Back to Frameworks

Australian Energy Sector Cyber Security Framework (AESCSF)

Self-Assess
Australia
vAESCSF Version 2 Framework Core (AEMO, 2023; current per the 2025 AESCSF Overview)
11 domains
354 controls

The Australian Energy Sector Cyber Security Framework (AESCSF), maintained by AEMO with the ACSC, is the energy sector's cyber security maturity model for electricity, gas, liquid fuels and distributed energy participants. Version 2 (2023) has 354 practices and anti-patterns in 11 domains built on the US DOE C2M2 V2.1 with an Australian privacy domain, scored by Maturity Indicator Level and by ACSC Security Profiles set from an organisation's criticality, and is named in SOCI Act risk management program rules as a recognised cyber framework.

Verified

Australian Energy Sector Cyber Security Framework (AESCSF) is a compliance framework from Australia with 11 domains and 354 controls that map to 12 other frameworks. The largest domains are Cybersecurity architecture (ARCHITECTURE) – Australian Energy Sector Cyber Security Framework (AESCSF) (55 controls), Event and incident response, continuity of operations (RESPONSE) – Australian Energy Sector Cyber Security Framework (AESCSF) (46 controls), Identity and access management (ACCESS) – Australian Energy Sector Cyber Security Framework (AESCSF) (40 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated Published standard

Get the official standard. This page is a source-grounded companion to the published text, not a replacement for it.

Visit aemo.com.au

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (11)

Asset, change and configuration management (ASSET) – Australian Energy Sector Cyber Security Framework (AESCSF)

33 controls
Controls in the Asset, change and configuration management (ASSET) – Australian Energy Sector Cyber Security Framework (AESCSF) domain of Australian Energy Sector Cyber Security Framework (AESCSF): 33 controls
CodeTitle
australian-energy-sector-cyber-security-framework-aescsf::ASSET-1aASSET-1a: Important IT and OT assets inventoried
australian-energy-sector-cyber-security-framework-aescsf::ASSET-1bASSET-1b: Inventory includes assets a threat actor could leverage
australian-energy-sector-cyber-security-framework-aescsf::ASSET-1cASSET-1c: Inventoried assets prioritised by defined criteria
australian-energy-sector-cyber-security-framework-aescsf::ASSET-1dASSET-1d: Prioritisation considers leverage by threat actors
australian-energy-sector-cyber-security-framework-aescsf::ASSET-1eASSET-1e: Inventory holds attributes that support security work
australian-energy-sector-cyber-security-framework-aescsf::ASSET-1fASSET-1f: IT and OT inventory complete
australian-energy-sector-cyber-security-framework-aescsf::ASSET-1gASSET-1g: IT and OT inventory kept current
australian-energy-sector-cyber-security-framework-aescsf::ASSET-1hASSET-1h: Data removed from assets before redeployment and at end of life
australian-energy-sector-cyber-security-framework-aescsf::ASSET-2aASSET-2a: Important information assets inventoried
australian-energy-sector-cyber-security-framework-aescsf::ASSET-2bASSET-2b: Information inventory includes assets a threat actor could leverage
australian-energy-sector-cyber-security-framework-aescsf::ASSET-2cASSET-2c: Information assets categorised by defined criteria
australian-energy-sector-cyber-security-framework-aescsf::ASSET-2dASSET-2d: Information categorisation considers threat leverage
australian-energy-sector-cyber-security-framework-aescsf::ASSET-2eASSET-2e: Information inventory holds security attributes
australian-energy-sector-cyber-security-framework-aescsf::ASSET-2fASSET-2f: Information inventory complete
australian-energy-sector-cyber-security-framework-aescsf::ASSET-2gASSET-2g: Information inventory kept current
australian-energy-sector-cyber-security-framework-aescsf::ASSET-2hASSET-2h: Information sanitised or destroyed at end of life
australian-energy-sector-cyber-security-framework-aescsf::ASSET-3aASSET-3a: Configuration baselines established
australian-energy-sector-cyber-security-framework-aescsf::ASSET-3bASSET-3b: Baselines used at deployment and restoration
australian-energy-sector-cyber-security-framework-aescsf::ASSET-3cASSET-3c: Baselines incorporate architecture requirements
australian-energy-sector-cyber-security-framework-aescsf::ASSET-3dASSET-3d: Baselines reviewed periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::ASSET-3eASSET-3e: Configurations monitored against baselines
australian-energy-sector-cyber-security-framework-aescsf::ASSET-4aASSET-4a: Changes evaluated and approved before implementation
australian-energy-sector-cyber-security-framework-aescsf::ASSET-4bASSET-4b: Changes documented
australian-energy-sector-cyber-security-framework-aescsf::ASSET-4cASSET-4c: Change documentation requirements defined
australian-energy-sector-cyber-security-framework-aescsf::ASSET-4dASSET-4d: Changes to higher priority assets tested before deployment
australian-energy-sector-cyber-security-framework-aescsf::ASSET-4eASSET-4e: Changes and updates made securely
australian-energy-sector-cyber-security-framework-aescsf::ASSET-4fASSET-4f: Ability to reverse changes for important assets
australian-energy-sector-cyber-security-framework-aescsf::ASSET-4gASSET-4g: Change management covers the full asset lifecycle
australian-energy-sector-cyber-security-framework-aescsf::ASSET-4hASSET-4h: Changes to higher priority assets tested for cybersecurity impact
australian-energy-sector-cyber-security-framework-aescsf::ASSET-4iASSET-4i: Change logs record effects on cybersecurity requirements
australian-energy-sector-cyber-security-framework-aescsf::ASSET-AP1ASSET-AP1: Anti-pattern: internet-facing changes not assessed for vulnerabilities
australian-energy-sector-cyber-security-framework-aescsf::ASSET-AP2ASSET-AP2: Anti-pattern: inventories not linked to data governance or impact assessment
australian-energy-sector-cyber-security-framework-aescsf::ASSET-AP3ASSET-AP3: Anti-pattern: inventories not updated in 24 months

