ASD Essentials is here: what should schools do with their Essential Eight work?

The new Essentials series does not make a school’s Essential Eight work redundant. It gives that work a broader context and a different way to use it.

The Essential Eight is a set of eight strategies involving prescriptive requirements with a technical focus, mostly designed for managed Windows environments. The Essentials series builds on that work with a broader framework, not just technical controls, that can be applied to different technology environments.

TL;DR: It is a more comprehensive framework and better suited to schools, but will require more work to align to.

What's changed in Essentials?

Every Essentials chapter has three layers:

• Principles describe the security outcomes an organisation aims to achieve.
• Actions describe what must be done to achieve those outcomes.
• Domains describe where that work applies.

The Essential Eight wasn't designed for cloud environments and includes a Microsoft Office macro strategy which can be too narrow for many schools.

It also expands beyond technical controls. The Enterprise IT chapter has six technical domains and two capability domains: Governance and culture and Visibility and response. Those capability domains bring leadership accountability, risk management, supplier assurance, detection and incident response into the framework.

The good news: existing work still carries forward

There are eight domains in the Enterprise IT chapter, which feels reassuringly familiar after the Essential Eight. The catch is that they are not a neat one-for-one replacement for the old eight strategies.

ASD’s transition guidance says every Essential Eight mitigation strategy maps to at least one Enterprise IT principle. Existing controls, implementation records and assessment evidence can be reused where they are current and relevant. One old strategy may contribute to several principles and actions, so the work is to map what the school already has and identify the gaps worth addressing.

Australian Cyber Security Centre head Stephanie Crowe said there was “no wasted investment” for organisations aligned with the Essential Eight. ASD’s own guidance adds the important qualification: map the existing controls and evidence, then use a gap analysis to find where they need broader coverage, stronger operation or better evidence.

Which chapters apply to schools?

There are three chapters in the Essentials: Enterprise IT, Cloud and Operational Technology, with more to come. The first two will be relevant to most schools: Enterprise IT for on-prem and hybrid environments, and Cloud for SaaS and PaaS environments. A school will commonly need to consider both over time.

For a school that has already been working through the Essential Eight, the Enterprise IT chapter is usually the natural place to begin because ASD’s transition mapping is written for that chapter. The Cloud chapter then helps the school consider SaaS platforms, where it still owns identity, data, configuration, integrations and provider assurance.

Starting with Enterprise IT and then working towards Cloud is a sensible transition path for a school that already has Essential Eight work. It is not a universal ASD requirement: the right order depends on the school’s actual environment and risk.

A transition, not a universal deadline

ASD is maintaining both the Essential Eight and Essentials during the transition. The agency has said regulatory bodies will communicate any expectations and timeframes for their sectors. There is no single ASD deadline that applies to every school, and a school’s obligations can still vary by jurisdiction, sector, contract and insurer.

The practical next step is to preserve what the school already knows: its Essential Eight position, controls, evidence, exceptions and planned uplift work. Then map that material to the Enterprise IT principles, actions and domains before deciding what should change. This keeps worthwhile work moving while making the next gaps and priorities visible.

For the detail, see ASD’s Enterprise IT chapter, Cloud chapter and transition guide.