ASD Essentials has launched: what changes in supplier evidence reviews?

The Australian Signals Directorate launched ASD Essentials on 15 October 2026, expanding its cyber security guidance through chapters for enterprise IT, operational technology and cloud. For Australian third-party risk teams, the immediate question is what to do with existing supplier evidence and the next round of assurance requests.

Start with a distinction that is easy to miss: ASD's assessment process guide is for assessing your own organisation's environment. It expressly excludes assessing the cyber security posture of suppliers and third parties. Providers still have an important role when they operate parts of the environment being assessed.

That makes the practical next step a conversation with your cyber assessment lead about scope and evidence, before issuing a new questionnaire across the supplier register.

What changed on 15 October?

The ASD launch announcement describes Essentials as an evolution of the Essential Eight. Its initial chapters cover different technology environments, with supporting guidance for implementation and assessment.

ASD says it will maintain both Essential Eight and Essentials during the transition. Organisations should continue meeting their current regulatory obligations until regulators communicate associated changes. The announcement does not establish a new APRA supplier-review deadline.

The Essentials FAQ also makes clear that Essential Eight maturity ratings do not automatically convert into Essentials effectiveness outcomes. Keep the name, version and scope attached to any existing assessment result; changing its heading would change what the record appears to prove.

Where suppliers fit in the new assessment

The assessment process guide distinguishes assessing your environment from assessing a supplier's overall posture. It says further guidance for organisations intending to use Essentials to assess suppliers will follow.

For your own assessment, identify providers operating systems within scope and involve them early. Establish what evidence and access they can provide, who can authorise assessment activities, and which contractual or operational restrictions apply. A provider operating one component may hold evidence your internal assessor cannot obtain alone.

For a lean team, this suggests a manageable division of work: the cyber assessment lead defines the technical question; the supplier relationship owner identifies the provider contact and contractual route; the risk team records unresolved dependencies and decisions. This is a suggested working arrangement, not a staffing model prescribed by ASD.

Where information-security evidence also supports an operational-risk review, our guide to separating CPS 230 and CPS 234 supplier evidence helps keep the questions and conclusions distinct.

Ask which environment and responsibility are involved

The chapter-selection guidance distinguishes on-premises, hybrid and infrastructure-as-a-service environments from predominantly software-as-a-service or platform-as-a-service environments. More than one chapter may be relevant. The word “cloud” in a supplier's sales material is not enough to select an assessment approach.

Consider a fictional organisation using a hosted document-management service. Before requesting another broad assurance pack, its reviewer writes down:

• The business function that depends on the service and the systems included in the planned assessment.
• The settings and activities controlled by the organisation, such as configuring its tenant and maintaining its own records.
• The activities performed by the provider, and the evidence needed to examine that part of the arrangement.
• Any work that neither party has clearly accepted responsibility for.

The cyber lead can then decide which chapter and assessment scope fit. The supplier team can direct questions to the right contact. Neither needs to infer an organisation-wide security result from a generic provider statement.

For any assurance report already held, check its service boundary, period and exceptions before treating it as evidence for the scoped environment.

Reuse evidence without relabelling the conclusion

ASD's Essential Eight transition guidance addresses moving an existing implementation to Essentials for enterprise IT. It supports identifying controls and evidence that can be reused and areas needing further work.

A practical evidence register can preserve that history with five fields: original framework and version; service or system covered; evidence date and period; proposed use in the new assessment; and the reviewer who confirmed that use. Add an unresolved question where the mapping is uncertain.

For example, a fictional provider's earlier test report might help explain how a recovery process worked at the time. The assessment lead still needs to decide whether its coverage and age support the current question. Retain the original report and conclusion alongside that decision. This leaves a traceable basis for reuse without presenting an old result as a fresh assessment.

ACS raises a question about assessor judgement

In its 16 October response, the Australian Computer Society welcomed the reform while questioning how assessor competence and consistency would be established. It called for clearer competency requirements and transparency about who assessed what.

Those are ACS's policy positions, not new legal requirements. They nevertheless raise useful procurement questions when commissioning assessment work: what relevant experience does the assessor have, what will be tested, what is excluded, and how will limitations appear in the report? Agree those points before relying on a headline result.

A bounded first step for this week's review queue

Choose one arrangement already relevant to your organisation's planned cyber assessment. Ask the assessment lead to identify the evidence dependency, then check whether current records answer it. Where something is missing, send a targeted supplier follow-up with the service, question and requested evidence clearly named.

Record the owner, unresolved gap and next review date. Keep existing obligations and remediation commitments visible while the transition is planned. The organisation retains responsibility for its risk decisions; the provider's participation helps establish what evidence is available to make them.