The Australian Signals Directorate has published the Essentials, a new cyber security framework that replaces the Essential Eight. Many organisations have used the Essential Eight as their baseline since 2017. The new guidance is built to flex with the systems you run, rather than one checklist for everyone.
What is different
The Essential Eight named a fixed set of practices. Those included patching applications and operating systems, using multi-factor authentication, and limiting administrator access. The Essentials groups its guidance into chapters. The first chapters cover enterprise IT, operational technology and cloud.
Each chapter is organised around the outcome you need, the actions that get you there, and the part of the business those actions apply to. Maturity can differ from one area to another, so you can put effort where a gap would matter most.
Who it is for
The Essentials is written mainly for government, critical infrastructure and larger businesses. It is not a small-business checklist. Smaller organisations still have simpler advice from ASD: multi-factor authentication, installing updates quickly, keeping backups, and training staff.
What to do now
If the Essential Eight is the baseline you use today, keep improving those controls. They still reduce risk. Read the Essentials on cyber.gov.au and match the chapter to your systems before you change the plan.
Key points
- The Essentials replace the Essential Eight with guidance you can shape to your systems.
- The first chapters cover enterprise IT, operational technology and cloud.
- Keep the controls you already rely on, and read the official page before you reset your plan.
Need help applying this to your organisation? Talk to Cybervisory.