Practical OT/IT cyber security guidance for critical infrastructure operators.
SOCI Act guidance, OT security insights, AESCSF walkthroughs, and lessons from the field. By O/IT Cyber — Australian OT/IT cyber security consulting.
3 posts
ASD is replacing the Essential Eight with a domain-split Essentials series, and one chapter is written for operational technology. No draft exists yet. What is confirmed, what is not, why an outcomes-based model fits OT better than a maturity ladder, and what to do before it lands.
ASD will retire the Essential Eight within about two years, replacing it with a domain-split Essentials series that includes an operational technology chapter. The Enhanced CIRMP Rules give you until June 2028 to comply with a nominated framework. Those two clocks overlap, and it changes what you should nominate.
The AESCSF has two scales and people mix them up. Maturity Indicator Levels measure where you are; Security Profiles say where you must be. The Enhanced CIRMP Rules move named energy asset classes to SP-2 by June 2028, and cumulative profiles make that further than it looks.