cyber risk essentials

Navigating the Transition to ASD Essentials: Key Insights for Organizations

Sam Keogh

October 19, 2026

8 MIN READ

On 15 October 2026 the Australian Signals Directorate launched the first three chapters of ASD Essentials, a new framework to help organisations build cyber resilience. The chapters cover enterprise IT, operational technology and cloud. iTnews reported that ASD is replacing the Essential Eight with it, "a principles-based framework", and that it will likely take a year or two to become the new standard. Cyber Daily describes the same launch as an expansion of the Essential Eight. The two outlets frame it differently, but both report that the Essential Eight stays available on cyber.gov.au during the transition, and iTnews adds that government agencies will be assessed against both next year.

I was lucky enough to be at the AISA Cyber Conference and had the opportunity to listen to Jayden Cooke walk through the Essentials and how they came to be.

Most of the early commentary will be about what the framework asks organisations to do, and that was the takeaway for CyQuantiFi. According to iTnews, "ASD Essentials does not sum up an organisation's security in a single rating, as the Essential Eight does." Under the Essential Eight an organisation is rated from Maturity Level Zero to Three. Under Essentials it reports area by area, such as identity services or internet-facing systems, with effectiveness ratings backed by evidence like independent testing and simulated exercises.

That is a more honest way to describe security. It also removes the one-line answer that boards, executives and auditors have been given. So what replaces it, and what happens in the areas where evidence is hard to produce?

A maturity level was never a risk number

It is worth being fair to the old model. "We are at Maturity Level Two" was easy to say, easy to compare and easy to put in a board pack. It also answered a question nobody had actually asked. A maturity level tells you how completely a set of controls has been implemented. It does not tell you what you would lose in a bad year, which systems carry that loss, or how confident anyone is in the estimate.

ASD's own wording points the same way. iTnews reports that ASD said the framework's priority phases are not maturity ratings, and that reaching a phase "describes implementation scope, not how secure the organisation is". Read that sentence twice. Progress through the framework and how secure you are are being kept apart.

For anyone who has sat in a room where a green rating was used to close a conversation, that is welcome. It is also a gap. When the single rating goes, someone still has to answer the board's question, which was never "what level are we?" It was "how much could this cost us, and are we spending in the right place?" We made a similar point about controls that look fine on paper in It wasn't an attack. That's why your risk register is wrong. An asserted control and a validated control are different things, and a rating can't tell them apart.

Evidence is the new currency

Under the new approach, an organisation's overall posture is expressed through effectiveness ratings "backed by evidence", and iTnews lists independent testing and simulated exercises as examples. That is the right instinct. A rating nobody can check is an opinion with a colour on it.

The difficulty is where those ratings are easiest and hardest to earn. Identity services, internet-facing systems and enterprise laptops can be tested, probed and exercised. An independent tester can be given a scope and a fortnight. The evidence builds up, and the rating means something.

Now take the second of the three chapters. Cyber Daily reports that the OT guidance targets critical infrastructure operators. What follows is our own argument, not something ASD or the reporting says. Those operators, in our experience, run control systems where active scanning can disrupt a live process, air-gapped enclaves with no network path for a tool, and legacy platforms that cannot run modern tooling at all. Independent testing on those assets is constrained, slow or simply not allowed. Simulated exercises help, but they exercise people and procedures more than they exercise the asset.

Illustrative only: the areas and statuses above are examples, not ASD's categories.

The result is predictable. An area-by-area report will be rich in evidence for the parts of the estate that were already easy to measure, and thin where the consequence of failure is highest. A report like that is not wrong, but it can mislead by omission. Thin evidence will read as a low rating, or as a blank, and neither one is the same as low consequence.

Area by area doesn't add up to a total

There is a second problem, and it is structural. Area-by-area ratings cannot be summed. Five areas rated "effective" and one rated "partially effective" do not average to a number a board can budget against, because the areas are not independent. They share vendors, credentials, network paths and administrators.

ASD's priorities are consistent with this. According to iTnews, identity services and the edge devices that connect networks to the internet come first, ahead of business systems and staff laptops. Stephanie Crowe, head of the Australian Cyber Security Centre, is quoted on edge devices: "So if those devices aren't secure, you're allowing threat actors into the network quite easily". Her point is about entry. The same logic applies to anything shared: a failure in identity or at the edge does not stay in one area.