Australian privacy management (PRIVACY) – Australian Energy Sector Cyber Security Framework (AESCSF)

17 controls
Controls in the Australian privacy management (PRIVACY) – Australian Energy Sector Cyber Security Framework (AESCSF) domain of Australian Energy Sector Cyber Security Framework (AESCSF): 17 controls
CodeTitle
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1APRIVACY-1A: Applicable privacy requirements identified
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1BPRIVACY-1B: Personal information defined for the business
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1CPRIVACY-1C: Point of contact for privacy issues
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1DPRIVACY-1D: Activities handling personal information identified
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1EPRIVACY-1E: Personal information holdings documented
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1FPRIVACY-1F: Privacy policy documented and communicated
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1GPRIVACY-1G: Handling requirements defined in the privacy policy
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1HPRIVACY-1H: Privacy roles and accountabilities assigned
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1IPRIVACY-1I: Privacy management plan implemented
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1JPRIVACY-1J: Privacy risks recorded in a risk register
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1KPRIVACY-1K: Process for privacy enquiries, complaints and corrections
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1LPRIVACY-1L: Privacy training for staff handling personal information
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1MPRIVACY-1M: Response plans cover personal information breaches
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1NPRIVACY-1N: Data breach plans tested and improved
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1OPRIVACY-1O: Privacy compliance assessed and reported to senior management
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-1PPRIVACY-1P: Privacy management plan updated for changing threats and regulation
australian-energy-sector-cyber-security-framework-aescsf::PRIVACY-AP1PRIVACY-AP1: Anti-pattern: unaware whether personal information is collected

Cybersecurity architecture (ARCHITECTURE) – Australian Energy Sector Cyber Security Framework (AESCSF)

55 controls
Controls in the Cybersecurity architecture (ARCHITECTURE) – Australian Energy Sector Cyber Security Framework (AESCSF) domain of Australian Energy Sector Cyber Security Framework (AESCSF): 55 controls
CodeTitle
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-1aARCHITECTURE-1a: A cybersecurity architecture strategy exists
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-1bARCHITECTURE-1b: Architecture strategy aligned with the program strategy and enterprise architecture
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-1cARCHITECTURE-1c: Documented architecture covering IT and OT
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-1dARCHITECTURE-1d: Architecture governance with periodic reviews and exceptions
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-1eARCHITECTURE-1e: Visible senior sponsorship for the architecture program
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-1fARCHITECTURE-1f: Architecture sets cybersecurity requirements for assets
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-1gARCHITECTURE-1g: Controls chosen and implemented to meet requirements
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-1hARCHITECTURE-1h: Security architecture aligned with enterprise architecture
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-1iARCHITECTURE-1i: Conformance to the architecture evaluated periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-1jARCHITECTURE-1j: Architecture guided by risk analysis and threat profile
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-1kARCHITECTURE-1k: Architecture supports predefined states of operation
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2aARCHITECTURE-2a: Network protections in place
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2bARCHITECTURE-2b: IT separated from OT
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2cARCHITECTURE-2c: Network protections per asset type by risk and priority
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2dARCHITECTURE-2d: Important assets segmented into security zones
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2eARCHITECTURE-2e: Least privilege and least functionality in network protections
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2fARCHITECTURE-2f: Traffic monitored, analysed and controlled for selected zones
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2gARCHITECTURE-2g: Web and email traffic monitored and controlled
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2hARCHITECTURE-2h: All assets segmented into security zones
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2iARCHITECTURE-2i: Separate networks with independent authentication where warranted
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2jARCHITECTURE-2j: OT can run through an IT outage
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2kARCHITECTURE-2k: Only authorised devices can connect
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-2lARCHITECTURE-2l: Architecture allows isolation of compromised assets
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3aARCHITECTURE-3a: Access controls protecting important assets
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3bARCHITECTURE-3b: Endpoint protections for important assets
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3cARCHITECTURE-3c: Least privilege enforced on assets
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3dARCHITECTURE-3d: Least functionality enforced on assets
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3eARCHITECTURE-3e: Secure configuration at deployment
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3fARCHITECTURE-3f: Security applications required in device configuration
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3gARCHITECTURE-3g: Removable media controlled
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3hARCHITECTURE-3h: Controls on all assets or compensating controls
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3iARCHITECTURE-3i: Maintenance and capacity management for all assets
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3jARCHITECTURE-3j: Physical operating environment controlled
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3kARCHITECTURE-3k: More rigorous controls for higher priority assets
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3lARCHITECTURE-3l: Firmware configuration and changes controlled across the lifecycle
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-3mARCHITECTURE-3m: Unauthorised code prevented from running
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-4aARCHITECTURE-4a: Secure development for in-house software on higher priority assets
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-4bARCHITECTURE-4b: Vendor secure development considered for higher priority assets
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-4cARCHITECTURE-4c: Secure configuration required at software deployment
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-4dARCHITECTURE-4d: Secure development for all in-house software
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-4eARCHITECTURE-4e: Vendor secure development considered for all procured software
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-4fARCHITECTURE-4f: Architecture review of new and revised applications
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-4gARCHITECTURE-4g: Authenticity of software and firmware validated
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-4hARCHITECTURE-4h: Security testing of in-house applications
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-5aARCHITECTURE-5a: Sensitive data protected at rest
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-5bARCHITECTURE-5b: All data at rest protected for selected categories
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-5cARCHITECTURE-5c: All data in transit protected for selected categories
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-5dARCHITECTURE-5d: Encryption controls for data at rest and in transit
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-5eARCHITECTURE-5e: Key management infrastructure in place
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-5fARCHITECTURE-5f: Controls restrict data exfiltration
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-5gARCHITECTURE-5g: Protection for data on assets that may be lost or stolen
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-5hARCHITECTURE-5h: Protection against unauthorised changes to software, firmware and data
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-AP1ARCHITECTURE-AP1: Anti-pattern: operational assets can reach the internet directly
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-AP2ARCHITECTURE-AP2: Anti-pattern: remote or third-party access bypasses network controls
australian-energy-sector-cyber-security-framework-aescsf::ARCHITECTURE-AP3ARCHITECTURE-AP3: Anti-pattern: critical assets cannot be isolated

