Australia · AEMO (in partnership with CISC and industry) · AESCSF

Australian Energy Sector Cyber Security Framework

A tailored framework used across Australia's electricity, gas and liquid-fuels sectors to measure cyber-security maturity.

What it is

AEMO, the AEMC and CISC developed the AESCSF, a criticality-tiered assessment framework. It draws on NIST CSF, ES-C2M2 (US Department of Energy) and the Essential Eight. A "Criticality Assessment Tool" sets the level of rigour expected. Participants self-assess each year and report results to regulators. Energy-sector critical-infrastructure assets can use these results to meet the CIRMP attestation pathway.

Who it applies to

Electricity, gas and liquid-fuels sector participants - mainly those registered with AEMO, plus major retailers and network operators. Water-sector operators adopt it voluntarily.

Australian Energy Sector Cyber Security Framework

Requirements

Criticality assessment

Set the target Security Profile (SP) level you'll be assessed against.

Domain-level self-assessment

Score maturity across 11 domains including Risk Management, Asset Change, Identity & Access, Situational Awareness and Cyber Incident Management.

Uplift planning

Identify gaps to the target SP level and plan uplift work, usually within the annual cycle.

Reporting

Submit results to AEMO. Use them to meet related CIRMP cyber-hazard obligations.

Sources

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.