The Australian Energy Sector Cyber Security Framework (AESCSF) has been developed by AEMO to provide a structured approach for energy sector organisations to uplift their cybersecurity maturity.

Although AESCSF was designed for traditional energy infrastructure operators, its principles are becoming increasingly relevant for CER operators. Aggregated CER fleets often exceed the capacity of conventional power plants, making them attractive targets for cyberattacks. Risks that have been identified for CER cybersecurity include loss of control over CER assets, denial-of-service attacks on fleet management systems, and malware or ransomware targeting cloud-based platforms and communication networks.

By 2030, 50% of consumers are expected to engage with CER such as rooftop PV, creating millions of potential cyber entry points and the AESCSF provides a voluntary framework to help CER businesses benchmark their cybersecurity posture and identify areas for improvement.

Current AESCSF guidance does not specifically address CER-specific challenges, but initiatives such as Version 2 Lite, co-developed with the ASD, aim to provide tailored advice for CER integration. The Lite Framework has been specifically developed to enable self-assessment against the AESCSF by lower-criticality market entities without the resources to undertake a full assessment. As such, the Lite Framework may be suited to new market entrants and existing market participants working at smaller scales. Suppliers of CER products and services are generally encouraged to (at least) self-assess against the Lite Framework.

Key points

• The AESCSF helps energy-sector organisations assess and improve cybersecurity maturity.
• The Lite Framework provides a more accessible assessment pathway for smaller or lower-criticality organisations.
• The ASD's Essential Eight provides a practical baseline for protecting CER-related IT systems.

How is the AESCSF structured?

Rather than prescribing specific technical solutions, AESCSF defines what organisations should achieve to maintain cyber resilience. The framework is built around core principles of confidentiality, integrity, and availability, supported by an assessment tool known as the Cybersecurity Assessment Tool (CAT). This tool enables organisations to self-assess against sector-specific criteria and maturity levels. AESCSF also outlines security practices that span governance, risk management, incident response, and technical controls, providing a holistic approach to cybersecurity.

The AESCSF maturity model is central to its implementation. It encourages organisations to progress through five defined capability levels by focusing on governance, operational resilience, technical controls, and continuous improvement:

• Level 0: No Capability: The organisation has minimal cybersecurity measures in place
• Level 1: Initial: Basic, ad hoc practices exist
• Level 2: Defined: Policies and procedures are documented and communicated
• Level 3: Managed: Cybersecurity is embedded in business processes
• Level 4: Optimised: Continuous improvement is in place.

AESCSF governance guidance includes establishing clear policies, roles, and responsibilities, while operational resilience ensures systems can withstand and recover from cyber incidents. Continuous improvement is achieved through regular reviews and participation in the AESCSF Annual Program of Assessment, which benchmarks performance across the sector and identifies emerging threats.

AESCSF complements broader national cybersecurity strategies, including the Australian Cyber Security Strategy 2020, which emphasises protecting critical infrastructure and supporting businesses to meet cybersecurity standards. AESCSF aligns with Australian regulatory frameworks such as the SOCI Act and the APPs, ensuring consistency with national security objectives and SOCI Act amendments that introduce obligations for risk management programs and incident reporting for critical assets.

IT Technical Controls for Cyber Security

The ASD recommends the Essential Eight as a baseline set of mitigation strategies to improve cyber resilience. These strategies are designed to prevent, limit and recover from cyber incidents and have been prioritised because they address the most common attack vectors and can significantly reduce the likelihood and impact of cyber incidents.

The Essential Eight are relevant to CER product developers because they provide practical, baseline organisational security measures that align with the AESCSF's objectives.

Implementing these strategies helps developers meet AESCSF maturity requirements by reducing vulnerabilities in back-end applications and operating systems, enforcing strong access controls, and ensuring secure configurations. Multi-factor authentication and privilege restrictions protect remote management interfaces, while regular patching and hardening prevent exploitation of common flaws. Backup strategies support AESCSFs recovery objectives, ensuring continuity after ransomware or device compromise.

The Essential Eight are:

1. Application Control: Restrict execution of unauthorised applications to reduce malware risk.
2. Patch Applications: Apply security patches to applications within two weeks of release or sooner if an exploit exists.
3. Configure Microsoft Office Macro Settings: Block macros from the internet and only allow trusted macros.
4. User Application Hardening: Disable unnecessary features in applications (e.g., Flash, ads, Java in browsers) to reduce attack surface.
5. Restrict Administrative Privileges: Limit admin rights and regularly review accounts to prevent misuse.
6. Patch Operating Systems: Apply OS patches within two weeks or sooner if an exploit exists.
7. Multi-Factor Authentication: Enforce MFA for remote access, privileged accounts, and critical systems.
8. Regular Backups: Perform daily backups, store them offline, and test restoration to ensure recovery capability.

