Is ASD Essential 8 Mandatory in Australia
Cybersecurity is a non-negotiable aspect of doing business in the modern world – and for Australian businesses, the Australian Signals Directorate (ASD) Essential 8 framework is a benchmark for best practices in cyber defence. Yet there remains confusion over whether adherence to this protocol is a recommendation or a regulatory must. This post sets out to clarify the status of the ASD Essential 8 for Australian businesses and compliance professionals, detailing why and how to integrate these practices into your cybersecurity strategy.
So Is It Actually Mandatory? The Short Answer
It depends entirely on who you are, and the answer splits three ways.
Australian Government non-corporate Commonwealth entities: yes. Essential Eight Maturity Level 2 is a mandatory requirement under the Protective Security Policy Framework. Not “recommended”, not “should consider”. Required, and reported on.
State government, depending on the state: usually yes, in their own words. In Queensland, Information Standard 18 (IS18:2018) requires departments to meet the ASD Essential Eight alongside an ISO 27001 based information security management system, with the accountable officer attesting to compliance annually by 30 September. Other jurisdictions have their own equivalents.
Private business: no, and it keeps turning up anyway. There is no Australian law requiring a private company to implement the Essential Eight. What there is instead is a set of commercial pressures that produce the same outcome:
- Government and defence supply chains. If your customer is a department that has to meet the Essential Eight, that obligation flows into your contract. It is faster for them to push the requirement down than to assess you from first principles.
- DISP membership. Defence Industry Security Program requirements pull the Essential Eight in for companies working with Defence.
- Cyber insurance. Renewal questionnaires now ask for a maturity level rather than a yes or no, and the answer affects both premium and excess.
- Enterprise vendor reviews. Large customers use it as shorthand in security questionnaires because it is easier to ask for than to design their own control set.
So the honest answer for most Australian businesses is that the Essential Eight is not mandatory, but it is increasingly the price of the contract. That is a different question, and it is usually the one that actually matters.
The Part Most People Get Wrong About Maturity Levels
Maturity is assessed from Level Zero to Level Three across all eight strategies together, and your overall maturity is the lowest level you have reached on any one of them. You do not average them.
This surprises almost everybody. An organisation with seven strategies comfortably at Level Two and one sitting at Level One is a Level One organisation. It is also why “we are working towards Level Two” is a statement that needs a gap analysis behind it before anybody puts it in a tender response.
If you need to know where you actually sit, our Essential 8 gap analysis assesses all eight against the current maturity model and gives you the remediation order, not just the score.
Understanding ASD Essential 8
The ASD Essential 8 is a set of strategies devised by the Australian Cyber Security Centre (ACSC) to help organisations mitigate cyber threats. It represents a baseline of proactive measures designed to make it harder for adversaries to compromise systems. The Essential 8 sits within a broader ASD framework which includes an additional 35 strategies.
The Importance of ASD Essential 8
While originally developed for government entities, the ASD Essential 8 is now widely recognised as effective cyber hygiene for all organisations. Businesses that adopt these strategies can significantly enhance their resilience against cyber incidents, safeguard sensitive data, and potentially avoid the significant costs associated with breaches.
However, it raises a critical question: Is compliance with ASD Essential 8 mandatory for Australian businesses? The short answer is ‘no’ – the ASD Essential 8 is not legislated as a compulsory framework. Despite this non-mandatory status, failure to implement adequate cybersecurity measures, including concepts covered in the Essential 8, could be interpreted as negligence given the ACSC’s strong recommendations.
Overview of the Essential 8 Controls
Detailed insights into each strategy of the Essential 8 will provide businesses with a clear path to bolstering cyber defences:
- Application Whitelisting
Control which applications can run within your network to prevent the execution of unauthorised software that could be malicious.
- Patching Applications
Regularly update applications to remediate known security vulnerabilities swiftly.
- Patching Operating Systems
Similar to application patching, ensure your operating system is also kept up-to-date to close off security loopholes.
- Restricting Administrative Privileges
Limiting admin access reduces the potential impact of a cybersecurity attack and helps protect sensitive data.
- Multi-factor Authentication
Add an extra layer of security through a verification process for user access to curb unauthorised infiltration.
- Daily Backups
Protect your data from ransomware and other cyber threats by maintaining secure and regularly updated backups.
- Disabling Macros
Many cyber-attacks exploit macros, so disable them in Internet Office files to reduce risks.
- User Application Hardening
Configure web browsers and Microsoft Office settings to protect against web-based and email-based attacks.
Implementing ASD Essential 8
For businesses considering adoption, implementing the Essential 8 requires a structured approach. Start with an assessment of your current cybersecurity posture and establish a plan for gradual implementation. Adequate staff training, regular auditing, and a responsive cybersecurity incident plan are also essential components.
Conclusion
Australian businesses may not be legally required to implement ASD Essential 8, but in an increasingly hostile digital environment, it makes sense to use every strategy at your disposal – and the Essential 8 is among the most effective. By making these protocols part of your cybersecurity foundation, you’re not just protecting your operations; you’re investing in the trust of your customers and the future of your business.
As experts in cybersecurity, Siege Cyber can support you through every step of integrating these essential strategies into your business. Don’t wait for legislation to nudge you into action; future-proof your business against cyber threats by embracing the ASD Essential 8 today.
Siege Cyber runs Essential Eight gap analysis and maturity uplift for Australian organisations, so you can see where each of the eight strategies actually sits. Get a Fixed-Price Quote.