The Essential Eight Has Evolved: What ASD Essentials Means for Australian Businesses

ASD Essentials is structured around three layers:

1. Principles describe the cyber security outcomes an organisation should achieve.

2. Actions describe what needs to be done to achieve those outcomes.

3. Domains describe the systems, functions and assets where those actions apply.

The initial series contains environment-specific chapters for:

• Enterprise Information Technology
• Cloud environments
• Operational technology

An organisation may need one chapter or several, depending on how its systems and services are delivered. For example, a business may need to consider both the enterprise Information Technology chapter for its devices and network, and the cloud chapter for Microsoft 365 and other software-as-a-service applications.

Although some chapters are written primarily for larger or more complex environments, ASD explicitly states that small and medium-sized businesses can use the guidance where relevant. The difference may be that more responsibility for implementation, operation and evidence sits with managed service providers and technology vendors.

The Essential Eight focused on eight prioritised mitigation strategies, including patching, Multi-Factor Authentication, restricting administrative privileges and regular backups.

These controls remain important. However, ASD Essentials takes a wider, outcome-focused approach. It examines security across domains that group together systems and functions with similar risks.

For enterprise Information Technology, the eight domains are:

1. Governance and culture
2. Visibility and response
3. Boundary services
4. Identity services
5. Critical processes and services
6. Privileged environments
7. Business systems
8. User devices

The framework also recommends a sequence for implementation.

Priority phase one addresses boundary services and identity services.

Priority phase two addresses critical processes and services, together with privileged environments.

Priority phase three addresses business systems and user devices.

Governance and culture, along with visibility and response, operate across every phase. These phases are not maturity ratings or certificates of compliance. They are a recommended sequence for reducing risk.

An organisation cannot simply say that it has “completed phase two” and assume that it is secure. ASD expects organisations to assess whether actions are effective, supported by evidence and consistently applied within each relevant domain.

ASD Essentials places stronger emphasis on leadership accountability. Cyber security is not positioned as a technical project owned only by the Information Technology team. It requires executive oversight, appropriate investment, defined risk appetite, clear accountability and sustained resourcing.

Senior leaders should expect reporting that explains:

• Which domains and assets have been assessed
• Where controls are effective
• Where material gaps remain
• What remediation is underway
• Which risks have been accepted
• What has not been assessed
• How control effectiveness has been validated
• What ongoing resources are required

ASD also makes clear that implementation is not a one-time project. Security controls need to be monitored, reassessed and improved as technology, business operations and threat behaviour change.

This provides executives with a more useful view than a single security score or a monthly report listing closed support tickets.

No vendor or managed service provider can make an organisation compliant simply by installing one product. However, Arrow’s security, device-management and managed Information Technology services can support many of the practical outcomes described within ASD Essentials.

1. Governance and culture

The Governance and culture domain includes executive accountability, security risk management, sufficient resourcing, supplier assurance and regular cyber security awareness training.

Arrow can help clients establish a current-state baseline, review Microsoft 365 security posture, identify risk, create a prioritised improvement roadmap and deliver clearer executive reporting.

Arrow’s security awareness program, powered by Huntress, provides ongoing training and realistic phishing simulations based on current attacker techniques. Huntress manages learning programs, phishing campaigns, reminders and reporting, helping organisations maintain awareness rather than relying on a once-a-year training exercise.

2. Visibility and response

ASD Essentials expects organisations to identify security events, triage alerts, use signals from identities, applications, data and infrastructure, and follow documented incident-response procedures.

Arrow’s managed security services are supported by Huntress and its 24/7 Security Operations Centre. This can include:

• Managed Endpoint Detection and Response (EDR)
• Managed Identity Threat Detection and Response (ITDR)
• Managed Security Information and Event Management (SIEM)
• Investigation and triage of suspicious activity
• Threat containment and remediation guidance
• Security logging and reporting

Huntress Managed EDR monitors Windows, macOS and Linux endpoints, while Managed ITDR focuses on identity threats such as credential theft, account takeover, session hijacking, malicious inbox rules and rogue applications. Huntress

Managed SIEM can bring together signals from Microsoft 365, Microsoft Entra, Microsoft Defender, Azure and other sources, helping organisations identify suspicious activity and retain searchable logs for investigation, audit and compliance purposes.

3. Boundary services and identity services

ASD places boundary services and identity services in priority phase one because they are common initial entry points for attackers.

Boundary services include internet-facing systems, edge devices, integrations and gateways.

