The Australian Computer Society (ACS) says the Australian Signals Directorate’s (ASD) new ASD Essentials cyber security framework relies on “expert judgement” without defining who qualifies as an expert, creating what it describes as a “critical blind spot” in assessments of critical systems.
ASD launched ASD Essentials on 15 October to replace the Essential Eight, shifting away from a single overall rating towards assessments of how well cyber defences perform across different areas, supported by independent testing and practical exercises. ACS said ASD guidance for assessors indicates ratings will depend on expert judgement, but without a clear standard for assessor qualifications.
ACS CEO Dr Prins Ralston said the shift from checklist-based compliance to effectiveness-based assessment was welcome, but warned inconsistent or unaccountable judgements could undermine confidence in the new regime.
Dr Ralston said, “For nine years the question was simple. Did you tick the box? Now the question is whether your security actually works. That is a better question but someone has to answer it. ASD makes clear that assessments rely on expert judgement.
“So who is that person? What training do they have? Who checked them? Right now, nobody can tell you what makes them an expert. We license electricians, yet the person who tells a hospital its network will survive a ransomware attack needs nothing. They can hang out a shingle on Monday.
“The old checklist had one thing going for it. Two assessors looking at the same system would mostly reach the same answer. Judgement doesn’t work like that unless the people making the call are held to a standard.
“Get this wrong and boards will be handed reports full of ‘fully effective’ ratings that nobody can stand behind. They’ll read them and relax. That worries me more than anything in the framework itself.
“Only 22 per cent of Commonwealth agencies met the old minimum standard last year. That’s down from 25 per cent in 2023. A new framework doesn’t change those numbers. People do.
“And we don’t have enough of them. Australia is about 54,000 cyber professionals short. Next year, agencies will be assessed against both frameworks at once. You can’t double the assessment load on a workforce that thin, and expect quality to hold.
“ACS supports this reform. With our partners, we’re already building professional standards for cyber through CyberPath, which has surpassed 2,000 community touchpoints. The pilot starts in February, and it is an important step towards a more skilled, trusted, and accountable cyber security profession,” said Dr Ralston.
ACS is calling on the Federal Government to set minimum competency requirements for people assessing organisations against ASD Essentials before the framework becomes mandatory, and to recognise a range of evidence of skill including SFIA-based assessment, professional certifications and demonstrated experience.
The society also wants assessment reports to name who performed the work and specify what was and was not tested, and is calling for workforce funding to support the transition to the new approach.
In a note accompanying its statement, ACS said ASD expects ASD Essentials to take one to two years to become the standard, and that agencies will be assessed against both ASD Essentials and the Essential Eight in 2027.
ACS cited ASD’s “Commonwealth Cyber Security Posture in 2025” report, which it said showed 22 per cent of Commonwealth entities reached Essential Eight Maturity Level 2 in 2025, compared with 15 per cent in 2024 and 25 per cent in 2023. It also referenced ACS Digital Pulse 2026 for the estimate that Australia is short about 54,000 cyber professionals.
