• 1. The clause still works today, but it will become dated.

  For now, the Essential Eight remains in effect and the obligation is clear. However, ASD advises organisations not to start work ‘solely to achieve a superseded Essential Eight target’ unless a regulator or other obligation requires it, or the work still addresses material risk. A contractual requirement is one such obligation. In practice, your template may keep suppliers working towards a target that ASD itself is moving away from. Expect suppliers to raise this in negotiations.

• 2. ‘As amended, updated or supplemented from time to time’ may not get you to the new framework.

  ASD describes ASD Essentials as an ‘evolution’ of the Essential Eight. However, it is a separate framework with a different structure, ratings and scope. It is at least arguable that ASD Essentials is not an ‘amended, updated or supplemented’ version of the Essential Eight. If so, the obligation could stay attached to a superseded document. That is a construction risk for customers. For suppliers, the opposite reading creates uncertainty about whether they have taken on a broader standard they did not agree to.

• 3. One clause may not fit every service.

  ASD now has separate chapters for enterprise IT, operational technology and cloud. A single framework reference in a template may not suit both a managed service provider operating infrastructure and a SaaS supplier.

• 4. Shared responsibility needs to be documented.

  The cloud chapter labels each action according to who does the work. Some are delivered by the customer, some are capabilities the supplier provides but the customer must enable and operate, and some are delivered by the supplier and verified by the customer through assurance evidence. For capabilities the supplier provides, ASD says the parties need to agree what the supplier is accountable for providing. That allocation belongs in the contract.

Why customers now have more to put in the contract

The new framework treats supplier security as part of the customer's own security posture. The governance principle on supplier cyber security assurance requires organisations to:

• select and engage suppliers on the basis of a cyber supply chain risk assessment proportionate to the risk the supplier introduces, and retain evidence to support that decision; and
• maintain current assurance that suppliers continue to meet their cyber security commitments, and act when that assurance lapses or the supplier's risk changes.

For cloud services, the framework also expects organisations to:

• maintain a register of the security responsibilities inherited from and retained with each supplier;
• apply a controlled process for onboarding and exiting services, including checking that data can be retrieved and deleted and that access has been revoked;
• include supplier notification arrangements in their incident response; and
• retain control over the keys protecting their most sensitive data, including the ability to revoke the supplier's access.

Customers that adopt ASD Essentials will need contractual rights to obtain this assurance and evidence from their suppliers. So the new framework affects not only which security standard the contract refers to, but also what else the contract needs to cover.

The takeaway

Security standards remain one of the most important protections in an IT contract. For almost a decade, the Essential Eight has given Australian customers a convenient, government-backed benchmark for those standards. That benchmark is now changing, and the transition period is the time to revisit templates and standard positions with your cyber team.