Practical OT/IT cyber security guidance for critical infrastructure operators.
SOCI Act guidance, OT security insights, AESCSF walkthroughs, and lessons from the field. By O/IT Cyber — Australian OT/IT cyber security consulting.
O/IT Cyber
Practical OT/IT cyber security guidance for critical infrastructure operators in Australia — SOCI Act compliance, framework maturity, and lessons from real engagements.
ASD is replacing the Essential Eight with a domain-split Essentials series, and one chapter is written for operational technology. No draft exists yet. What is confirmed, what is not, why an outcomes-based model fits OT better than a maturity ladder, and what to do before it lands.
6 min readASD will retire the Essential Eight within about two years, replacing it with a domain-split Essentials series that includes an operational technology chapter. The Enhanced CIRMP Rules give you until June 2028 to comply with a nominated framework. Those two clocks overlap, and it changes what you should nominate.
6 min readTelecommunications assets have specific requirements under the SOCI Act TSRMP framework. What the risk management program needs to cover and where most entities leave gaps.
10 min readThe regime now has three obligation layers and two of them are called enhanced. They apply to different populations, are triggered differently, and demand different things. Which ones you can look up today, and which one arrives privately.
5 min readThe AESCSF has two scales and people mix them up. Maturity Indicator Levels measure where you are; Security Profiles say where you must be. The Enhanced CIRMP Rules move named energy asset classes to SP-2 by June 2028, and cumulative profiles make that further than it looks.
5 min read