Cybersecurity program management (PROGRAM) – Australian Energy Sector Cyber Security Framework (AESCSF)

18 controls
Controls in the Cybersecurity program management (PROGRAM) – Australian Energy Sector Cyber Security Framework (AESCSF) domain of Australian Energy Sector Cyber Security Framework (AESCSF): 18 controls
CodeTitle
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-1aPROGRAM-1a: A cybersecurity program strategy exists
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-1bPROGRAM-1b: Strategy sets goals and objectives for cybersecurity activities
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-1cPROGRAM-1c: Strategy documented and aligned with mission, objectives and critical infrastructure risk
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-1dPROGRAM-1d: Strategy defines oversight and governance
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-1ePROGRAM-1e: Strategy defines the program's structure
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-1fPROGRAM-1f: Strategy names the standards and guidelines to follow
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-1gPROGRAM-1g: Strategy identifies compliance requirements
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-1hPROGRAM-1h: Strategy updated periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-2aPROGRAM-2a: Senior management supports the program
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-2bPROGRAM-2b: Program established according to the strategy
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-2cPROGRAM-2c: Visible, active senior sponsorship of the program
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-2dPROGRAM-2d: Senior sponsorship of cybersecurity policies
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-2ePROGRAM-2e: Program responsibility assigned to a role with authority
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-2fPROGRAM-2f: Program stakeholders identified and involved
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-2gPROGRAM-2g: Program activities reviewed against the strategy
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-2hPROGRAM-2h: Independent review of conformance with policies
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-2iPROGRAM-2i: Program enables legal and regulatory compliance
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-2jPROGRAM-2j: Collaboration on standards, practices and emerging technology

Event and incident response, continuity of operations (RESPONSE) – Australian Energy Sector Cyber Security Framework (AESCSF)

