On 15 October 2026 the Australian Signals Directorate launched the first three chapters of ASD Essentials, a new framework to help organisations build cyber resilience. The chapters cover enterprise IT, operational technology and cloud. iTnews reported that ASD is replacing the Essential Eight with it, "a principles-based framework", and that it will likely take a year or two to become the new standard. Cyber Daily describes the same launch as an expansion of the Essential Eight. The two outlets frame it differently, but both report that the Essential Eight stays available on cyber.gov.au during the transition, and iTnews adds that government agencies will be assessed against both next year.
I was lucky enough to be at the AISA Cyber Conference and had the opportunity to listen to Jayden Cooke walk through the Essentials and how they came to be.
Most of the early commentary will be about what the framework asks organisations to do, and that was the takeaway for CyQuantiFi. According to iTnews, "ASD Essentials does not sum up an organisation's security in a single rating, as the Essential Eight does." Under the Essential Eight an organisation is rated from Maturity Level Zero to Three. Under Essentials it reports area by area, such as identity services or internet-facing systems, with effectiveness ratings backed by evidence like independent testing and simulated exercises.
That is a more honest way to describe security. It also removes the one-line answer that boards, executives and auditors have been given. So what replaces it, and what happens in the areas where evidence is hard to produce?
It is worth being fair to the old model. "We are at Maturity Level Two" was easy to say, easy to compare and easy to put in a board pack. It also answered a question nobody had actually asked. A maturity level tells you how completely a set of controls has been implemented. It does not tell you what you would lose in a bad year, which systems carry that loss, or how confident anyone is in the estimate.
ASD's own wording points the same way. iTnews reports that ASD said the framework's priority phases are not maturity ratings, and that reaching a phase "describes implementation scope, not how secure the organisation is". Read that sentence twice. Progress through the framework and how secure you are are being kept apart.
For anyone who has sat in a room where a green rating was used to close a conversation, that is welcome. It is also a gap. When the single rating goes, someone still has to answer the board's question, which was never "what level are we?" It was "how much could this cost us, and are we spending in the right place?" We made a similar point about controls that look fine on paper in It wasn't an attack. That's why your risk register is wrong. An asserted control and a validated control are different things, and a rating can't tell them apart.
Under the new approach, an organisation's overall posture is expressed through effectiveness ratings "backed by evidence", and iTnews lists independent testing and simulated exercises as examples. That is the right instinct. A rating nobody can check is an opinion with a colour on it.
The difficulty is where those ratings are easiest and hardest to earn. Identity services, internet-facing systems and enterprise laptops can be tested, probed and exercised. An independent tester can be given a scope and a fortnight. The evidence builds up, and the rating means something.
Now take the second of the three chapters. Cyber Daily reports that the OT guidance targets critical infrastructure operators. What follows is our own argument, not something ASD or the reporting says. Those operators, in our experience, run control systems where active scanning can disrupt a live process, air-gapped enclaves with no network path for a tool, and legacy platforms that cannot run modern tooling at all. Independent testing on those assets is constrained, slow or simply not allowed. Simulated exercises help, but they exercise people and procedures more than they exercise the asset.
Illustrative only: the areas and statuses above are examples, not ASD's categories.
The result is predictable. An area-by-area report will be rich in evidence for the parts of the estate that were already easy to measure, and thin where the consequence of failure is highest. A report like that is not wrong, but it can mislead by omission. Thin evidence will read as a low rating, or as a blank, and neither one is the same as low consequence.
There is a second problem, and it is structural. Area-by-area ratings cannot be summed. Five areas rated "effective" and one rated "partially effective" do not average to a number a board can budget against, because the areas are not independent. They share vendors, credentials, network paths and administrators.
ASD's priorities are consistent with this. According to iTnews, identity services and the edge devices that connect networks to the internet come first, ahead of business systems and staff laptops. Stephanie Crowe, head of the Australian Cyber Security Centre, is quoted on edge devices: "So if those devices aren't secure, you're allowing threat actors into the network quite easily". Her point is about entry. The same logic applies to anything shared: a failure in identity or at the edge does not stay in one area.
