Does the Essential Eight cover AI?
The Essential Eight protects IT networks, and none of its eight strategies address AI. Who has to implement it, what the maturity levels mean, and the separate ASD guidance that covers AI.
No. The Essential Eight is a set of eight cyber security controls published by the Australian Signals Directorate, designed to protect internet-connected IT networks, and last updated in November 2023. None of the eight address anything specific to AI. That is not a criticism of it, because ASD is explicit about what it was scoped for, and it has published separate guidance for AI. If a buyer's security questionnaire asks whether you meet the Essential Eight and then asks how you secure your AI, those are two different answers and you need both.
This comes up constantly once an Australian business starts selling to government, financial services or a larger enterprise. The Essential Eight is the framework everyone here knows, so it gets reached for, and it does not reach.
Before the AI part, it is worth being clear about what the thing actually is, because plenty of people are asked to comply with it without ever having been told.
What the Essential Eight is
Eight cyber security strategies from ASD: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups. They sit at the top of ASD's longer list of ways to stop cyber security incidents, chosen because they stop the attacks ASD keeps being called in to clean up.
Read the list and you can see the attack it was built for: someone gets malware onto a Windows desktop, takes admin rights, moves across the network, and encrypts or steals what they find.
Who has to comply, how the maturity levels work and how an assessment runs are all in the Essential Eight explained. This post is about the AI part.
Why it does not cover AI, and why that is fine
Look back at the eight. Three are about keeping software current, one is about macros in Office documents, one is about browsers and PDF readers. The closest thing to a control touching an AI agent is restricting administrative privileges, and that was written about human administrators on endpoints.
The date settles it. November 2023 is before the current generation of agentic systems existed in any deployable form.
ASD is also explicit that the framework has a scope. The Essential Eight "has been designed to protect organisations' internet-connected information technology networks", and while the principles may apply elsewhere, "it was not designed for such purposes and alternative mitigation strategies may be more appropriate". That is ASD telling you not to stretch it over things it was not built for. An AI agent with its own credentials, taking actions across systems, is one of those things.
Here is what the eight give you for each way a business typically uses AI, and what they leave open.
| How your business uses AI | What the Essential Eight gives you | What it leaves open |
|---|---|---|
| Staff using chat assistants | Multi-factor authentication on the accounts, patched browsers and devices | Which data staff paste in, where the provider processes and keeps it, and whether it is used for training |
| AI features inside tools you already pay for | The same account and device protections as the tool itself | What the AI feature can read and change, and who checks its output before it reaches a customer |
| AI agents that take actions | Admin restrictions and multi-factor authentication for the people who set them up | The agent's own credentials and permissions, instructions hidden in an email or web page it reads, and actions that cannot be undone |
| Custom AI builds and integrations | Patching and hardening of the servers they run on | API keys to model providers, logging of what the model saw and did, and testing before release |
Where Australian AI guidance actually lives
ASD covers AI in separate guidance.
Engaging with Artificial Intelligence, published 24 January 2024, is the general one. Be careful here, because that page still looks canonical and has been overtaken for anything involving agents.
Careful adoption of agentic AI services, published 1 May 2026 with CISA, the NSA and the UK, Canadian and New Zealand cyber centres, is the current word. It covers privilege and scope creep, agent impersonation, indirect prompt injection through email, tool use, rogue agents in multi-agent systems, and accountability. It asks for least privilege, human control points, versioning and rollback, and containment that limits the blast radius of unexpected behaviour.
That document, and not the Essential Eight, is what an Australian business should answer against when the question is about AI.
ASD Essentials, and what it says about AI
On 15 October 2026 ASD published ASD Essentials, the successor to the Essential Eight it consulted on in June. The first release has three chapters: enterprise IT, which replaces the Essential Eight directly, plus cloud and operational technology. The Essential Eight stays on cyber.gov.au during the transition and ASD has set no changeover date, so a contract that names the Essential Eight still means the Essential Eight.
AI gets more attention than it used to. A companion paper, AI considerations within the Essentials, counts AI systems as assets inside the series' scope, including the models, prompts and outputs and the accounts AI agents use. It sits alongside the agentic AI guidance above and does not replace it. The other changes, including how you are measured, are in the Essential Eight explained.
So the answer to this post's question has moved a little. The Essential Eight still does not cover AI. Its successor has started to, and the detailed AI guidance is still a separate document.
Has a buyer asked how you secure your AI yet?
The Essential Eight answer and the AI answer are two different documents.
What to do on top of the Essential Eight
Keep working through the eight, because AI tools sit on the same accounts and devices. Then add five things the eight do not ask for:
- List the AI tools in use. Including the ones staff signed up for themselves, and the AI features switched on inside your existing software.