46 controls
Controls in the Event and incident response, continuity of operations (RESPONSE) – Australian Energy Sector Cyber Security Framework (AESCSF) domain of Australian Energy Sector Cyber Security Framework (AESCSF): 46 controls
CodeTitle
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-1aRESPONSE-1a: Detected events reported to a named role and recorded
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-1bRESPONSE-1b: Event detection criteria defined
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-1cRESPONSE-1c: Events documented against the criteria
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-1dRESPONSE-1d: Event information correlated for patterns
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-1eRESPONSE-1e: Detection tuned to risks and threat profile
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-1fRESPONSE-1f: Situational awareness monitored to identify events
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-2aRESPONSE-2a: Incident declaration criteria set
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-2bRESPONSE-2b: Events analysed to support declaration
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-2cRESPONSE-2c: Declaration criteria formally based on impact to the function
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-2dRESPONSE-2d: Events declared incidents according to the criteria
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-2eRESPONSE-2e: Declaration criteria updated periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-2fRESPONSE-2f: Repository tracks events and incidents to closure
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-2gRESPONSE-2g: Stakeholders identified and notified of incidents
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-2hRESPONSE-2h: Declaration criteria aligned with risk prioritisation
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-2iRESPONSE-2i: Incidents correlated across multiple incidents
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3aRESPONSE-3a: Response personnel identified and roles assigned
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3bRESPONSE-3b: Incident responses executed to limit impact and restore operations
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3cRESPONSE-3c: Incidents reported internally and externally
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3dRESPONSE-3d: Incident response plans cover the whole lifecycle
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3eRESPONSE-3e: Response follows defined plans and procedures
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3fRESPONSE-3f: Response plans include a stakeholder communications plan
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3gRESPONSE-3g: Response plan exercises held periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3hRESPONSE-3h: Lessons learned captured and acted on
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3iRESPONSE-3i: Root-cause analysis performed and acted on
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3jRESPONSE-3j: Response coordinated with external entities including evidence handling
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3kRESPONSE-3k: Responders take part in joint exercises with other organisations
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3lRESPONSE-3l: Responses use and trigger predefined states of operation
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4aRESPONSE-4a: Continuity plans to sustain and restore the function
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4bRESPONSE-4b: Backups available and tested
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4cRESPONSE-4c: Assets needing spares identified
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4dRESPONSE-4d: Continuity plans address cyber incident impacts
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4eRESPONSE-4e: Assets and activities for minimum operations documented
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4fRESPONSE-4f: Plans cover important assets, backups and spares
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4gRESPONSE-4g: RTOs and RPOs in continuity plans
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4hRESPONSE-4h: Incident criteria triggering continuity plans set and communicated
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4iRESPONSE-4i: Continuity plans tested periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4jRESPONSE-4j: Backup controls at least as strong as source
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4kRESPONSE-4k: Backups separated from source data
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4lRESPONSE-4l: Spares available for selected assets
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4mRESPONSE-4m: Continuity plans aligned with risks and threat profile
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4nRESPONSE-4n: Continuity exercises address higher priority risks
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4oRESPONSE-4o: Test and activation results compared with recovery objectives
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-4pRESPONSE-4p: Continuity plans reviewed and updated periodically
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-AP1RESPONSE-AP1: Anti-pattern: critical functions not identified
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-AP2RESPONSE-AP2: Anti-pattern: services and assets supporting critical functions not identified
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-AP3RESPONSE-AP3: Anti-pattern: responders do not know which authorities to contact

Identity and access management (ACCESS) – Australian Energy Sector Cyber Security Framework (AESCSF)

40 controls
Controls in the Identity and access management (ACCESS) – Australian Energy Sector Cyber Security Framework (AESCSF) domain of Australian Energy Sector Cyber Security Framework (AESCSF): 40 controls
CodeTitle
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-1aACCESS-1a: Identities created for people, services and devices needing access
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-1bACCESS-1b: Credentials issued to those needing access
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-1cACCESS-1c: Identities removed when no longer needed
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-1dACCESS-1d: Password strength and reuse rules set and enforced
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-1eACCESS-1e: Identity repositories reviewed on a schedule and on triggers
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-1fACCESS-1f: Deprovisioning within defined time limits
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-1gACCESS-1g: Privileged credentials used only where needed
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-1hACCESS-1h: Stronger authentication for higher risk access
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-1iACCESS-1i: Multifactor authentication for all access where feasible
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-1jACCESS-1j: Inactive identities disabled after a set period
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-2aACCESS-2a: Logical access controls in place
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-2bACCESS-2b: Logical access revoked when no longer needed
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-2cACCESS-2c: Logical access requirements defined and maintained
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-2dACCESS-2d: Least privilege built into logical access rules
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-2eACCESS-2e: Separation of duties built into logical access rules
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-2fACCESS-2f: Asset owners approve logical access requests
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-2gACCESS-2g: Extra scrutiny and monitoring for higher risk logical access
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-2hACCESS-2h: Logical access reviewed on schedule, triggers and after elevation
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-2iACCESS-2i: Anomalous logical access attempts monitored
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-3aACCESS-3a: Physical access controls in place
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-3bACCESS-3b: Physical access revoked when no longer needed
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-3cACCESS-3c: Physical access logs kept
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-3dACCESS-3d: Physical access requirements defined and maintained
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-3eACCESS-3e: Least privilege applied to physical access
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-3fACCESS-3f: Separation of duties applied to physical access
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-3gACCESS-3g: Asset owners approve physical access requests
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-3hACCESS-3h: Extra scrutiny and monitoring for higher risk physical access
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-3iACCESS-3i: Physical access privileges reviewed and updated
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-3jACCESS-3j: Physical access monitored for cybersecurity events
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-AP1ACCESS-AP1: Anti-pattern: access provisioned before need is confirmed
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-AP10ACCESS-AP10: Anti-pattern: access reviews do not test continued need
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-AP11ACCESS-AP11: Anti-pattern: no policy ban on unauthorised devices reaching critical assets
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-AP2ACCESS-AP2: Anti-pattern: no complete register of privileged users
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-AP3ACCESS-AP3: Anti-pattern: deprovisioning ignores risk criteria
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-AP4ACCESS-AP4: Anti-pattern: single-factor access to non-public internet-facing assets
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-AP5ACCESS-AP5: Anti-pattern: privileged access granted by default
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-AP6ACCESS-AP6: Anti-pattern: access that breaches segregation of duties
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-AP7ACCESS-AP7: Anti-pattern: users not individually attributable
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-AP8ACCESS-AP8: Anti-pattern: unusual access not monitored
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-AP9ACCESS-AP9: Anti-pattern: unknown users or devices can connect to known assets

