ASD Essentials makes cyber security a formally defined executive and board responsibility, and the Australian Signals Directorate now treats executive commitment as something an assessor can rate. Boards will see posture reported by domain rather than as a single maturity level, with gaps and untested areas shown openly. ASD's guidance for senior executives lists ten questions to ask before approving an implementation proposal, and they make a good agenda for the first board discussion.
For years, a board could ask "where are we on the Essential Eight?" and get a one-line answer. The ASD Essentials series ends that. Its reporting is more detailed, its sequencing says nothing about how secure the organisation is, and its Governance and culture domain puts the board's own arrangements in scope.
This article is for directors, CEOs and executive committees. It covers what ASD now expects of them, how reporting changes, the ten questions ASD recommends and what to put on the agenda next.
Key takeaways
- ASD's first governance principle asks organisations to "formally define and establish executive and board-level accountabilities for cyber security", including risk appetite, and to review them at a defined cadence.
- Executive commitment "is now assessable content within the Governance and culture domain".
- Board reports should show posture by domain, with both a summary view and a detailed view of gaps. ASD warns the summary alone "may obscure outstanding risk".
- Reaching a priority phase is not a security rating. A phase describes scope, "not how secure the organisation is".
- The board or executive committee is also accountable for AI being "secure, controllable, human-supervised and used in an ethical and accountable manner".
- ASD's ten questions focus on consequence, investment, reporting, validation, ongoing cost and accepted risk.
- Boards may need to seek independent advice from an organisation like Beyond Technology to ensure they understand the information they should be provided and know how to respond.
Summary table: what ASD says senior executives should expect
| ASD expectation | What it means at board level |
|---|---|
| A clear understanding of the sequencing model | Priority phases set implementation order. They are not maturity ratings and do not indicate assurance |
| Formal executive and board-level accountability | Named accountabilities, including setting, monitoring and adjusting risk appetite |
| Alignment with operating context | The plan reflects regulatory obligations, critical functions, risk appetite and resources |
| A current-state baseline | Applicable actions assessed and gaps identified, including existing Essential Eight investment |
| Realistic implementation and sustainment expectations | "There is no completion date for effective cyber security" |
| Sustainable resourcing | Funding separates implementation, ongoing operation and assessment or assurance costs |
| Evidence of effectiveness | Claims backed by evidence, which may include simulated exercises and independent testing |
| Clear reporting arrangements | Agreed content, frequency and audience, including material gaps, accepted risk and domains not assessed |
| Continued regulatory compliance | Existing legal and regulatory obligations still met during the transition |
What does ASD now expect of executives and boards?
The Essential Eight was a technical maturity model. Governance sat outside it. ASD Essentials brings it inside through the Governance and culture domain, which applies from the first priority phase onwards.
The first principle in that domain, Executive cyber security accountability, reads in full: "Formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence."
ASD's implementation planning guide spells out what follows from it. The board of directors or executive committee is accountable for cyber security. The same executive body monitors and assures the Cyber security resourcing principle, which requires that suitable and sufficient people and resources be identified, acquired and maintained. And risk management activities are subject to ongoing monitoring and assurance.
The sentence that matters most for directors is this one: "Executive commitment is now assessable content within the Governance and culture domain." An assessor can now rate the board's arrangements as not effective. Good intentions recorded in a strategy document are not enough. The evidence needs to show named accountability, defined reporting and reviews that happen on schedule.
How will cyber security reporting to the board change?
Domains instead of a maturity level
Posture is reported by domain, for example Boundary services, Identity services or Privileged environments, showing how many principles are fully effective, partially effective, not effective or not assessed. Each domain also gets a percentage score, which lets the board track progress between assessments.
Phases are not a security rating
A management report that says "we have completed priority phase 1" tells the board where the programme is up to. It does not say how well protected the organisation is. ASD's guidance for executives says a statement like "we have reached priority phase 2" describes implementation scope, "not how secure the organisation is". Posture comes from the effectiveness ratings.
Gaps are shown, not averaged away
ASD's assessment guide requires both a summary view showing progress across domains and a detailed view identifying the principles and actions behind each rating, along with the remediation under way. It suggests a domain-level radar chart suits board and regulator reporting. It also warns that "the summary view alone may obscure outstanding risk", which is why both views should reach the board.
Not assessed is reported, not hidden
Domains and actions that haven't been assessed are labelled not assessed. ASD treats this as a neutral status and insists it stay distinct from not effective. Boards should expect to see it in early reports and should ask whether the reasons for leaving assets unassessed are justified.
The ten questions ASD says senior executives should ask
ASD lists these questions for executives considering an implementation proposal, and recommends revisiting them as the programme progresses. They are quoted below as ASD publishes them, with a note on what a useful answer looks like.
1. "Which of our key functions and assets sit in each domain, and which domains hold the assets whose compromise would be most consequential for the organisation?"
A useful answer names systems, not categories. It should identify where the organisation's critical services sit and which domain carries the most consequential risk, so the board can judge whether the plan's priorities match.
2. "What did our Essential Eight investment buy us under the ASD Essentials framework, and what is genuinely new work, such as the governance principles and the expanded detection and response capability?"
This separates reused investment from new spend. Expect a gap analysis that classifies each action as already addressed, partially addressed or not addressed, rather than a claim that previous maturity levels carry over.
3. "When will we see the first posture report, what will it cover and what will be reported as not assessed? Are the reasons justified for the assets deemed not assessed?"
The board should get a date and a scope. Anything excluded should come with a reason, and that reason should be revisited at each report.
4. "What specific risk reduction do priority phase 1 investments provide? Which observed attack paths does hardening those domains disrupt for us?"
