Picture the next cyber report to land in your Board pack. There is no maturity level, no reassuring "we're at ML2". Instead there are eight domains, each with a set of actions rated not effective, partially effective or fully effective, and a note that the organisation has completed priority phase one.
What would your Board ask?
On 15 October the Australian Signals Directorate released the ASD Essentials, the successor to the Essential Eight. It launches with three chapters, covering enterprise IT, operational technology and cloud, alongside guidance on AI and a publication titled The Essentials for senior executives. It is aimed at Commonwealth entities, critical infrastructure owners and operators, and large organisations. Most of those have Boards, and many have independent Directors.
Most commentary so far has focused on the technical changes. For Directors, the more significant change is that the Board's role is now written into the standard itself.
What has changed
The Essential Eight gave organisations eight mitigation strategies and a maturity ladder. It was easy to report and easy to misread. A single maturity number told a Board how far down a checklist the organisation had progressed, not whether the controls actually worked.
The Essentials replaces this with principles (the outcome sought), actions (what is done) and domains (where it applies, from identity and boundary systems through to critical processes and services, and governance and culture). Each action is rated for effectiveness in each domain it applies to. ASD is explicit that Essential Eight maturity does not automatically translate into effectiveness. Deployment records show a control was installed. Effectiveness needs operational evidence, such as testing, exercises and monitoring.
The Board is in the standard
The first action in the governance domain, GOV-01, asks organisations to formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting organisational risk appetite, and to review those accountabilities on a defined cadence.
Setting risk appetite is not a technical activity. It is one of the core functions of a Board. For the first time, a national technical baseline treats it as a control, and an assessor can check whether it exists.
The same domain covers resourcing, risk management assurance, supplier assurance, accountability for AI, and legacy systems. Each is a question a Board already owns, now framed as part of the security baseline rather than something adjacent to it.
What this gives Directors
Three shifts are worth taking into the boardroom.
From deployment to evidence. The question moves from "have we implemented it?" to "how do we know it is working, and how will we know if it stops?" That is assurance language Directors already use for financial controls.
Progress is not security. ASD's executive guidance notes that reaching a priority phase describes "implementation scope, not how secure the organisation is". A Board hearing "we've completed phase two" should consider asking what the effectiveness ratings say.
Compliance is the floor. ASD advises that "an obligation establishes a floor, not a priority order". Regulatory requirements set the minimum. They do not tell you where your greatest exposure sits.
Finding the crown
The Essentials directs effort towards critical processes and services. That raises the question I explored in my previous Insight: who decides what is critical? The framework assumes the organisation knows which processes deliver its objectives, and which information and systems those processes depend on. That chain starts with strategy, which is the Board's domain. Without it, domain ratings are well-structured data with no anchor.
A familiar gap
There is one place where the Essentials falls short of its own standard. The leadership guidance is titled for senior executives, and the implementation guidance describes "the board of directors or executive committee" as accountable, as though the two were interchangeable.
For many Commonwealth entities that is accurate. Under the PGPA Act the accountable authority is often an agency head, and there is no Board. For a critical infrastructure operator or a listed company with independent Directors, it is not. The Board and the Executive hold different accountabilities, and the guidance would be stronger if it spoke to each.
We have been here before. The first annual update of Australia's 2016 Cyber Security Strategy recognised that Directors needed to be reached directly, in their own language. The response was a partnership between the AICD and CSIRO's Data61 to lift the cyber literacy of Boards, and I was fortunate to lead the development of that programme. It worked because it was written for Directors, not translated for them afterwards.
ASD consulted widely on the Essentials, and peak bodies including the AICD took part. A natural next step would be a Director's companion, developed with those bodies, that speaks to the governing role.
What Directors should consider asking
Until then, the executive guidance translates well. Three questions for the next Board or committee meeting:
First, which cyber accountabilities sit with the Board and which with the Executive? GOV-01 asks for them to be formally defined. If the answer is "the Board or the executive committee", that work has not been done.
Second, what evidence of effectiveness will we receive, and how often? Agree the reporting format now, domain by domain, before the first assessment rather than after it.
Third, are we funding sustainment or only the project? ASD expects implementation and ongoing operation to be treated together as a single capability. A one-off uplift budget will not hold effectiveness ratings over time.
The Essentials is a better standard than the one it replaces, and much of that improvement sits in the governance domain. Directors should consider reading it as if it were written for them. In most of the ways that matter, it was.
This article reflects the author's own analysis, experience, and professional judgement. AI tools were used during drafting to assist with structure, editing, and refinement. The ideas and positions expressed are entirely the author's own.
For more on how Wilk Advisory uses AI, see our AI use statement.