ASD Essentials Raises the Bar for Third-Party Risk to Focus on Outcomes

Australia's cyber baseline is changing, and many third-party risk programs are not keeping pace. The Australian Signals Directorate's (ASD) new Essentials framework is set to replace the Essential Eight. Instead of one maturity rating, organisations will report security area by area, with effectiveness ratings backed by evidence such as independent testing and simulated exercises. The framework also drops prescribed controls in favour of security outcomes and asks organisations to define executive and board-level accountability for cyber security.

For organisations managing third-party risk, it is no longer enough to show you did the checks. To be compliant, they will need to show action has been taken to fix identified risks. That is a shift for programs built around questionnaires and annual reviews.

Third-party risk has the same flaw

Third-party risk management (TPRM) has long had this problem. BlueVoyant research found only 12% of Australian supply chain and risk management leaders named genuine risk reduction within their third parties as a primary program driver. Most programs are shaped instead by compliance requirements, cyber insurance mandates, contractual obligations and board directives. The gap between perceived and actual TPRM program effectiveness poses a serious threat.

Teams spend thousands of hours capturing vendor risk information, cataloguing contracts and mapping ownership, leaving little time to turn that data into action. Compliance is a critical first step, but it is only a baseline, and baselines don't prevent breaches.

Where the exposure sits

Every connected organisation is at risk. According to ASD, frontier AI is speeding up how quickly adversaries can find and exploit weaknesses. Essentials tells organisations to secure identity services and internet-facing edge devices first, ahead of business systems and staff laptops.

These are exactly the points where vendor access and vendor-managed technology tend to meet the enterprise. A questionnaire completed once a year cannot tell you whether a supplier's exposed asset was patched this week. Threat actors don't operate on annual review cycles.

What action-oriented TPRM looks like

Legacy TPRM maturity frameworks measure activity, such as audits and assessments completed, rather than remediation speed or effectiveness. An action-oriented model has four connected stages:

• Risk identification and assessment: foundational due diligence and intelligent risk tiering. Where most programs begin, and where many stall.
• Continuous monitoring and intelligence: real-time visibility into vendor security posture and emerging threats.
• Actionable insights and prioritisation: distilling large datasets into validated risks teams can prioritise, assign and act on, cutting through the noise and remediation fatigue.
• Rapid and collaborative remediation: closing the loop with vendors. This is the stage most legacy models miss, and it separates resilient organisations from vulnerable ones.

In practice, stage four means vendors own their risks, and findings name the exact asset, port or vulnerability affected. Organisations further along their TPRM maturity replace slow, subjective reviews with timely, actionable guidance.

Evidence boards can use

The defining measure of an action-oriented program is not how many vendors it monitors or questionnaires it completes. It is how well the program drives high-priority issues from identification to closure. In other words, the program is judged by what it fixes, not what it files.

Completed questionnaires show effort; closed findings show results. The critical finding resolution rate, the percentage of high-risk findings remediated within a defined timeframe, shows how third-party exposures are being reduced, not just documented.

It is the kind of evidence-backed effectiveness measure ASD Essentials points towards, and it gives boards a concrete number to hold executives accountable against. Analysed by finding type, vendor tier or industry, it also reveals patterns that inform decisions from pre-onboarding due diligence to monitoring frequency, remediation expectations and renewals.

From oversight to outcomes

Third-party cyber risk has outpaced models built around compliance, assessments and point-in-time visibility. The next generation of maturity will be defined by action. Leading organisations will prioritise, escalate and resolve the issues that matter most. They will measure success by critical findings closed, exposures reduced and remediation performance improved over time.

ASD Essentials will have a transition period before it comes into force. Government agencies will be assessed against both frameworks next year, and the timeline for mandatory adoption is still being settled. But threat actors do not wait for transition periods, and neither should organisations. The time to move from oversight to outcomes is now. Every month of delay leaves critical supplier risks open and unresolved.