ASD Essentials Replaces Essential Eight With Broader Cyber Framework

The Australian Signals Directorate has introduced ASD Essentials, a new cyber security framework that replaces the long-standing Essential Eight checklist. This shift affects Australian organisations that previously relied on the Essential Eight for their primary defence posture. The new framework expands the scope of required controls to include operational technology and cloud environments, which were not fully addressed by the original model. According to The Cyber Express, this change alters how organisations measure their security progress and allocate defensive efforts.

Root cause

The Australian Signals Directorate cites its Annual Cyber Threat Report 2024-2025 as a primary driver for this update. The report indicates that Australian organisations are facing increasingly sophisticated cyber threats. Simultaneously, modern technology environments have grown more complex, spanning on-premises systems, hybrid cloud infrastructure and emerging technologies. The previous fixed list of controls struggled to keep pace with this variety and complexity. The new framework aims to address these gaps by providing broader guidance.

Attack path

The Essential Eight was designed primarily for traditional enterprise IT environments. Attackers increasingly target hybrid cloud setups and operational technology systems that fall outside the original framework's strict definitions. The new ASD Essentials framework addresses this by adopting a threat-informed approach. This allows defenders to focus on security outcomes rather than specific technological implementations. The shift recognises that rigid control lists are less effective against modern, diverse attack surfaces.

Affected versions

• The original Essential Eight framework is being superseded by ASD Essentials.
• The new framework applies to enterprise IT environments.
• Operational technology environments are now explicitly included in the scope.
• Cloud and hybrid cloud infrastructure are covered under the new guidance.

Mitigation

• Review current security controls against the new ASD Essentials framework requirements.
• Identify gaps in coverage for operational technology and cloud environments.
• Adjust security measurement strategies to align with the principles-based approach.
• Update internal documentation to reflect the transition from Essential Eight to ASD Essentials.

Signals worth monitoring

Teams usually start by mapping current assets to the new framework's principles rather than checking boxes. Look for configuration drift in cloud environments that may not align with the updated guidance. Monitor for alerts indicating unpatched operational technology systems, as these were previously less scrutinised. Check whether access controls in hybrid setups match the new threat-informed standards. Review log retention policies to ensure they support the broader scope of the new framework. Containment moves should focus on isolating non-compliant systems quickly. Verify that segmentation between IT and OT networks remains effective under the new model.

What to do and how to stay safe: Australian Signals Directorate

• Audit your current security posture against the ASD Essentials framework to identify gaps.
• Ensure operational technology and cloud assets are included in your security monitoring.
• Update internal security policies to reflect the principles-based approach of the new framework.
• Train security teams on the differences between the Essential Eight and ASD Essentials.

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why is the Australian Signals Directorate replacing the Essential Eight?

The ASD states that modern technology environments have grown more complex and threats are becoming more sophisticated, requiring a broader framework.

What new environments does ASD Essentials cover?

The new framework covers enterprise IT, operational technology and cloud environments, expanding beyond the original Essential Eight scope.

How does the new framework differ from the old one?

ASD Essentials takes a threat-informed, principles-based approach, giving organisations flexibility to achieve security outcomes without being tied to specific technologies.