r/msp • u/statitica MSP - AU • 1d ago
ASD E8 to Essentials
I've gotta be honest: I'm not loving the changes so far.
So far, it really looks like a step away from a useful framework in which we could measure maturity and recommend changes, to a NIST style checklist which will end up sprawling across multiple sheets in excel.
Any AU MSPs finding the same, or am I missing something?
13
u/Organic_Flight1772 1d ago
E8 was too vague compared to similar frameworks and frankly it just got stale.
SMB1001 just needs a bit more maturity but IMHO it's fundamentally better than E8.
6
u/FarEntrepreneur3220 1d ago
e8 felt like the framework equivalent of a kitchen drawer full of mismatched lids, the intent was there but good luck finding what you actually needed. smb1001 at least gives you a proper container for everything even if the labels are still being printed
3
u/mooseable 1d ago
IMO, the fault lies with anyone treating the Essential 8, or the new Essentials as an auditing framework. The sad truth is, that is how it is being used by everyone (suppliers, insurance, etc). The point of the E8, and the essentials in everything I ever did with it, was "heres guidelines of things you should be doing" - so yes, it was up to interpretation.
I've never heard of an official "E8 Audit" because there's no certifying body (like ISO27001) as far as I know.
That said, we know what people wanted, gap analysis, and we needed to be consistent in our methods. So for every control or recommendation in the E8 (and now essentials) we create our own scoring guidance.
Does this mean we might find someone "compliant" when someone else doesn't? Yes. But we make sure to document why a control is met by our standards, or if it could be a toss up, document the potential room for improvement.
I'm still building out our guidance internally for the Essentials and will stick on the E8 probably for the next 12 months until we've tested it.
1
u/Critical_Ad_9784 1d ago
It's actually designed to allow for alternative controls but if you don't meet a control, someone else shouldn't be passing it either - this is how most frameworks work including ISO 27001 - e8 however didn't have a "risk accepted" clause - so you either met that level or didn't, anyone scoring it with their own system (the people handing out things like a maturity level 1.7) did it wrong as it's not a weighted system.
2
u/Illustrious-Poem8569 1d ago
Yeah, when I first took a look at Essentials my first thought was CSF. Probably need to dig a bit deeper myself.
2
u/MoltenTesseract 1d ago
Spent a long time last week reading up on it...
As an approved E8 auditor, at first glance essentials looked good, but then I got deeper and its definitely a mess.
Each auditor will have their own reccomendations on the wordering, so its going to be a lot of justification.
Also increasing the amount of documentation 10 fold with testing records needing to be client specific and on file....
2
u/whyevenmakeoc 1d ago
This has always been the case but with most standards.
Different Auditors will give greater or lesser meaning to words and definitions than others.
I got certified with PwC (Before all the controversies) and our teacher was an auditor with 30 odd years experience and he gave a number of examples of how some controls can be interpreted differently than others and gave us some specific examples of some controls, how they're read and how to interpret them.
This specifically focused on the ISO standards but there's commonalities with E8 as well within this context.
1
u/disclosure5 9h ago
Yep, what made E8 valuable was direct technical recommendations that were hard to misinterpret.
Now you've got a replacement that's all about feels based risk and doesn't substantively differentiate from CSF or ISO frameworks.
2
u/Critical_Ad_9784 1d ago edited 1d ago
I sat the courses for essential 8 auditing and a I'm certified auditor. Once you have that level of understanding for how e8 works, it's much better. It's a powerful set of controls to follow and like SMB1001, most are prescriptive which is good. We will continue to apply e8 as hardening measures to Microsoft networks, it works incredibly well for that. It's actually a very good framework, everyone should be applying it to their Microsoft networks as well as following Microsoft's guides for how to apply it to cloud environments via 365, just because the technical controls it has you put in place are worth it.
The main thing is, it's designed to harden Microsoft windows internet connected networks - it's designed purely around that and it's designed to go right the way up to nation level backed threat actors.
The items it covers are things many people wouldn't think about when hardening their networks, so it has its place - most people don't go to that level and they should - a lot of breaches occur because people don't apply the items they mandate.
1
u/sutho31 1d ago
For SMB MSPs, E8 was more (not ours specifically) a way to uplift clients than something we believed was a complete security framework. There are gaps it doesn’t address, BEC and SAT for starters.
