ASD Essentials: What Actually Gets Easier

Background

On 15 October 2026, the Australian Signals Directorate (ASD) published ASD Essentials as the evolution of their Essential Eight (E8) framework. The eight strategies and maturity levels are gone. In their place are eight domains, each with principles (outcomes) and actions (how to get there), sequenced into three priority phases.

CI-ISAC is encouraged by the changes. Eight years after E8 was first published, and three years after maturity level (ML) 2 became mandatory for Commonwealth entities, only 22 percent of those entities reached it (ASD). Operational Technology (OT) is now treated as a priority, getting its own full chapter in the new guidance.

How Essentials is built

There are three phases. Each domain has a number of principles. These principles are the outcomes. There are actions, which are what you do to achieve them.

• Phase 1 is improved: Boundary and identity services come first, because that’s how attackers get in. Getting meaningful coverage there is achievable for almost every organisation.
• Phases 2 and 3 are still challenging: Privileged environments, business systems, and user devices still carry the old pain of application control, legacy systems, and macros.
• Cheaper to start, similar to finish: Some actions have no E8 equivalent at all, including credential exposure, supply chain security, and the governance and visibility domains. So the overall scope is much larger; but that increase is offset by a phase-scoped implementation.

When assessing each domain in your environment, ASD is very clear that “work commencing” or “a plan existing” doesn’t constitute effectiveness. Non-production environments are in-scope. Assets are classed by the role they perform, not by the team that owns them. For much of Critical Infrastructure (CI), there’s a specific OT chapter that reorders things slightly. This chapter treats every device inside the OT system as privileged and drops the User devices domain entirely.

The hardest parts about E8. How Essentials addresses them.

The main things fixed are sequencing and scoring, the TLDR is below:

Application control is extremely difficult to do properly: Application control is very effective against users double-clicking virus.exe, though targeted attacks can bypass it. The E8 ML1 application control lands primarily in user devices, a Phase 3 domain. This used to be something even relatively immature organisations focused on initially as part of an ML1 project; so being able to defer it for other, higher priority controls is a good risk-managed approach. It also allows implementers to focus on doing app control on Phase 1 entities first, rather than doing it on everything everywhere all at once.

The 48-hr patching window is unachievable, so it gets “risk managed”: The action is now to patch within a defined risk-based timeframe, or automatically where operational impact is low. Because that risk-base is implementor-defined, it can weigh actual exploitability, exposure, and impact; and these can differ between domains. ASD is explicit that ISM, regulatory, and other mandatory timeframes still apply.

‍

Restricting admin privileges breaks things: Under Essentials, this (important) control is split over Identity & Access Management (IDAM), least privilege access, secure administration, and network segmentation. Administration must happen from dedicated environments isolated from unprivileged workloads. Privilege must be time-bound, and least privilege now explicitly includes non-human accounts (service accounts, API accounts, MCPs, AI agents, etc).

Legacy systems can’t be patched or allowlisted: Legacy system management is now a named principle in the Governance and culture domain. Where legacy systems can’t be removed or replaced immediately, organisations must identify and manage the risk until decommissioning. For legacy authentication protocols ASD is very clear – disable them, or restrict and monitor them, plus a time-bound decommissioning plan.

Compensating controls: Essentials addresses this through the rating model, a compensating control can only lift ratings where it demonstrably achieves the action’s intended outcome, with not only the rationale but also evidence documented. Exceptions, compensating controls, and accepted risks form a core part of the reassessment and review process.

Macros: Office macros likely fall out of scope until Phase 3 where they fall under secure configuration management on user devices. Macros in Office documents remain a viable way in for attackers particularly with increasing effectiveness of AI-enabled phishing lures, but content disarming is getting better on emails, and it is a viable compensating control to strip all active content from external emails. Unfortunately, we can’t suggest a technical fix for a finance team whose end-of-month depends on a macro written in 2007 by someone who left in 2011. That’s a bigger problem and it will remain until leadership can be convinced it’s cheaper to replace than defend.

Our Take

We expect Essentials projects to produce far more meaningful results at low to medium maturity, which is where most Critical Infrastructure entities sit. Implement Phase 1, measure it, understand it, then plan Phase 2 with real data. Workflows break (macros blocked, app control deployed, auto-patching enabled, etc.) in one domain at a time instead of everywhere. Existing E8 evidence carries forward through ASD’s framework mappings.

Recommendations

1. Don’t transition from E8 until your obligations do: SOCI CIRMP and DISP still reference E8, so keep reporting against it until it references Essentials. ASD says to keep existing uplift programs going while assessing alignment with Essentials, and it hasn’t set a deadline. Start your transition baseline now, but don’t kick off new workstreams unless an obligation or a material risk requires it.
2. Budget for independent assessment: Independently assess the risks of compensating controls. ASD still budgets periodic independent assessment in addition to internal assessment effort into their costing model.
3. Coordinate with your board: Your Board or executive committee is now explicitly accountable for cyber risk appetite and resourcing, and your “governance and culture” is a formal part of assessment. Consider sending them a summary of this article.
4. Fund sustainment, not just the project: There is no finish line. ASD expects ongoing reassessment once the phases are complete, and the operating cost grows with each phase. Just remember to fund sustainment beyond the project’s implementation.
5. Don’t assess suppliers with Essentials (yet): ASD indicates that guidance is coming. Keep your existing third-party assurance until it lands.

References

https://www.cyber.gov.au/essentials

https://partners.cyber.gov.au/s/article/ASD-Essentials

https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model

https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/the-commonwealth-cyber-security-posture-in-2025