ASD Essentials and Your Internet-Facing Systems: Why Boundary Services Come First
On 15 October 2026 the Australian Signals Directorate published ASD Essentials, the framework that replaces the Essential Eight. For anyone responsible for internet-facing systems, one design decision stands out: the domain that covers them, boundary services, is in priority phase 1, the first work ASD asks organisations to do.
This guide covers what that means for your external attack surface, what evidence assessors will expect, and where external attack surface management fits. For a full explainer of the framework, Security Solution Consultants has published ASD Essentials explained.
Principles, actions and domains
ASD Essentials replaces the Essential Eight's mitigation strategies and maturity levels with three layers. Principles describe the security outcome, drawn from the cyber security principles in the Information Security Manual. Actions describe the work needed to achieve them. Domains group assets and functions with similar risk, so each action is applied and assessed where it matters.
The enterprise IT chapter has eight domains. Six are technical and grouped into priority phases; two capability domains, governance and culture, and visibility and response, run through every phase.
Boundary services come first
Boundary services are the internet-facing services, gateways and edge devices that connect zones of different trust. ASD places them in phase 1 with identity services because they are the most common paths to initial access. The operational technology chapter goes further and puts boundary services in phase 1 alongside critical processes and services.
A domain is a logical grouping, not a network zone. One internet-facing customer application can sit in boundary services in phase 1 and in critical processes and services in phase 2. You implement each action on it once, but you must first know that it exists and that it faces the internet.
The inventory problem
ASD's transition guidance asks organisations to scope the phase 1 domains early: map your assets and functions into boundary services, identity services, governance and culture, and visibility and response. ASD Essentials also adds an asset identification principle: a continuous inventory of infrastructure, operating systems, applications, identities, credentials and data.
For boundary services, that means an accurate list of everything you expose to the internet, including the things nobody recorded: the remote access appliance a supplier installed, the staging site left online, the subdomain pointing at a retired cloud service. A CMDB records what someone remembered to add. Scoping boundary services from it alone will miss exactly the assets most likely to be used for initial access.
What assessors will look for
Each action is rated not effective, partially effective or fully effective in each domain, and a principle's rating in a domain is its lowest action rating. Assessors look at four qualities of evidence: coverage, consistency, currency and quality. Two of those are where external attack surface data helps most.
- Coverage. Evidence that an action applies to every asset in the domain. If your boundary services inventory is incomplete, coverage claims are weak by definition.
- Currency. Evidence that the control is working now, not when it was deployed. A scan result from last quarter does not show that internet-facing services are patched today.
The Essential Eight already expected online services to be scanned for missing patches at least daily. Under ASD Essentials, patching becomes risk-based vulnerability management with treatment timeframes that can differ by domain, and the boundary services domain is where the shortest timeframes make most sense.
What does not change yet
Essential Eight maturity levels do not convert into ASD Essentials ratings, and the Essential Eight remains in place until ASD and regulators set transition dates. Commonwealth entities still have an Essential Eight obligation under the PSPF, and Australia's PSPF Requirement 0211 still asks entities to identify and manage their internet-facing systems. Keep current uplift work running and map it to the new actions as you go.
Where EASM fits
External attack surface management produces the outside-in inventory that scoping boundary services needs, and keeps it current. EASMLens discovers internet-facing assets from DNS, certificate transparency and internet-wide data, checks them continuously with non-destructive tests, and reports what changed since the last scan. That is evidence of coverage and currency for the boundary services domain. It does not rate your actions or certify anything; your assessor does that.
For the rest of Australia's attack surface rules, including PSPF 0211, SOCI and the enhanced CIRMP rules, see our Australia guide and PSPF 0211, SOCI and the Essential Eight.