Frameworks
AESCSF Self-Assessment: How It Works & How to Simplify
The AESCSF Self-Assessment & How Australia's Energy Sector Measures Cyber Maturity
The Australian Energy Sector Cyber Security Framework (AESCSF) is a voluntary framework and annual assessment programme for Australia's energy sector. It gives energy market operators a structured way to assess, benchmark, and improve their cyber security maturity against a common standard.
The AESCSF leverages international industry frameworks including the US Department of Energy's Electricity Subsector Cybersecurity Capability Maturity Model (ES-C2M2) and the NIST Cyber Security Framework. It also incorporates Australian-specific control references, including the ACSC Essential Eight, the Australian Privacy Principles (APPs), and the Notifiable Data Breaches (NDB) scheme.
Developed through collaboration between AEMO, the ACSC, and the Cyber and Infrastructure Security Centre (CISC), the aim is to help energy market operators assess, benchmark, and improve their cybersecurity maturity in a coordinated and standardised way.
This post walks through how the AESCSF assessment works in practice: the criticality assessment, the maturity self-assessment, the 11 domains, how scoring works, and how Overcyte simplifies the process.
Energy Sector Operators Are Being Actively Targeted
A prolonged and widespread failure in Australia's distributed energy sector could result in shortages of or disruption to essential medical supplies and food across the country, telecoms network outages and downstream disruption to transport and traffic management systems and critical fuel supplies.
The ASD Annual Cyber Threat Report 2024-25 reinforces why. ASD's ACSC responded to over 1,200 cybersecurity incidents during the reporting period, an 11% increase on the prior year. Critical infrastructure accounted for 13% of all incidents, up from 11% the year before. ASD notified critical infrastructure entities of potential malicious cyber activity over 190 times, a 111% increase. The report confirms that state-sponsored cyber actors routinely target Australian critical infrastructure networks for espionage and, in some cases, to pre-position for disruptive and destructive cyber effects in the event of crisis or conflict.
As an example of these attacks, the previous year's ASD report highlighted how an energy supplier in New South Wales lost remote connectivity with the supervisory control and data acquisition (SCADA) system at two of its sites following a brute-force attack targeting a vulnerability in the company's perimeter VPN devices.
Under a barrage of login attempts, MFA provided effective control, but even authorised connection requests were dropped. There was no interruption to energy supply in this incident, but it took the company eight hours to restore VPN services and highlighted the need to have effective security in place.
How and Where the Framework Is Applied
The first iteration of the AESCSF framework was released in 2018, and as Australia's focus on regulating critical infrastructure organisations has grown, so too has the AESCSF.
In 2021 and 2022, the coverage was expanded to other Energy Market Operators, including liquid fuels and gas markets, and alignment was sought with the Security of Critical Infrastructure Act (SOCI). Version 2 was launched in October 2023, expanding the framework from 282 to 354 practices and anti-patterns and placing greater emphasis on operational technology and supply chain security:
From Voluntary Programme to Legal Obligation
In December 2024, the AEMC published a final rule that formally embedded AEMO's cyber security responsibilities in the National Electricity Rules. This codified four functions for AEMO: cyber security incident coordinator for the NEM, stewardship of the AESCSF programme, examining cyber risks and advising government and industry, and facilitating critical cyber security information sharing with market participants. Before this rule change, AEMO managed the AESCSF programme without a specific mandate in the NER.
In January 2026, the AEMC began consulting on extending the same cyber security roles to the gas sector under the National Gas Rules.
In June 2026, the Enhanced CIRMP Rules under the SOCI Act made the AESCSF's significance more concrete. Energy-responsible entities designated as high-risk must now achieve AESCSF Security Profile 2 by 30 June, 2028. The annual self-assessment is no longer just a voluntary benchmarking exercise; it generates the evidence base for a binding legal obligation.
How the Assessment Is Structured
The AESCSF is quite novel when compared with other international approaches. It comprises a set of security practices for Australia's energy sector and a methodology for organisations to 1) assess their criticality within the national energy system and 2) assess their maturity against the security practices listed.
