The Australian Signals Directorate (ASD) has launched ASD Essentials, a new cybersecurity framework that replaces its nearly decade-old Essential Eight guidance with a more flexible, risk-based approach.

First released in 2017, the Essential Eight outlined eight key security practices, including application and operating system patching, multi-factor authentication and restricting administrative privileges, to help organisations strengthen their cyber defences.

However, the growing complexity of cloud computing, artificial intelligence (AI) and other technologies has made cybersecurity increasingly challenging, prompting the ASD to acknowledge the limitations of “prescriptive technical controls” and consult on how to expand its guidance.

The resulting ASD Essentials framework organises security guidance into chapters focused initially on enterprise IT, operational technology and cloud.

Rather than prescribing a fixed set of technical controls, it gives organisations greater flexibility in how they achieve security outcomes and prioritise improvements across different areas of their operations.

Each chapter of the new framework, whose creation was flagged earlier this year as the ASD worked to modernise its widely adopted Essential Eight, takes a “consistent and prioritised approach” to cyber security built around principles, actions, and domains.

Principles, the ASD explained, describe the cybersecurity outcomes that an organisation should achieve, with guidance drawn from existing cybersecurity principles outlined in the ASD’s Information Security Manual and aligned with its Modern Defensible Architecture.

Actions, many of which are mapped against known attack techniques mapped in the MITRE ATT&CK database, describe what needs to be done to achieve those outcomes.

Domains are the business functions and assets to which the actions apply and are grouped by similar risk, an approach the ASD says will help “focus security efforts where they will deliver the greatest reduction in risk” – with separate maturity ratings for each area.

“Good cyber security does not have to be complicated,” ACSC head Stephanie Crowe said, calling the new guidelines “practical, prioritised guidance that Australian organisations can use to reduce risk, protect critical systems and strengthen their defences against real-world threats.”

Protecting the forest, not just the trees

The new guidelines comes amidst industry warnings that AI-powered cyberattacks have rewritten the rules of cybersecurity engagement.

Speaking to this month’s CyberCon Melbourne 2026 conference, AISA director Dr Rajiv Shah cited Elastic research that identified “a serious imbalance” in cybersecurity, with just 14 per cent of Australian firms saying they can respond to AI-driven attacks “at machine speed.”

With cyberattacks “becoming faster and more sophisticated,” he said, “good cyber hygiene remains our first line of defence [but] we need to focus on what businesses can do to reduce their exposure and strengthen their ability to respond.”

Critically, he added, business leaders need to be actively engaged with cybersecurity efforts – a point that the ASD has echoed in releasing specific guidelines to help senior business executives understand ASD Essentials and how they can facilitate its adoption.

Yet for all its work to complement technical guidance with more specific risk management, Dr Prins Ralston, CEO of the Australian Computer Society (ACS), warned the success of the “overdue” new guidelines “would only be as good as the people carrying it out.”

And those people are in short supply – the government’s Infosec Registered Assessors Program (IRAP) has over 400 registered cybersecurity assessors but they are focused on governments and big businesses, leaving smaller companies looking elsewhere.

Businesses, Ralston said, will struggle to apply the new guidelines meaningfully unless they can also access people with the right skills and demonstrable certifications that show their assessment is actually meaningful.

“For nine years [using the Essential Eight],” he said, “the question was simple: did you tick the box? Now the question is whether your security actually works… that is a better question but someone has to answer it.”

“ASD makes clear that assessments rely on expert judgement, but judgement doesn’t work… unless the people making the call are held to a standard.”

“Get this wrong and boards will be handed reports full of ‘fully effective’ ratings that nobody can stand behind.”

Essentials is not for small businesses

Designed for government bodies, critical infrastructure owners and big businesses, ASD Essentials offers little guidance for the small and medium businesses (SMEs) that make up the majority of businesses in Australia, and are regularly targeted by cybercriminals.

Questions of whether cybersecurity requirements are too onerous for small businesses were floated during recent House Select Committee hearings, where Home Affairs and ASD officials highlighted their SMB-focused work to date.

Home Affairs, for one, offers SMB-focused tools like Cyber Health Check and recently held an online town hall about CyberSmart, a program it says “will make cybersecurity certification simple, affordable and accessible” – including a certification scheme and Cyber Trust Mark.

Around 150,000 business members currently subscribe to the ASD’s Cyber Security Partnership Program, Crowe told the committee, noting that the ASD responded to 220 small business cyber incidents last year alone.

Yet small businesses are less likely than major enterprises to engage directly with government around cybersecurity, officials told the committee, creating a different dynamic that requires government to support lawyers, accountants and other SMB service providers.

The ASD is also working to simplify its cybersecurity advice for small business: this month, for example, it published a Small Business Cyber Security Handbook that prioritises four main actions: multi-factor authentication, rapid updates, regular backups, and staff training.