The Australian Computer Society has largely welcomed the Australian Signals Directorate’s new ASD Essentials cyber security framework, but has called on the government to address what it sees as a “hole in the middle”.
The ASD Essentials were launched last week as an evolution of the existing Essential Eight.
"For nine years the question was simple. Did you tick the box? Now the question is whether your security actually works,” ACS CEO Dr Prins Ralston (pictured) said in a Friday statement.
“That is a better question, but someone has to answer it. ASD makes clear that assessments rely on expert judgement.
"So who is that person? What training do they have? Who checked them? Right now, nobody can tell you what makes them an expert.
“We license electricians, yet the person who tells a hospital its network will survive a ransomware attack needs nothing. They can hang out a shingle on Monday.”
The previous Essential Eight, which was essentially an easy-to-navigate checklist, Dr Ralston said, had one thing in its favour compared to the new framework.
“Two assessors looking at the same system would mostly reach the same answer. Judgement doesn't work like that unless the people making the call are held to a standard,” Dr Ralston said.
"Get this wrong and boards will be handed reports full of 'fully effective' ratings that nobody can stand behind. They'll read them and relax. That worries me more than anything in the framework itself.
"Only 22 per cent of Commonwealth agencies met the old minimum standard last year. That's down from 25 per cent in 2023. A new framework doesn't change those numbers. People do.
"And we don't have enough of them. Australia is about 54,000 cyber professionals short. Next year, agencies will be assessed against both frameworks at once. You can't double the assessment load on a workforce that thin, and expect quality to hold.”
The ACS has laid out four recommendations for the government:
Set minimum competency requirements for the people who assess organisations against ASD Essentials, before the framework becomes mandatory.
Accept a range of evidence of skill, including SFIA-based assessment, professional certification, and demonstrated experience.
Require every assessment report to name who did the assessment, what they tested, and what they didn't test.
Fund the workforce through the transition, not just the framework.
"ACS supports this reform. With our partners, we're already building professional standards for cyber through CyberPath, which has surpassed 2,000 community touchpoints," said Dr Ralston.
“The pilot starts in February, and it is an important step towards a more skilled, trusted, and accountable cyber security profession.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
