From the Essential Eight to ASD’s Essentials

By Peter Baussman & David Cottingham

ASD has released its Essentials series, covering enterprise IT, cloud and operational technology, with supporting guidance on implementation, assessment and transitioning from the Essential Eight.

For organisations already investing in the Essential Eight, the immediate question is what this means for their existing security program. ASD’s advice is clear:

“Organisations should continue their current uplift programs, while assessing alignment with the new framework.”

Organisations should first assess existing controls against the new framework’s mappings, identify where further work is needed and use their risk management processes to guide implementation.

A broader framework, with more judgement required

The Essential Eight’s simplicity was one of its strengths. Eight mitigation strategies, supported by explicit requirements and maturity levels, gave security teams a clear direction and a practical way to communicate progress to management.

Essentials broadens the approach considerably. It asks organisations to apply security actions across different parts of their environment and demonstrate that those actions achieve their intended outcomes. Its assessment process considers coverage, effectiveness and the quality of supporting evidence.

For organisations, the biggest change is the greater role of organisational judgement in turning the framework into an effective security program. ASD’s assessment guidance explains how these judgements should be made and reported.

Organisations have always been responsible for understanding and managing their own risks. However, those that relied on the Essential Eight primarily as an explicit checklist will need to reconsider how they assess their environment, prioritise improvements and demonstrate results.

Start with the Essential Eight control mapping

For organisations transitioning from the Essential Eight, we recommend taking the following steps:

1. Firstly read ASD’s transition guidance alongside its implementation planning guide.

2. Map existing Essential 8 controls and planned improvements to the relevant Essentials actions. Check which assets they cover and whether current evidence shows if the controls are effective.

3. Use your organisation’s risk management framework and security strategy to turn any findings into a delivery plan. Consider primarily the systems that support important business functions, their exposure and the consequences of compromise. Use ASD’s priority phases to perform planning, with any departures supported by a documented risk rationale.

Existing Essential Eight investment remains valuable

While the Essentials represents shift in governance, every Essential Eight mitigation strategy maps to at least one principle in Essentials for enterprise IT.

However, it’s important to know that an existing Essential Eight maturity rating does not automatically establish effectiveness under Essentials. Some controls may require additional evidence, and the framework introduces requirements beyond the Essential Eight. ASD’s transition mappings help organisations determine if any changes are needed.

The transition builds on existing investments, with a gap assessment being the best way to determine what comes next.

Where application control fits

We continue to regard application control as a foundational security capability. Essentials reinforces that role by incorporating application control into broader requirements for trustworthy software, including explicit restrictions on administrative tools and their permitted execution locations. These requirements apply across all six technical domains in enterprise IT.

ASD’s application-control transition mapping identifies three actions under the Trustworthy software and Secure configuration management principles. 

IT.PRO-07.1: Trustworthy software

“Permit only supported, verified and organisation-authorised software to execute on systems, with exceptions minimised, formally risk accepted, time-bound, monitored and regularly reviewed.”

IT.PRO-07.2: Trustworthy software

“Restrict administrative and management tooling to approved software sets and executed from only authorised, known locations.”

IT.PRO-04.3: Secure configuration management

“Detect and respond to configuration drift using scheduled technical assessments and, where supported, automated monitoring, based on system criticality and change rate.”

All three actions apply across the six technical domains in enterprise IT: boundary services, identity services, critical processes and services, privileged environments, business systems and user devices.

ASD’s transition guidance expands upon the above, by stating that Rulesets, approved software lists and blocklists can provide strong evidence for software execution restrictions.  

Supporting customers through the transition

In the coming days, we will publish more detailed guidance explaining how Airlock Digital supports the relevant Essentials requirements for enterprise IT and operational technology, including implementation considerations for customers.

ASD’s guidance has been part of Airlock Digital’s history from the beginning. The Top Four helped inspire the creation of the company, and the Essential Eight subsequently played a significant role in shaping the depth and capability of our product.

We will continue to develop our solutions around customers’ compliance needs and the security intent behind the controls. As organisations adopt Essentials, our commitment is to help them meet its requirements through effective, practical security controls, supported by clear guidance and ongoing product development.