- Write down who can approve a new one. A one-page policy is enough to start. Ours is in who signs off on AI: a one-page AI policy you can actually use.
- Give every agent its own account with the least access it needs. Never a person's login, and never admin rights because it was easier.
- Make a person approve anything that cannot be undone. Sending to customers, deleting records, moving money. See can you undo what an AI agent just did?
- Know where the data goes. Which provider, which region, how long it is kept. We trace one example in where your data actually goes when Claude reads your CRM.
How we handle each of these for the agents we build and run is set out in our AI Security and Governance Overview. The wider Australian picture is in our AI governance guide for Australian businesses.
What to tell a buyer who asks
Give two answers, and say plainly that they are two.
On the Essential Eight, give your maturity level across all eight, honestly, including where you are not there yet, and remember the weakest one sets the number. Level Two is what tenders usually ask for, because it is the level the Commonwealth set for itself.
On AI, answer against the agentic guidance instead: what privileges each agent holds, which steps have human approval, what you log, how you would reverse an action, and what happens when the agent reads something malicious. That is a better answer than a framework name, and it is what a technical buyer is testing for.
We wrote about the broader version of this in the AI security questionnaire your buyer's CTO is about to send.
Which other frameworks apply
For most Australian mid-market businesses, more than one, and they stack together:
- The Privacy Act and the APPs if you hold personal information, plus the automated decision-making disclosure commencing 10 December 2026.
- The agentic AI guidance above for anything that acts rather than just generates.
- The National AI Centre's Guidance for AI Adoption and its six essential practices, published 21 October 2025, which superseded the Voluntary AI Safety Standard in October 2025. The older standard is still published, so check the date before quoting it at anyone.
- APRA CPS 234 and CPS 230 if you are a regulated entity or a material service provider to one.
We mapped this out in which Australian AI framework applies to you.
What we do on client builds
When a client is answering a security questionnaire that mixes the two, we split it before anything else. Essential Eight questions get Essential Eight answers, with a real maturity level and no rounding up to the next one.
AI questions get answered against the agentic guidance, control by control. Then we make those answers true, which is usually where the work is: narrowing the permissions an agent actually holds, adding approval on anything irreversible, and making sure there is a log of what the agent read as well as what it did.
In short
The Essential Eight is ASD's list of the eight controls that stop the most real-world attacks on internet-connected IT networks. It is mandatory for non-corporate Commonwealth entities at Maturity Level Two, arrives by contract for their suppliers, and is worth doing regardless. The rest of the Australian picture, from the six practices to the Privacy Act change on 10 December 2026, is in AI governance in Australia.
It does not cover AI, and ASD says plainly it was scoped for something else. Its successor, ASD Essentials, published 15 October 2026, has started to bring AI into scope. The detailed AI guidance still sits in a separate document, updated 1 May 2026, and that is the one to answer against.
Frequently asked questions
What is the Essential Eight? Eight cyber security mitigation strategies published by the Australian Signals Directorate, drawn from the top of its Strategies to Mitigate Cyber Security Incidents list. They are patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict Microsoft Office macros, user application hardening and regular backups.
Does the Essential Eight apply to AI systems? Not specifically. None of the eight address AI risks such as prompt injection, agent privilege or autonomous action, and ASD states the framework was designed for internet-connected IT networks. Its Careful adoption of agentic AI services guidance, published 1 May 2026, covers AI instead.
Does ASD Essentials cover AI? Partly. ASD published ASD Essentials on 15 October 2026 with a companion paper, AI considerations within the Essentials, which brings AI models, prompts, outputs and agent accounts into scope. ASD's agentic AI guidance of 1 May 2026 still carries the detail.
Sources
- Essential Eight explained, ASD, last updated 27 November 2023, for the eight strategies, their origin and the stated scope.
- Essential Eight maturity model, ASD, for the four maturity levels, the tradecraft basis and the absence of certification.
- PSPF Policy 10 amendment, for the Maturity Level Two mandate on non-corporate Commonwealth entities and the 1 July 2022 core requirement.
- Consultation on evolution of Essential Eight, ASD, 15 June 2026, for the Essentials series and consultation window.
- Careful adoption of agentic AI services, ASD's ACSC, 1 May 2026, for the current AI security guidance.
- ASD Essentials and AI considerations within the Essentials, Australian Signals Directorate, published 15 October 2026.
Answering a security questionnaire that mixes the two, and want the AI half to be true before you send it? Talk to us.
Is every one of your eight strategies at the same level?
Your weakest strategy sets your maturity level, and self-reported levels are usually optimistic.