That is the difference between risk by area and risk across an environment. If two systems depend on the same identity provider, or the same appliance at the perimeter, a bad day for one is more likely to be a bad day for both. Treat them as independent and the worst year in your model comes out smaller than the worst year you could actually have. Our recent piece on legacy systems made the same case for retained systems that share a vendor or a network path.
A fair objection is that Essentials is a security framework, not a risk model, and that is true. ASD is not asking anyone to produce a dollar figure. Boards will, though, and iTnews reports that the framework itself calls for executive and board-level accountability to be formally defined. Accountability needs something to be accountable for, and "effective" across six areas is not a number anyone can hold, budget against or defend to a regulator.
| What a board is told | What it tells you | What it leaves out |
|---|---|---|
| Essential Eight maturity level (Zero to Three) | How completely a set of controls has been implemented | What the gap costs, and where it concentrates |
| ASD Essentials, area by area, evidence-backed | How effective each area is, and how well that is proven | How the areas move together, and what to do where evidence is thin |
| A dollar range for the whole estate | What a bad year costs, how confident the estimate is, which dependencies drive it | Nothing, if the inputs and assumptions are shown |
A number only helps if it survives a hard question. For assets with no telemetry, that means three things.
First, the input has to come from people who know the system, collected in a structured way and not as one confident estimate from the loudest voice in the room. A range from three operators who maintain the asset is better evidence than a single score from someone who has never seen it. Second, the estimates need calibration, so the organisation learns over time whose judgement has held up. Third, every figure has to carry its assumptions, its confidence and its evidence grade, so a reader can see the difference between a number that rests on a test and one that rests on expert judgement.
That third point connects straight back to ASD Essentials. If effectiveness ratings are meant to be backed by evidence, then expert judgement, properly collected and graded, belongs on the evidence scale. It sits below an independent test and above an unsupported assertion. Labelling it honestly is more defensible than leaving the cell blank or, worse, filling it with a colour.
A dollar range does not replace the Essentials. It answers the question the Essentials deliberately do not: how much does this matter if it goes wrong?
iTnews quotes Crowe saying existing control maturity counts towards the new framework, and reports that ASD's guidance tells organisations to check those controls against Essentials "rather than assume they are equivalent". Start with the transition guide when you have it.
For every area, mark whether the rating rests on an independent test, a simulated exercise, expert judgement or nothing yet. Be blunt about the "nothing yet" column. It is usually the OT, legacy and classified estate.
For each consequential area with thin evidence, ask the two or three people who know it for a minimum, a most likely and a maximum annual loss. Record who answered and why they are credible. If the list of people is one person, that is a finding.
Identity services and edge devices first, since ASD puts them first, then vendors, administrators and network paths. Anything several systems rely on should be priced as a group, not once per system.
iTnews reports that Essentials asks organisations to formally define executive and board-level accountability for cyber security. Agree now what the one-line answer will be once there is no single rating to quote.
ASD has done something uncomfortable and sensible. It is moving away from a single rating that was easy to quote and easy to misread, and toward reporting that has to be evidenced. ASD says investment in the Essential Eight is not wasted, though controls should be checked rather than assumed equivalent, and the transition looks set to run for a year or two. There is time to prepare.
The risk is in how that time gets used. If the replacement for a single rating is a larger spreadsheet of area-by-area ratings, boards will end up with more detail and no more clarity. The areas that are hardest to test will carry the thinnest evidence, and the areas that share dependencies will be reported as though they stood alone.
The organisations that handle this well will treat Essentials as the evidence layer and put a calibrated dollar range on top of it, including for the assets nobody can scan. That gives a board a number it can budget against, an auditor a trail it can follow, and an operator an honest account of where the evidence is thin.
Crowe is quoted by iTnews putting the stakes plainly: "Every organisation that's connected to the internet is at risk." The same is true of organisations that think they are not connected. The air gap, the isolated enclave and the unpatched controller are still risks, and they still need a figure someone is willing to sign.
A rating tells you where you are on the ladder. A number tells you what the fall costs.
We'll put a number on it in 30 minutes, and show you how it would sit beside an evidence-backed rating.