Priority phase 1 covers Boundary services and Identity services, plus establishing governance and detection. A good answer links that work to the ways attackers commonly get in and escalate access, in this organisation's environment.
5. "Where does the plan depart from ASD's recommended sequencing, and what is the documented, risk-based justification?"
Departing from ASD's order can be sensible, for example where a critical service faces a specific threat. It should be a documented decision, not a convenience.
6. "How will effectiveness be validated, and will independent assessment or adversary-simulation testing be used, and on what cycle?"
Effectiveness needs evidence. ASD's planning guide lists validation methods ranging from control validation testing to penetration testing and red team exercises, and notes that the advanced methods "may not be required for every action". The board should know which methods will be used, how often and by whom.
7. "What are the ongoing operational costs and resourcing needs once priority phase 3 is reached, and how will resourcing be reviewed against threat trends and incident outcomes?"
ASD says implementation is not a one-time activity, and the planning guide asks business cases to separate the programme end date from the ongoing sustainment run rate. The board should see both numbers.
8. "How are exceptions, compensating controls and accepted risks governed? Who owns them, when do they expire and when do we re-approve or close them?"
Every exception should have an owner, an expiry date and a review point. An exception register that only ever grows is a governance finding in its own right.
9. "What are the anticipated disruptions to operations and user experience during implementation, and how will they be managed?"
Changes such as tighter administrative access, application control and phishing-resistant authentication affect how people work. The board should know where disruption is expected and how it will be handled.
10. "How will we continue to meet our current regulatory reporting obligations during the transition?"
Obligations that refer to the Essential Eight still apply. ASD's transition guidance says organisations should continue to meet them as directed by the relevant authority, so management may need to report in both frameworks for a while.
ASD adds that the questions are not exhaustive, and that considering them helps senior executives turn the framework "into a well-governed, strategic investment rather than a compliance exercise".
What about AI?
ASD's AI guidance places it within the board's accountability too. Under the Executive artificial intelligence accountability principle, "the board of directors or executive committee is accountable for ensuring AI is secure, controllable, human-supervised and used in an ethical and accountable manner".
For boards, that means knowing which AI tools the organisation uses, including AI features switched on inside existing software, who approved them, what data they can reach and who is accountable for them. ASD also notes that AI "has made existing attacks faster, cheaper and available to more people", including synthetic voice and video aimed at staff who approve payments or reset access.
Why independent assurance matters to the board
The board's job is to know whether the reports it receives are accurate. That is hard when the same party designs the controls, runs them and reports on them.
ASD does not require an independent assessor, and says organisations may engage one where proportionate and affordable. It is clear about the benefit: independent assessors "bring a fresh perspective and judgement, helping to identify gaps and weaknesses that may have become accepted through familiarity". For a board, that fresh perspective is most valuable at three points: understanding their responsibility when planning starts, at the first baseline, and any time management reports a domain as fully effective.
What to put on the next board agenda
- Name the accountable executive and confirm which committee oversees cyber security, so the Executive cyber security accountability principle has an owner.
- Determine if independent advice to the board is warranted to ensure they understand responsibilities and how to interpret plans and reports.
- Agree the reporting format with management now: domain summary, detailed view of gaps, accepted risks and domains not assessed, and how often the board sees it.
- Ask for a current-state baseline, including what the Essential Eight investment already covers.
- Set the risk appetite the plan should be built against, and the cadence for reviewing it.
- Decide how effectiveness will be validated, and whether an independent assessment is warranted for the baseline.
How Beyond Technology can help
Beyond Technology is an independent technology advisory firm. We don't sell technology, software, hosting or support, and we take no referral fees. We work with boards and executive teams on cyber security governance and assurance, and, building on our Essential Eight audit, we can provide an independent ASD Essentials baseline that a board can rely on. If you are working out what the transition will cost, our guide to budgeting for ASD Essentials covers the business case.
FAQs
Is the board responsible for cyber security under ASD Essentials?
ASD's governance principles make the board of directors or executive committee accountable for cyber security, including setting, monitoring and adjusting risk appetite. Executive commitment is assessed as part of the Governance and culture domain.
What should a board cyber security report look like under ASD Essentials?
It should show posture by domain and priority phase, with counts of principles at each rating and a percentage per domain. ASD requires a summary view and a detailed view of the principles and actions behind each rating, including remediation in progress and domains not assessed.
Does reaching a priority phase mean we are secure?
Priority phases set the order of implementation, so reaching one shows where the programme is up to. ASD says a statement such as "we have reached priority phase 2" describes implementation scope, not how secure the organisation is. Security posture comes from the effectiveness ratings.
What questions should directors ask about ASD Essentials?
ASD's guide for senior executives lists ten, covering which assets sit in each domain, what the Essential Eight investment already covers, when the first posture report arrives, how effectiveness will be validated, ongoing costs, and how exceptions and accepted risks are governed.
Do we need an independent assessment or advice?
ASD does not require independent assessment and leaves each organisation to judge what is proportionate and affordable. It also says independent assessors help identify gaps that may have become accepted through familiarity. Independent advice can be critical if your board does not have the skills and experience to provide critical review and judgement.
References
- Australian Signals Directorate, ASD Essentials overview: The Essentials for senior executives (2026)
- Australian Signals Directorate, ASD Essentials for enterprise IT (2026)
- Australian Signals Directorate, Implementation planning guide (2026)
- Australian Signals Directorate, Assessment process guide (2026)
- Australian Signals Directorate, AI considerations within the Essentials (2026)
- Australian Signals Directorate, Transitioning from the Essential Eight (2026)
