Essential Eight out: Australia’s cyber maturity framework evolves

Background

For almost a decade, the Essential Eight has provided Australian organisations with a simplified baseline for improving cyber security. Its eight mitigation strategies cover areas including application control, patching, multi-factor authentication, restricting administrative privileges and regular backups. Organisations could assess implementation against a maturity model ranging from Maturity Level Zero to Maturity Level Three.

It has been common for management to report to the board on an organisation’s maturity level measured by the Essential Eight. It has also been a maturity framework by which external experts assess the cyber resilience of an organisation. Because of this, meeting a certain maturity level has often become a requirement to participate in particular government contracting or tender processes.

However, feedback to the AICD indicated that the Essential Eight did not translate well across different technology environments (such as cloud environments), and was not suited to changing threats and technologies. The ASD has highlighted that Australian organisations face increasingly capable malicious cyber actors, ranging from state-sponsored actors to cyber criminals and rapid advances in artificial intelligence (AI) tools.

The new framework

The Essentials aims to provide organisations with a consistent and prioritised approach to cyber security across different technology environments. Instead of a single framework applied uniformly across different technologies, it is organised into environment-specific chapters that use the same underlying model while accounting for different threats, risks and operational considerations.

The initial framework comprises three chapters: Essentials for enterprise IT, which evolves the existing Essential Eight; Essentials for operational technology, aimed at protecting operational technology environments; and Essentials for cloud, for environments delivered entirely through software-as-a-service and platform-as-a-service.

There are supplementary publications, designed to be used in tandem with the chapters to help organisations implement the new framework, including Transition from the Essential Eight.

What has changed?

Board and executive accountability

The ASD has published an Essentials overview for senior executives. Despite the title, the publication has implications for directors. It highlights how the Essentials place greater emphasis on formal executive and board-level accountability for cyber security, including oversight of organisational risk, investment and resourcing.

Rather than treating implementation as solely a technical compliance task, the Essentials prompts a board to consider whether current governance arrangements give directors sufficient visibility of cyber risk. This extends to whether management can demonstrate the effectiveness of the organisation’s most important cyber controls.

Over time, the Essentials should support more risk-focused conversations in the boardroom. A single maturity score under the Essential Eight can be easy to communicate but may conceal important differences between the protection of critical and less critical systems. The new approach should allow boards to interrogate where material exposures lie.

Outcomes focus

The Essentials also signify a shift from prescribed controls towards security outcomes, with organisations having greater flexibility to determine how they achieve the required outcomes. While the ASD continues to provide specific examples of appropriate measures, the framework is less centred on implementing the same technical controls across all organisations.

This potentially makes implementation more adaptable to organisations with different technology environments, resourcing and risk profiles. It also places greater importance on being able to demonstrate that selected controls actually achieve the intended security outcomes.

Priority phases

The Essentials have priority phases, which set out the order in which the ASD recommends the domains be addressed. This is intended to help organisations sequence technical implementation in a risk-informed manner rather than attempting to uplift the entire environment at once.

The framework prioritises identifying services and internet-facing edge devices ahead of business systems and staff laptops, reflecting the risks associated with systems that can provide pathways into organisational networks.

This reinforces the importance of understanding an organisation’s critical assets and functions, rather than viewing cyber security investment simply as an organisation-wide technology program.

Implementation

There will be a transition period rather than an immediate switch from the Essential Eight to the ASD Essentials. The ASD is maintaining both the Essential Eight and the ASD Essentials on Home | CGA , and says organisations should continue to comply with their existing regulatory requirements until relevant regulators communicate any changes.

It is worth noting that existing controls and capabilities pursued under the Essential Eight will contribute to the Essentials framework.

The Essentials overview for senior executives provides a list of questions that the ASD recommends senior executives ask when considering a proposal to implement the ASD Essentials. These questions may also assist some directors who have a heightened focus on cyber resilience, for example by virtue of sitting on a risk committee. These questions include:

• Which of our key functions and assets sit in each domain, and which domains hold the assets whose compromise would be most consequential for the organisation?
• Where does the plan depart from the ASD’s recommended sequencing, and what is the documented, risk-based justification?
• What are the anticipated disruptions to operations and user experience during implementation, and how will they be managed?