ACS Warns New ASD Essentials Framework Leaves Assessor Qualifications Undefined

The Australian Computer Society (ACS) has raised concerns about ASD Essentials, the Australian Signals Directorate's new cyber security framework. ASD launched it on 15 October to replace the Essential Eight. It moves away from a single overall rating and instead assesses how well cyber defences perform across different areas, supported by independent testing and practical exercises. ACS says ASD's guidance for assessors makes ratings depend on expert judgement, but sets no clear standard for assessor qualifications.

ACS CEO Dr Prins Ralston welcomed the shift from checklist-based compliance to effectiveness-based assessment. He warned, however, that inconsistent or unaccountable judgements could undermine confidence in the new regime. He asked who the experts are, what training they have and who checks them, and compared the situation with electricians, who are licensed. He also cautioned that boards could receive reports full of "fully effective" ratings that nobody can stand behind.

Dr Ralston pointed to workforce pressures as well. He said only 22 per cent of Commonwealth agencies met the old minimum standard last year, down from 25 per cent in 2023. He also said Australia is about 54,000 cyber professionals short, and that agencies will be assessed against both frameworks next year, which he argues will strain a thin workforce.