Risk management (RISK) – Australian Energy Sector Cyber Security Framework (AESCSF)

37 controls
Controls in the Risk management (RISK) – Australian Energy Sector Cyber Security Framework (AESCSF) domain of Australian Energy Sector Cyber Security Framework (AESCSF): 37 controls
CodeTitle
australian-energy-sector-cyber-security-framework-aescsf::RISK-1aRISK-1a: A cyber risk management strategy exists
australian-energy-sector-cyber-security-framework-aescsf::RISK-1bRISK-1b: Risk strategy aligned with program strategy and enterprise architecture
australian-energy-sector-cyber-security-framework-aescsf::RISK-1cRISK-1c: Risk management program operates per the strategy
australian-energy-sector-cyber-security-framework-aescsf::RISK-1dRISK-1d: Risk information communicated to stakeholders
australian-energy-sector-cyber-security-framework-aescsf::RISK-1eRISK-1e: Risk program governance in place
australian-energy-sector-cyber-security-framework-aescsf::RISK-1fRISK-1f: Visible senior sponsorship of risk program
australian-energy-sector-cyber-security-framework-aescsf::RISK-1gRISK-1g: Risk program aligned with mission and objectives
australian-energy-sector-cyber-security-framework-aescsf::RISK-1hRISK-1h: Cyber risk coordinated with enterprise risk management
australian-energy-sector-cyber-security-framework-aescsf::RISK-2aRISK-2a: Cyber risks identified
australian-energy-sector-cyber-security-framework-aescsf::RISK-2bRISK-2b: Defined method used to identify risks
australian-energy-sector-cyber-security-framework-aescsf::RISK-2cRISK-2c: Operations and business stakeholders take part in risk identification
australian-energy-sector-cyber-security-framework-aescsf::RISK-2dRISK-2d: Risks consolidated into categories
australian-energy-sector-cyber-security-framework-aescsf::RISK-2eRISK-2e: Risks recorded in a register
australian-energy-sector-cyber-security-framework-aescsf::RISK-2fRISK-2f: Risks assigned to owners
australian-energy-sector-cyber-security-framework-aescsf::RISK-2gRISK-2g: Risk identification repeated periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::RISK-2hRISK-2h: Risk identification uses asset inventory and priority data
australian-energy-sector-cyber-security-framework-aescsf::RISK-2iRISK-2i: Vulnerability information updates risks
australian-energy-sector-cyber-security-framework-aescsf::RISK-2jRISK-2j: Threat information updates risks
australian-energy-sector-cyber-security-framework-aescsf::RISK-2kRISK-2k: Third-party information updates risks
australian-energy-sector-cyber-security-framework-aescsf::RISK-2lRISK-2l: Architecture gaps update risks
australian-energy-sector-cyber-security-framework-aescsf::RISK-2mRISK-2m: Risks from and to critical infrastructure and interdependencies considered
australian-energy-sector-cyber-security-framework-aescsf::RISK-3aRISK-3a: Risks prioritised by estimated impact
australian-energy-sector-cyber-security-framework-aescsf::RISK-3bRISK-3b: Defined criteria used to prioritise risks
australian-energy-sector-cyber-security-framework-aescsf::RISK-3cRISK-3c: Defined method estimates impact of higher priority risks
australian-energy-sector-cyber-security-framework-aescsf::RISK-3dRISK-3d: Defined methods analyse higher priority risks
australian-energy-sector-cyber-security-framework-aescsf::RISK-3eRISK-3e: Stakeholders take part in analysing higher priority risks
australian-energy-sector-cyber-security-framework-aescsf::RISK-3fRISK-3f: Risks removed from register when no longer needed
australian-energy-sector-cyber-security-framework-aescsf::RISK-3gRISK-3g: Risk analyses updated periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::RISK-4aRISK-4a: Risk responses implemented
australian-energy-sector-cyber-security-framework-aescsf::RISK-4bRISK-4b: Defined method selects and implements responses
australian-energy-sector-cyber-security-framework-aescsf::RISK-4cRISK-4c: Controls evaluated for design and operation
australian-energy-sector-cyber-security-framework-aescsf::RISK-4dRISK-4d: Leadership reviews impact analyses with control evaluations
australian-energy-sector-cyber-security-framework-aescsf::RISK-4eRISK-4e: Leadership periodically reviews risk responses
australian-energy-sector-cyber-security-framework-aescsf::RISK-AP1RISK-AP1: Anti-pattern: identified risks not periodically reviewed
australian-energy-sector-cyber-security-framework-aescsf::RISK-AP2RISK-AP2: Anti-pattern: risks left untreated for long periods
australian-energy-sector-cyber-security-framework-aescsf::RISK-AP3RISK-AP3: Anti-pattern: assets risk-assessed in isolation
australian-energy-sector-cyber-security-framework-aescsf::RISK-AP4RISK-AP4: Anti-pattern: risk activities not guided by risk criteria

