands-on technical delivery would. The likely failure is a program that looks complete on paper but rates poorly when someone tests the evidence, or one that stalls after phase one because nobody owns the governance.

InterIntra is a managed service provider that is also currently ISO 27001 certified. Our technical teams deploy and run the controls ASD Essentials depends on. We maintain our own ISMS through annual surveillance audits, and our team has delivered GRC programs and ISO 27001 implementations for clients across a range of industries. We have built scope statements, evidence registers and exception processes for ourselves and for others. Having both under one roof puts us in a good position to help businesses plan and run ASD Essentials properly from the start.

Where to start

ASD recommends starting small. You do not need to plan the whole chapter at once. A sensible first step looks like this:

1. Brief your executive team on what has changed and what the framework now expects of leadership.
2. Record your operating context: regulatory obligations, client requirements, risk appetite and available budget.
3. Scope only the priority phase 1 domains and write down what is in and what is out.
4. Run a gap analysis against your existing Essential Eight controls and documentation, and check that the evidence is still current.
5. Set up your evidence and exception registers now, not when the assessment is due.

If you would like help working out where your business sits under ASD Essentials, or who should own the program, talk to our cyber security team.