16 October 2026 – For immediate release
The Australian Computer Society says the government's new cyber security framework, ASD Essentials, has a hole in the middle. It relies on expert judgement to assess the security of critical systems, including hospitals, water utilities and government services, yet sets no clear standard for who qualifies as an expert.
The Australian Signals Directorate (ASD) yesterday launched ASD Essentials to replace the Essential Eight. Instead of giving organisations one overall cyber security rating, the new framework will assess how well their defences work in different areas, using independent testing and practical exercises. ASD's guidance for assessors says those ratings depend on expert judgement.
The Essential Eight has guided Australia's cyber security for almost a decade. Replacing it marks a major shift in how cyber security is assessed. ACS CEO Dr Prins Ralston said the reform was overdue but would only be as good as the people carrying it out.
Dr Ralston said, "For nine years the question was simple. Did you tick the box? Now the question is whether your security actually works. That is a better question but someone has to answer it. ASD makes clear that assessments rely on expert judgement.
"So who is that person? What training do they have? Who checked them? Right now, nobody can tell you what makes them an expert. We license electricians, yet the person who tells a hospital its network will survive a ransomware attack needs nothing. They can hang out a shingle on Monday.
"The old checklist had one thing going for it. Two assessors looking at the same system would mostly reach the same answer. Judgement doesn't work like that unless the people making the call are held to a standard.
"Get this wrong and boards will be handed reports full of 'fully effective' ratings that nobody can stand behind. They'll read them and relax. That worries me more than anything in the framework itself.
"Only 22 per cent of Commonwealth agencies met the old minimum standard last year. That's down from 25 per cent in 2023. A new framework doesn't change those numbers. People do.
"And we don't have enough of them. Australia is about 54,000 cyber professionals short. Next year, agencies will be assessed against both frameworks at once. You can't double the assessment load on a workforce that thin, and expect quality to hold.
"ACS supports this reform. With our partners, we're already building professional standards for cyber through CyberPath, which has surpassed 2,000 community touchpoints. The pilot starts in February, and it is an important step towards a more skilled, trusted, and accountable cyber security profession," said Dr Ralston.
ACS is calling on the Government to:
- Set minimum competency requirements for the people who assess organisations against ASD Essentials, before the framework becomes mandatory.
- Accept a range of evidence of skill, including SFIA-based assessment, professional certification and demonstrated experience.
- Require every assessment report to name who did the assessment, what they tested and what they didn't test.
- Fund the workforce through the transition, not just the framework.
ENDS
Note to the editor
- ASD launched the ASD Essentials on 15 October 2026, with chapters for enterprise IT, cloud, and operational technology. ASD expects it to take a year or two to become the standard. Agencies will be assessed against both frameworks in 2027.
- In 2025, 22 per cent of Commonwealth entities reached Essential Eight Maturity Level 2, compared with 15 per cent in 2024 and 25 per cent in 2023 (ASD, Commonwealth Cyber Security Posture in 2025).
- The 54,000 figure is from ACS Digital Pulse 2026.
- CyberPath is a government-supported pilot led by ACS, AISA and Aus3C with AWSN as a diversity partner. The CyberPath Pilot delivery begins in February 2027.
ENDS
Further information
Troy Steer
Director of Corporate Affairs and Public Policy
M – 0417 173 740
E – troy.steer@acs.org.au
About ACS
The Australian Computer Society (ACS) is the professional body for Australia’s technology profession. Since 1966, we have championed a trusted, skilled, and world-class profession, representing 42,000 members across business, government and education, with branches in every Australian state and territory. Our work strengthens Australia’s digital sovereignty, responsible AI adoption, cyber resilience, workforce capability and digital trust. We set professional standards, accredit education, certify practitioners and advocate for the skills and capabilities Australia needs. ACS is committed to advancing the profession and ensuring technology serves Australia’s national interests and delivers lasting public value.