Situational awareness (SITUATION) – Australian Energy Sector Cyber Security Framework (AESCSF)

33 controls
Controls in the Situational awareness (SITUATION) – Australian Energy Sector Cyber Security Framework (AESCSF) domain of Australian Energy Sector Cyber Security Framework (AESCSF): 33 controls
CodeTitle
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-1aSITUATION-1a: Logging on important assets
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-1bSITUATION-1b: Logging on assets a threat actor could leverage
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-1cSITUATION-1c: Logging requirements set for important and leverageable assets
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-1dSITUATION-1d: Logging requirements set for monitoring infrastructure
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-1eSITUATION-1e: Log data aggregated
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-1fSITUATION-1f: More rigorous logging for higher priority assets
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-2aSITUATION-2a: Log data and monitoring reviewed periodically
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-2bSITUATION-2b: Monitoring infrastructure data and alerts reviewed
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-2cSITUATION-2c: Monitoring and analysis requirements set for timely review
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-2dSITUATION-2d: Indicators of anomalous activity defined and monitored across IT and OT
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-2eSITUATION-2e: Alarms and alerts configured for cybersecurity events
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-2fSITUATION-2f: Monitoring aligned with the threat profile
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-2gSITUATION-2g: More rigorous monitoring for higher priority assets
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-2hSITUATION-2h: Risk analysis used to identify anomaly indicators
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-2iSITUATION-2i: Indicators reviewed periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-3aSITUATION-3a: Methods to communicate the current cybersecurity state
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-3bSITUATION-3b: Monitoring data aggregated to show operational state
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-3cSITUATION-3c: Information from across the organisation enhances awareness
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-3dSITUATION-3d: Situational awareness reporting requirements defined
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-3eSITUATION-3e: External information collected and shared internally
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-3fSITUATION-3f: Near-real-time capability to aggregate, correlate and analyse monitoring
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-3gSITUATION-3g: Predefined states of operation documented
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-AP1SITUATION-AP1: Anti-pattern: operational assets monitored only for performance
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-AP10SITUATION-AP10: Anti-pattern: logs of impacted assets cannot be inspected
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-AP11SITUATION-AP11: Anti-pattern: IOCs cannot be added to monitoring of critical assets
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-AP2SITUATION-AP2: Anti-pattern: logs monitored only during incidents
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-AP3SITUATION-AP3: Anti-pattern: normal operation not baselined
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-AP4SITUATION-AP4: Anti-pattern: alerts exclude security events
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-AP5SITUATION-AP5: Anti-pattern: logs not time synchronised
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-AP6SITUATION-AP6: Anti-pattern: critical asset logs stored only on the asset
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-AP7SITUATION-AP7: Anti-pattern: unnecessary write access to central logs
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-AP8SITUATION-AP8: Anti-pattern: third-party privileged access not logged
australian-energy-sector-cyber-security-framework-aescsf::SITUATION-AP9SITUATION-AP9: Anti-pattern: IOCs considered only during or after incidents

Supply chain and external dependencies management (THIRD-PARTIES) – Australian Energy Sector Cyber Security Framework (AESCSF)

19 controls
Controls in the Supply chain and external dependencies management (THIRD-PARTIES) – Australian Energy Sector Cyber Security Framework (AESCSF) domain of Australian Energy Sector Cyber Security Framework (AESCSF): 19 controls
CodeTitle
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-1aTHIRD-PARTIES-1a: Important third-party dependencies identified
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-1bTHIRD-PARTIES-1b: Third parties with access, control or custody identified
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-1cTHIRD-PARTIES-1c: Defined method identifies third-party risks
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-1dTHIRD-PARTIES-1d: Third parties prioritised by established criteria
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-1eTHIRD-PARTIES-1e: Escalated priority for high-consequence third parties
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-1fTHIRD-PARTIES-1f: Third-party prioritisation updated periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2aTHIRD-PARTIES-2a: Supplier selection considers cybersecurity qualifications
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2bTHIRD-PARTIES-2b: Product and service selection considers security capabilities
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2cTHIRD-PARTIES-2c: Defined method sets third-party security requirements and controls
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2dTHIRD-PARTIES-2d: Defined method evaluates and selects third parties
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2eTHIRD-PARTIES-2e: More rigorous controls for higher priority third parties
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2fTHIRD-PARTIES-2f: Security requirements formalised in agreements
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2gTHIRD-PARTIES-2g: Third parties periodically attest to requirements
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2hTHIRD-PARTIES-2h: Secure development requirements for suppliers
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2iTHIRD-PARTIES-2i: Product selection considers end of life and support
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2jTHIRD-PARTIES-2j: Selection considers safeguards against counterfeit or compromised items
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2kTHIRD-PARTIES-2k: Bills of material evaluated for higher priority assets
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2lTHIRD-PARTIES-2l: Hosting environments and source data evaluated for higher priority assets
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-2mTHIRD-PARTIES-2m: Acceptance testing includes security requirements