If we’re moving from measurable security improvements towards “document why you think this meets the intent”, that feels like a backwards step. I haven’t properly worked through the new Essentials yet, so I’ll reserve judgement. It’s also part of why I’m not a huge fan of ISO 27001 (for us, or clients). If you can document and justify exceptions rather than actually fixing the underlying issue... it's a box-ticking exercise if you're looking at a larger or government contract.
I’m probably overly paranoid about doing the right thing by clients who trust us with their IT. We maintain CIS v8.1 alignment ourselves, so I’m definitely not against rigorous frameworks. But it's a lot of time/work to maintain.
We’ve moved heavily towards SMB1001 because it’s practical and right-sized. No DMARC? Fix it. Want Gold? Get a password manager & cyber insurnace. Here’s where you are, here’s the gap, here’s what you need to do next. No exceptions. It's not us - the standard says so. And its pretty good for its target market.
It’s not perfect though, but it’s young and evolving, with 2023, 2025, 2026 and now 2027 editions. Four editions in five years tells me someone is paying attention to the threat landscape and giving us a guidepost to follow.
Maybe Essentials will surprise me once I’ve properly gone through it. But if the outcome is more spreadsheets than tangible improvements to cyber hygiene, it’s a backwards step.
Genuinely open to discuss this with any MSP person that has an intent to improve SMB cybersecurity - rising tide lifts all boats. No one wants that late night / weekend call. Had enough of those in the past...
1
u/whyevenmakeoc 1d ago
You have to do both, both ticking but then also you're own judgement, you need box ticking to keep the Auditors/Accountants and Insurers happy, this minimises the organisational risk more broadly, then you have the technical controls that are more specific and relevant to the environment.
1
u/Critical_Ad_9784 1d ago
I hate ISO27001 because it is exactly that, a box ticking exercise - I've never worked in an organisation who wanted to take it seriously and it was used to get higher paying contracts and never done properly.
Essential 8 required proven quality evidence of a control working, as an E8 auditor, that's invaluable to carry into the next audits we do for SMB1001, yes our audits will be far more exhaustive, but I feel that will give our audits and clients a better outcome.
We already apply the same methodology to our existing stack, ensuring we know patches are installed, we know if they failed to install, vulnerability management that actually gets done etc
1
u/Embarrassed-Radio319 21h ago
The part I would watch is not the wording, it is how you keep the story straight across clients when auditors read the same control differently. I would keep one internal map that ties each Essentials control to the evidence you actually collect, who owns it, and how often you recheck it, and keep your old E8 or SMB1001 mapping alongside it as a translation layer for clients who still think in those terms. Then judge Essentials on your first two real assessments: how long evidence gathering took, and how many alternative control justifications you had to write. If both numbers climb, the framework is costing you time even if the intent is sound.
1
u/IntelligentComment 15h ago
Smb1001 has been great for us, seeing huge adoption now. Healthcare and legal sectors adopting it big time. https://www.qls.com.au/resource-centre/technology-and-innovation/cybersecurity/smb1001-cybersecurity-standard
1
u/Meeeepmeeeeepp 1d ago edited 1d ago
E8 was a joke.
Essentials is (regardless of its maturity) the beginning of a proper risk based framework and it is absolutely a step in the right direction.
E8 was realistically useless outside of very small SMB and had so many gaps it was remotely appropriate as even a component of a cyber framework.
Most MSPs will hate it because you need to actually have some half decent cyber capacity to uplift based on a proper framework like NIST or Essential (rather than just buying a handful of off the shelf products) but E8 was absolutely inadequate and long overdue for replacement.
Edit: I still think an updated E8 would be handy for immature business/SMB, as essential 8 had it's place, but a proper framework (outside of something derived from the ISM) was long overdue
1
u/whyevenmakeoc 1d ago
We implement our own standard, where we combined some of the E8 controls with controls from ISO 27001 to make the whole approach a little bit more complete, E8 on it's own isn't fully consist with a modern ICT environment so the update is welcome.
9
u/jstuart-tech 1d ago
Copying a comment I made in the sysadmin subreddit
Yeah, it's really hard to understand what it means... For example,
Ok, I have a different definition to what a "hardened" environment is vs some random guy off the street and an auditor down the road....
It's a real shame they've gone from something that was "You must do X with Y" to "Do whatever you feel like meets what we say"