The Australian Energy Market Operator (AEMO) runs the national programme and states that the framework "describes what your organisation should strive to achieve, not how it should be achieved."
The Eleven AESCSF Domains
The AESCSF is organised into 11 domains which group relevant practices together:
- Program (Cybersecurity program management)
- Workforce
- Cybersecurity Architecture
- Response, Continuity of Operations / Incident Response
- Third Parties / External Dependencies Management (i.e. supply chain, etc.)
- Situational Awareness
- Threat and Vulnerability Management
- Identity and Access Management
- Asset, Change and Configuration Management
- Risk Management
- Australian Privacy Management (APM), which covers the handling of personal information.
Criticality, Maturity Levels, and Security Profiles
Organisations initially use a Criticality Assessment Tool (CAT) to put them into a band (High / Medium / Low) based on how much impact a cyber incident could have on energy sector operations.
Ratings against the eleven practices are then made by selecting a Maturity Indicator Level (MIL) ranging from 1 to 3. Your overall MIL is determined by the lowest score across all domains, which means one weak domain pulls the entire rating down.
Security Profiles (SPs) are also set out for the set of practices (SP-1, SP-2, SP-3). Which profile is applied is determined by the criticality rating. More critical organisations are expected to achieve more stringent cybersecurity maturity by aligning to a higher-level profile.
Anti-patterns that hinder cybersecurity maturity are also provided so that organisations can make efforts to avoid or mitigate them.
Sounds complex? Dig into the detail on the AEMO website to learn more.
How the AESCSF Feeds into Your SOCI Obligations
One of the most common questions from energy sector compliance teams is how the AESCSF relates to the SOCI Act. The short answer: the SOCI Act is the legal obligation, and the AESCSF is one of five frameworks CISC recognises as meeting the cyber security requirements within your Critical Infrastructure Risk Management Program (CIRMP).
Completing your annual AESCSF self-assessment directly satisfies the framework alignment component of your CIRMP cyber security requirements. For energy sector operators, the two are not separate workstreams. Assess once against the AESCSF, and the maturity evidence and gap analysis feeds into both your AEMO submission and your SOCI CIRMP documentation.
This became more consequential in June 2026. The Enhanced CIRMP Rules (registered 9 June 2026) now require AESCSF Security Profile 2 across all domains by 30 June 2028 for designated high-risk energy asset classes. Most energy responsible entities currently sit at SP-1, and the SP-1to SP-2 jump requires foundational controls to be operationalised, measured, and improved rather than simply documented.
For more on the SOCI Act's core obligations across all 11regulated sectors, see the SOCI Act compliance page.
Simplify Your AESCSF Assessment
Using Overcyte, companies can complete both parts of the AESCSF assessment:
- Criticality Assessment
- Cyber Security Capability and Maturity Self-Assessment
The platform enables the assessor to submit artefacts to support their ratings and score the practices one by one, adding findings and recommendations as they progress through the controls.
At SP-3, there are 354 Practices and Anti-Patterns across 11 domains and 37 subdomains.
A reporting dashboard provides an overall view of their maturity and areas to focus on in a future security uplift programme.
AEMO manages the formal industry programme of supervisory reporting which takes place each year. The 2026 assessment portal was open from 16 March to 1 May 2026, with sector benchmarking to follow.
With Overcyte's implementation of the AESCSF assessment, security teams can manage their ratings and remediation efforts in a single platform with continuous reporting that tracks progress year on year. For organisations now working toward the SP-2 requirement by June 2028, this trending visibility is how you track whether your uplift programme is on pace.
Overcyte also supports Essential Eight, ISO 27001, NIST CSF, ISA/IEC 62443, and other frameworks alongside AESCSF, so teams managing obligations across multiple standards work from a single view.
Book a demo to see how Overcyte supports your AESCSF assessment and SOCI compliance workflow.
Similar posts
Identify. Secure. Assure.
.png)