Threat and vulnerability management (THREAT) – Australian Energy Sector Cyber Security Framework (AESCSF)

27 controls
Controls in the Threat and vulnerability management (THREAT) – Australian Energy Sector Cyber Security Framework (AESCSF) domain of Australian Energy Sector Cyber Security Framework (AESCSF): 27 controls
CodeTitle
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1aTHREAT-1a: Vulnerability information sources identified
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1bTHREAT-1b: Vulnerability information gathered and interpreted
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1cTHREAT-1c: Vulnerability assessments performed
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1dTHREAT-1d: Relevant vulnerabilities mitigated
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1eTHREAT-1e: Sources covering higher priority assets monitored
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1fTHREAT-1f: Vulnerability assessments periodic and triggered
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1gTHREAT-1g: Vulnerabilities analysed, prioritised and addressed
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1hTHREAT-1h: Operational impact evaluated before patching
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1iTHREAT-1i: Vulnerability information shared with defined stakeholders
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1jTHREAT-1j: Sources covering all IT and OT assets monitored
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1kTHREAT-1k: Independent vulnerability assessments
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1lTHREAT-1l: Vulnerability responses checked for effectiveness
australian-energy-sector-cyber-security-framework-aescsf::THREAT-1mTHREAT-1m: Mechanism to receive external vulnerability reports
australian-energy-sector-cyber-security-framework-aescsf::THREAT-2aTHREAT-2a: Threat information sources identified
australian-energy-sector-cyber-security-framework-aescsf::THREAT-2bTHREAT-2b: Threat information gathered and interpreted
australian-energy-sector-cyber-security-framework-aescsf::THREAT-2cTHREAT-2c: Threat objectives identified
australian-energy-sector-cyber-security-framework-aescsf::THREAT-2dTHREAT-2d: Relevant threats addressed
australian-energy-sector-cyber-security-framework-aescsf::THREAT-2eTHREAT-2e: Threat profile established
australian-energy-sector-cyber-security-framework-aescsf::THREAT-2fTHREAT-2f: Sources covering the whole threat profile prioritised and monitored
australian-energy-sector-cyber-security-framework-aescsf::THREAT-2gTHREAT-2g: Threats analysed, prioritised and addressed
australian-energy-sector-cyber-security-framework-aescsf::THREAT-2hTHREAT-2h: Threat information exchanged with stakeholders
australian-energy-sector-cyber-security-framework-aescsf::THREAT-2iTHREAT-2i: Threat profile updated periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::THREAT-2jTHREAT-2j: Threat activities use and trigger predefined states of operation
australian-energy-sector-cyber-security-framework-aescsf::THREAT-2kTHREAT-2k: Secure near-real-time threat sharing methods
australian-energy-sector-cyber-security-framework-aescsf::THREAT-AP1THREAT-AP1: Anti-pattern: no compensating controls where remediation is blocked
australian-energy-sector-cyber-security-framework-aescsf::THREAT-AP2THREAT-AP2: Anti-pattern: internet-facing assets not periodically assessed
australian-energy-sector-cyber-security-framework-aescsf::THREAT-AP3THREAT-AP3: Anti-pattern: controls not updated for new high-priority threats

Workforce management (WORKFORCE) – Australian Energy Sector Cyber Security Framework (AESCSF)