Identity services include directories, authentication systems, credentials and access controls.

Arrow can assist through:

• Managed network and firewall services
• Microsoft 365 and Microsoft Entra security configuration
• Multi-Factor Authentication and access-policy reviews
• Huntress Managed ITDR
• External exposure and vulnerability reviews
• Penetration testing
• Monitoring of suspicious authentication and identity activity

Arrow Pen Testing, powered by ZIRILIO, can test infrastructure, web applications, wireless networks and other attack surfaces, providing prioritised findings and remediation validation.

4. User devices and business systems

Laptops, desktops, applications and everyday business platforms are frequent entry points for attackers. Arrow DeviceShield, powered by Devicie, helps businesses deploy, manage, patch and secure devices through Microsoft Intune.

Its capabilities include:

• Application and operating-system patching
• Application control
• Microsoft Office security policies
• User-application hardening
• Rstrictions on administrative privileges
• Device inventory and compliance reporting
• Automated policy enforcement
• Zero-touch deployment

These capabilities support several control areas that organisations may already have implemented under the Essential Eight, while also providing the ongoing visibility and evidence required under the broader ASD Essentials model.

Huntress Managed EDR adds continuous detection and response across protected endpoints, helping identify threats that may bypass preventative controls.

5. Critical processes, recovery and operational resilience

Protecting systems is only part of the requirement. Organisations also need to understand which services are critical, prepare for disruption and ensure that business data and systems can be restored.

Arrow’s backup, business continuity and disaster-recovery services can protect servers, Microsoft 365 data and other critical systems, with options for frequent backup, restoration and cloud-based recovery.

Incident-response planning, recovery testing and clear ownership are also important for demonstrating that the organisation can respond when preventative controls fail.

For organisations that rely heavily on Microsoft 365 and other cloud platforms, the ASD Essentials for cloud chapter may be particularly relevant.

It focuses on responsibilities such as:

• Identity and access
• Data protection
• Cloud configuration
• Applications and integrations
• Provider assurance
• Monitoring and response

ASD notes that the existence of a provider capability is not enough. The organisation remains responsible for ensuring that the capability has been enabled, correctly configured and consistently operated.

This is an important distinction.

A business may already own Microsoft security capability through its licence but may not have the internal time or expertise to configure, monitor and maintain it effectively.

Arrow manages and optimises Microsoft 365 environments and guarantees that Microsoft Secure Score will exceed 70% within the first 90 days across its service packages. That Secure Score uplift can provide a useful Microsoft-specific measure of improvement, but it should not be confused with a complete ASD Essentials assessment.

Arrow’s recommended approach would generally involve five stages.

1. Select the applicable chapters and scope. Determine whether enterprise Information Technology, cloud, operational technology or a combination applies to the organisation.

Identify the business functions, systems, identities, devices and services that need to be assessed.

2. Establish the current-state baseline. Review existing Essential Eight investment, Microsoft 365 configuration, identity controls, endpoint protection, network exposure, backups, training and monitoring.

Document existing evidence rather than assuming that a control is effective because it has been purchased or deployed.

3. Identify and prioritise gaps. Map current controls against the relevant ASD Essentials principles, actions and domains.

Prioritise identity services and boundary services where appropriate, while addressing governance and monitoring requirements across the full program.

4. Implement and validate controls. Deploy or strengthen the required controls.

Use reporting, technical testing, phishing simulations, backup testing and penetration testing to validate that the controls are operating effectively.

5. Report, sustain and improve. Provide executives with regular reporting on assessed posture, gaps, remediation progress and accepted risks.

Reassess the environment as systems, suppliers, business functions and threats change.

The ASD assessment guide follows a similar structure of planning, scope approval, assessment, evidence collection, aggregation and reporting.

It is important to position ASD Essentials accurately. The framework does not replace specific legal, regulatory or contractual obligations that may apply to an organisation.

It is also not a product certification.

Arrow can help an organisation assess its current position, implement relevant controls, collect evidence and sustain the required security capabilities. Where formal independent assurance or regulatory compliance is required, the scope and assessment method need to reflect those specific obligations.

The first step is understanding what you already have.

Many organisations have invested in Microsoft 365, endpoint security, backup and Essential Eight controls. The opportunity is to determine:

• What remains effective
• Where coverage is incomplete
• Whether the controls are consistently operated
• What evidence exists
• Which domains require attention first
• What executives should be receiving in regular reporting

Arrow can help create that baseline and develop a practical roadmap using existing investments wherever possible.