ASD Essentials for cloud

Scope. ASD launched ASD Essentials on 15 October 2026 as a principles-based framework that will replace the Essential Eight and is designed to cover enterprise, cloud and operational technology environments, techpartner.news reported. In its initial version the Essentials covers cloud and operational technology as well as enterprise IT (iTnews). This page covers the cloud chapter.

Principles, actions and domains

The series introduces three core concepts: principles that describe the cyber security outcomes an organisation should achieve, actions that describe what needs to be done to achieve those outcomes, and domains that define the business functions and assets to which actions apply (techpartner.news). Effectiveness is rated per action and domain as 'not effective', 'partially effective' or 'fully effective', and a principle's overall rating is determined by its lowest-rated applicable action (techpartner.news).

Priority phases

Across the series, priority phases replace maturity levels, sequencing effort toward the highest-risk assets first, and ASD recommends organisations begin scoping work in the phase one domains: boundary services, identity services, governance and culture, and visibility and response (techpartner.news). ASD said priority phases are not maturity ratings, and that reaching a phase 'describes implementation scope, not how secure the organisation is', according to iTnews.

Chapter detail

Neither iTnews nor techpartner.news reported this chapter's specific contents. For the chapter's domains, actions and wording, read the ASD publication listed under further reading; this page does not summarise it.

CyberStack guidance (our own advice, not ASD's)

This section is CyberStack's own general hardening advice for cloud services. It is not ASD's guidance and does not describe what the ASD chapter contains.

Use phishing-resistant multi-factor authentication for administrators, such as security keys or passkeys.

Apply least privilege. Give people and service accounts only the access they need, keep administrator accounts to a minimum, and review admin roles regularly.

Turn on logging and alerting. Make sure audit logs are enabled and retained, and alert on sign-in anomalies, admin role changes and new integrations.

Review third-party apps and OAuth access. Check which applications have been granted access to your tenant and data, remove ones you don't need, and control who can approve new ones.

Understand the shared-responsibility model. For each service, work out which security tasks your provider handles and which remain yours, and confirm the settings you are responsible for are not left at defaults.

We'll summarise this chapter from ASD's own text once we can retrieve it.