29 controls
Controls in the Workforce management (WORKFORCE) – Australian Energy Sector Cyber Security Framework (AESCSF) domain of Australian Energy Sector Cyber Security Framework (AESCSF): 29 controls
CodeTitle
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-1aWORKFORCE-1a: Vetting at hire
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-1bWORKFORCE-1b: Separation procedures address cybersecurity
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-1cWORKFORCE-1c: Periodic vetting for positions with access to important assets
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-1dWORKFORCE-1d: Separation and transfer procedures address cybersecurity with supplementary vetting
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-1eWORKFORCE-1e: Personnel aware of protection and acceptable use responsibilities
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-1fWORKFORCE-1f: Vetting for all positions by position risk
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-1gWORKFORCE-1g: Formal accountability and disciplinary process
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-2aWORKFORCE-2a: Awareness activities occur
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-2bWORKFORCE-2b: Awareness objectives set
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-2cWORKFORCE-2c: Awareness objectives aligned with the threat profile
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-2dWORKFORCE-2d: Awareness activities periodic
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-2eWORKFORCE-2e: Awareness tailored to job role
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-2fWORKFORCE-2f: Awareness covers predefined states of operation
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-2gWORKFORCE-2g: Awareness effectiveness evaluated and improved
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-3aWORKFORCE-3a: Cybersecurity responsibilities identified
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-3bWORKFORCE-3b: Responsibilities assigned to specific people
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-3cWORKFORCE-3c: Responsibilities assigned to roles including service providers
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-3dWORKFORCE-3d: Responsibilities documented
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-3eWORKFORCE-3e: Responsibilities reviewed periodically and on triggers
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-3fWORKFORCE-3f: Coverage, redundancy and succession managed
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-4aWORKFORCE-4a: Training available for people with cybersecurity responsibilities
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-4bWORKFORCE-4b: Knowledge, skill and ability gaps identified
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-4cWORKFORCE-4c: Gaps addressed by training, recruiting and retention
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-4dWORKFORCE-4d: Training required before access to important assets
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-4eWORKFORCE-4e: Training effectiveness evaluated and improved
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-4fWORKFORCE-4f: Continuing education for significant cybersecurity roles
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-AP1WORKFORCE-AP1: Anti-pattern: capability depends on one or two people with no succession
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-AP2WORKFORCE-AP2: Anti-pattern: people working with critical assets lack added responsibilities
australian-energy-sector-cyber-security-framework-aescsf::WORKFORCE-AP3WORKFORCE-AP3: Anti-pattern: people unaware of their added responsibilities

Your Compliance Coverage

If you comply with Australian Energy Sector Cyber Security Framework (AESCSF), you already cover:

NIST Cybersecurity Framework 2.0

5%

19 controls mapped

Compare →

NIST SP 800-53 Rev 5

2%

9 controls mapped

Compare →

ISO 27002:2022

1%

3 controls mapped

Compare →

+ 9 more: ISO 27018:2019 (1%), ISO 27001:2022 (1%)

See all 12 mapped frameworks ↓

Maps to 12 other frameworks

386 total controls
NIST Cybersecurity Framework 2.0
19 source controls mapped|19 target controls covered
5%
NIST SP 800-53 Rev 5
9 source controls mapped|10 target controls covered
2%
ISO 27002:2022
3 source controls mapped|3 target controls covered
1%
ISO 27018:2019
2 source controls mapped|2 target controls covered
1%
ISO 27001:2022
2 source controls mapped|2 target controls covered
1%
ACSC Essential Eight
2 source controls mapped|3 target controls covered
1%
Australian Privacy Principles (APPs)
2 source controls mapped|2 target controls covered
1%
ISO 45001:2018
1 source controls mapped|2 target controls covered
0%
ISO 55001:2014
1 source controls mapped|1 target controls covered
0%
ISO 37001:2016
1 source controls mapped|1 target controls covered
0%
ISO 27701:2019
1 source controls mapped|1 target controls covered
0%
ISO 10007:2017
1 source controls mapped|1 target controls covered
0%
Compare Australian Energy Sector Cyber Security Framework (AESCSF) with NIST Cybersecurity Framework 2.0

Coverage is not the same as your position

This page shows what Australian Energy Sector Cyber Security Framework (AESCSF) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is Australian Energy Sector Cyber Security Framework (AESCSF) and who does it apply to?

Australian Energy Sector Cyber Security Framework (AESCSF) is a compliance framework from Australia with 11 domains and 354 controls. The Australian Energy Sector Cyber Security Framework (AESCSF), maintained by AEMO with the ACSC, is the energy sector's cyber security maturity model for electricity, gas, liquid fuels and distributed energy participants. Version 2 (2023) has 354 practices and anti-patterns in 11 domains built on the US DOE C2M2 V2.1 with an Australian privacy domain, scored by Maturity Indicator Level and by ACSC Security Profiles set from an organisation's criticality, and is named in SOCI Act risk management program rules as a recognised cyber framework. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Australian Energy Sector Cyber Security Framework (AESCSF) actually require?

Australian Energy Sector Cyber Security Framework (AESCSF) has 354 controls organised across 11 domains. The largest domains are Cybersecurity architecture (ARCHITECTURE) – Australian Energy Sector Cyber Security Framework (AESCSF) (55 controls), Event and incident response, continuity of operations (RESPONSE) – Australian Energy Sector Cyber Security Framework (AESCSF) (46 controls), Identity and access management (ACCESS) – Australian Energy Sector Cyber Security Framework (AESCSF) (40 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Australian Energy Sector Cyber Security Framework (AESCSF) do I already cover?

Australian Energy Sector Cyber Security Framework (AESCSF) maps to 12 other compliance frameworks. The top mapping partners are NIST Cybersecurity Framework 2.0 (5% coverage), NIST SP 800-53 Rev 5 (2% coverage), ISO 27002:2022 (1% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement Australian Energy Sector Cyber Security Framework (AESCSF)?

Start your Australian Energy Sector Cyber Security Framework (AESCSF) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Australian Energy Sector Cyber Security Framework (AESCSF) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 354 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required