That is the difference between risk by area and risk across an environment. If two systems depend on the same identity provider, or the same appliance at the perimeter, a bad day for one is more likely to be a bad day for both. Treat them as independent and the worst year in your model comes out smaller than the worst year you could actually have. Our recent piece on legacy systems made the same case for retained systems that share a vendor or a network path.

A fair objection is that Essentials is a security framework, not a risk model, and that is true. ASD is not asking anyone to produce a dollar figure. Boards will, though, and iTnews reports that the framework itself calls for executive and board-level accountability to be formally defined. Accountability needs something to be accountable for, and "effective" across six areas is not a number anyone can hold, budget against or defend to a regulator.

What a board is told	What it tells you	What it leaves out
Essential Eight maturity level (Zero to Three)	How completely a set of controls has been implemented	What the gap costs, and where it concentrates
ASD Essentials, area by area, evidence-backed	How effective each area is, and how well that is proven	How the areas move together, and what to do where evidence is thin
A dollar range for the whole estate	What a bad year costs, how confident the estimate is, which dependencies drive it	Nothing, if the inputs and assumptions are shown

What a defensible number looks like where you can't test

A number only helps if it survives a hard question. For assets with no telemetry, that means three things.

First, the input has to come from people who know the system, collected in a structured way and not as one confident estimate from the loudest voice in the room. A range from three operators who maintain the asset is better evidence than a single score from someone who has never seen it. Second, the estimates need calibration, so the organisation learns over time whose judgement has held up. Third, every figure has to carry its assumptions, its confidence and its evidence grade, so a reader can see the difference between a number that rests on a test and one that rests on expert judgement.

That third point connects straight back to ASD Essentials. If effectiveness ratings are meant to be backed by evidence, then expert judgement, properly collected and graded, belongs on the evidence scale. It sits below an independent test and above an unsupported assertion. Labelling it honestly is more defensible than leaving the cell blank or, worse, filling it with a colour.

A dollar range does not replace the Essentials. It answers the question the Essentials deliberately do not: how much does this matter if it goes wrong?

Five things to do this quarter

Check your Essential Eight results against the Essentials, don't assume they carry over

iTnews quotes Crowe saying existing control maturity counts towards the new framework, and reports that ASD's guidance tells organisations to check those controls against Essentials "rather than assume they are equivalent". Start with the transition guide when you have it.

List your areas and grade the evidence behind each one

For every area, mark whether the rating rests on an independent test, a simulated exercise, expert judgement or nothing yet. Be blunt about the "nothing yet" column. It is usually the OT, legacy and classified estate.

Put a range on the areas you can't test

For each consequential area with thin evidence, ask the two or three people who know it for a minimum, a most likely and a maximum annual loss. Record who answered and why they are credible. If the list of people is one person, that is a finding.

Name your shared dependencies and model them together

Identity services and edge devices first, since ASD puts them first, then vendors, administrators and network paths. Anything several systems rely on should be priced as a group, not once per system.

Decide who owns the number, and what the board will be told

iTnews reports that Essentials asks organisations to formally define executive and board-level accountability for cyber security. Agree now what the one-line answer will be once there is no single rating to quote.

The bottom line

ASD has done something uncomfortable and sensible. It is moving away from a single rating that was easy to quote and easy to misread, and toward reporting that has to be evidenced. ASD says investment in the Essential Eight is not wasted, though controls should be checked rather than assumed equivalent, and the transition looks set to run for a year or two. There is time to prepare.

The risk is in how that time gets used. If the replacement for a single rating is a larger spreadsheet of area-by-area ratings, boards will end up with more detail and no more clarity. The areas that are hardest to test will carry the thinnest evidence, and the areas that share dependencies will be reported as though they stood alone.

The organisations that handle this well will treat Essentials as the evidence layer and put a calibrated dollar range on top of it, including for the assets nobody can scan. That gives a board a number it can budget against, an auditor a trail it can follow, and an operator an honest account of where the evidence is thin.

Crowe is quoted by iTnews putting the stakes plainly: "Every organisation that's connected to the internet is at risk." The same is true of organisations that think they are not connected. The air gap, the isolated enclave and the unpatched controller are still risks, and they still need a figure someone is willing to sign.

A rating tells you where you are on the ladder. A number tells you what the fall costs.