ASD Essentials for enterprise IT: the first chapter is now live

Grounded in the ISM

ASD has confirmed the Essentials guidance is grounded in the Information Security Manual (ISM). The chapter inherits the ISM's threat-informed mitigation philosophy but packages it into prioritised, practical guidance for contemporary enterprise environments.

Outcome-focused, not checkbox-driven

The Essential Eight was built around prescriptive controls and specific technologies. The enterprise IT chapter moves toward an outcomes-focused approach, giving organisations flexibility to achieve security objectives using the technologies and architectures that best suit their environment.

Practical tools and implementation guidance

ASD has stated the new Essentials guidance offers prioritised, threat-informed mitigations supported by practical tools and clear implementation guidance. The intent is to make the framework easier to operationalise than the current maturity-level self-assessment process.

Designed for enterprise scale

The chapter addresses enterprise-scale environments with thousands of endpoints, federated identity, multiple business units and complex change-management environments. Today's ML2 and ML3 guidance was sometimes difficult to scale operationally. The new chapter gives organisations clearer accountability for outcomes.

Existing controls carry over

ASD has explicitly stated that organisations already using the Essential Eight can expect strong alignment with their existing controls and investments. Your MFA deployment, patch management, backup strategy and application control work all remain directly relevant.

New adopters benefit too

New adopters will benefit from established best-practice guidance. The chapter does not raise the barrier to entry. It restructures the guidance so it is clearer and more adaptable to modern architectures.

Procurement and insurance still reference E8

Contracts, procurement and insurance questionnaires still reference the Essential Eight. ASD says to keep meeting those obligations during the transition. Plan for both frameworks being referenced simultaneously during the transition.

SMB1001 maps cleanly

SMB1001 is a separate standard from Dynamic Standards International, and the Essentials release does not change it. The controls behind SMB1001 overlap heavily with the Essential Eight, so the work still counts.

Identity as a first-class layer

Identity (Entra ID, Okta) has become the new perimeter. The chapter improves identity controls beyond the current MFA strategy, covering conditional access, identity threat detection and response (ITDR), and privileged access management (PAM) as core expectations.

Cloud-first operational reality

Today's Essential Eight assumes Windows server fleets and on-premises Active Directory in many places. The chapter acknowledges that most Australian organisations now operate Microsoft 365, Intune-managed endpoints and SaaS-first architectures. ASD's Chris Horlyck told iTnews: 'Essential Eight started before cloud was really a big thing in the sector.'

Outcome-based measurement

Likely shift from prescriptive maturity-level checkboxes toward outcome statements that organisations can demonstrate they have achieved. Reduces tick-box behaviour, increases the requirement for operational evidence. ASD acknowledged that maturity level requirements shifted under organisations' feet, creating the impression of going backwards without actual deterioration.

Influenced by Modern Defensible Architecture

ASD's Modern Defensible Architecture publication is a key influence on the series. It emphasises defence in depth and protecting crown jewels rather than a thin perimeter layer. The chapter carries this philosophy forward.

Identity services

Manages identities, credentials and access, including directories, authentication and authorisation services. Compromise gives an adversary persistent or privileged access across the environment and undermines controls that rely on trusted identities.

Boundary services

Gateways and access at network boundaries that manage connectivity between environments of different trust levels, including internet-facing services and edge devices. These systems are routinely exposed to adversary scanning and exploitation.

Critical processes and services

The core processes and services needed to deliver an organisation's primary outcomes. Malicious actors targeting this domain typically pursue disruption or theft. These assets attract the most capable and deliberate adversary activity.

Privileged environments

Systems, services and accounts that support privileged activities and high-impact administrative functions. Compromise gives an adversary extensive control over systems, services and security controls, making detection and containment more difficult.

Business systems

Supporting enterprise functions that enable day-to-day operations. Compromise can disrupt operations and provide pathways to more sensitive or critical systems.

User devices

Endpoints people use, including workstations. Their widespread use and connection to other systems make them pathways for compromise. Protecting them at scale reduces the impact of everyday activity and adversary movement.

Governance and culture (capability)

Policies, risk management processes, roles and security culture that support the cyber security program. Applies across all priority phases. Helps establish clear ownership, accountability and consistent security decision-making.

Visibility and response (capability)

Processes and capabilities used to detect, analyse and respond to cyber security events and incidents. Applies across all priority phases. Effective visibility and response reduces delays in identifying, analysing and containing intrusions.

Continue your Essential Eight programme

Do not pause MFA rollout, patching cycles, backup testing or admin privilege restriction. The mitigation strategies behind the Essential Eight remain best practice and form the foundation of the enterprise IT chapter.

Document current maturity with evidence

Have a current, written ML self-assessment with evidence per control. Most organisations have a verbal understanding of where they sit. Write it down. The successor framework will refer back to today's maturity model for transition purposes.

Move identity to the centre

Whatever the final guidance says, identity will be elevated. Enforce conditional access, deploy ITDR, document privileged access procedures and rationalise admin accounts. This is the area that pays back most.

Build outcome evidence, not just configuration evidence

Start logging the outcomes the framework is likely to ask for: credential-stuffing attempts blocked per quarter, mean time to patch by criticality, percentage of admin actions from PAW devices, percentage of OT assets visible to your inventory.

Clean up your backup posture

Backups remain critical. Verify the 3-2-1 minimum, test restorations quarterly, document RTO and RPO per system, and confirm Microsoft 365 backups are in place. The new guidance is likely to be stricter on testing.

Get a gap assessment

A no-obligation baseline across all eight controls tells you where you stand today, what it takes to reach your target maturity level, and which quick wins move the needle most for cyber insurance, tenders and procurement.