ASD shifts cyber security framework from maturity scores to evidence

The Australian Signals Directorate (ASD) has issued its replacement for the Essential Eight, changing how organisations assess cyber security. Called ASD Essentials, the framework measures effectiveness across separate security areas rather than combining performance into one maturity score. It will likely become the new standard in a year or two.

Organisations must substantiate their effectiveness ratings with evidence, which can include independent testing or simulated exercises. ASD said the framework’s implementation phases describe how much has been put in place, rather than how secure an organisation is.

Australian Cyber Security Centre head Stephanie Crowe said government policy agencies were working on the regulatory transition timetable, with that work expected to run over the next year or two. Mandatory adoption has no settled deadline, and ASD will keep both frameworks on its website during the transition.

Crowe said organisations’ existing Essential Eight investments would count towards the replacement. ASD nevertheless advises them to check their controls against the new framework, not presume equivalence. Transition guidance accompanies ASD Essentials, and workshops are planned.

The framework specifies desired outcomes while allowing organisations to choose their methods. Crowe said identity services and devices connecting networks to the internet take priority over business systems and employee laptops. Its initial coverage includes enterprise IT, cloud and operational technology, with organisations also required to formally establish cyber security accountability for executives and boards.