While not designed for device-level OT, they provide a baseline for securing the IT-OT boundaries that underpin the secure CER operation. Overall, the Essential Eight provide a practical baseline for securing the IT components and connectivity layers that underpin CER operations, even if they are not applied directly to OT devices.

OT Technical Controls

For OT environments such as CER, cybersecurity controls must address device-level risks and the unique characteristics of embedded systems. Unlike IT systems, OT devices often operate continuously, have limited processing capability, and are highly sensitive to availability and integrity. Controls should therefore focus on hardening device firmware, securing communication channels, and preventing unauthorised commands that could compromise grid stability.

Implementing OT-specific controls helps CER product developers meet AESCSF objectives for Protective Technology, Access Control, and System Integrity. Key measures include:

• enforcing secure boot and firmware validation to prevent malicious code
• applying IEC 62443 based configuration standards,
• implementing cryptographic authentication for device-to-cloud and device-to-device communications
• network segmentation and protocol whitelisting to reduce exposure to lateral movement, while disabling unused ports and services limits attack surfaces
• continuous monitoring for anomalous behaviour and intrusion detection at the edge to support AESCSF’s resilience goals
• robust patch management processes for embedded software including ensuring vulnerabilities are addressed without disrupting critical operations
• securing remote update mechanisms.

These OT controls complement IT measures by supporting secure integration into the energy network and compliance with Australian cybersecurity expectations.

Stakeholder feedback has also highlighted the increasing importance of penetration testing of IT/OT systems for large CER portfolios. There is a sector-wide shift from periodic to continuous penetration testing and monitoring, especially for OT and cloud-based services. The ASD plays a key role in supporting these activities, providing independent assessment and guidance to uplift cybersecurity maturity across the energy sector.

In the EV context, ISO 15118-20 security profiles and PKI requirements apply at the EVSE-to-EV level and must be aligned with, but not replaced by, IEC 62443 OT controls.

Firmware update management

Remote firmware updates introduce significant cybersecurity and operational risks for CER. There have been several instances in the Australian market where updates have “bricked” devices or rendered them inoperable for third-party aggregators and service providers, disrupting customer services and market participation. Key risk amplifiers include insufficient rollback mechanisms, lack of interoperability testing, and poor certificate or key management during update processes which may invalidate trust anchors or break functionality.

Potential mitigation strategies include:

• Secure Update Frameworks: Implement cryptographically signed firmware and integrity checks aligned with IEC 62443 and ACSC Essential Eight.
• Rollback Capability: Ensure devices support safe fallback to previous firmware versions.
• Interoperability Testing: Validate updates against CSIP-AUS, NEPKI, and DNSP requirements before deployment.
• Staged Rollouts: Use controlled update waves with monitoring to detect failures early.
• Certificate Lifecycle Management: Maintain continuity of PKI trust anchors during updates to avoid disruption to CSIP-AUS, Plug & Charge or CER aggregator operations.

OEMs disabling or withdrawing a feature relied upon by third parties to deliver services has also raised competition law concerns, particularly if the feature is essential for interoperability or market participation. Concerns have included the misuse of market power, exclusive dealing / refusal to supply, and impacting consumer choice and market efficiency.

For these reasons there is an increasing focus on CER lifecycle compliance, and this is reflected in the development of the National Technical Regulator initiative and draft standard AS 5438.

Challenges and Future Directions

Previous government reviews have highlighted growing cyber risks to Australia’s energy sector. Increased decentralisation, automation, and internet connectivity have expanded attack surfaces, creating vulnerabilities in hardware, software, and supply chains. Key findings from prior reviews include insufficient technical standards, lack of mandatory security requirements, inadequate testing, and inadequate cyber literacy across the sector.

AESCSF is considered a benchmark for future policy development, but its voluntary nature leaves gaps in enforcement. The introduction of mandatory technical standards and compliance mechanisms is intended to promote greater energy sector resilience as Australia adopts greater numbers of CER.

Future directions must also address secure identity and trust frameworks, particularly as the sector moves towards common and large-scale communications frameworks such as CSIP-AUS. The proposed NEPKI organisation is viewed as critical in promoting both secure CSIP-AUS communication as well as uplifting the capability and resilience of organisations providing CSIP-AUS client services.

Quantum computing is widely acknowledged as a long-term challenge to traditional cryptographic methods underpinning PKI and secure communications. CER developers intending to be major participants in Australia’s electricity systems should be commencing transition planning for post-quantum cryptography, including alignment with emerging standards (e.g., NIST PQC). This proactive approach will safeguard the energy sector against future cryptographic vulnerabilities and maintain trust in digital infrastructure.

Related articles

• Australia’s Privacy Principles
• Cyber security requirements for CSIP-AUS
• National Energy PKI (NEPKI) and CSIP-AUS
• Data sovereignty and data residency requirements