AESCSF & SOCI Act CIRMP Obligations (Australia) compliance software
Evidence AESCSF maturity and SOCI Act risk-management obligations for Australian critical infrastructure — one assessment, board-ready reporting.
What AESCSF / SOCI requires
The Australian Energy Sector Cyber Security Framework (AESCSF), developed by AEMO with industry and government, is the energy sector's cyber maturity framework — drawing on ES-C2M2 with Australian context, assessed through maturity indicator levels and anti-patterns across security domains.
The Security of Critical Infrastructure Act 2018 (SOCI) imposes obligations on responsible entities of critical infrastructure assets, including a Critical Infrastructure Risk Management Program (CIRMP). The CIRMP rules require a cyber framework to be met — AESCSF is a recognised option, alongside frameworks such as the Essential Eight maturity model, ISO/IEC 27001 and NIST SP 800-53 — with an annual board-approved report.
For energy and other critical infrastructure entities the practical task is the same: assess against the chosen framework, evidence maturity, and produce the annual attestation trail. GRCLens structures exactly that.
Who it applies to
- Australian energy market participants using the AESCSF
- Responsible entities for critical infrastructure assets under the SOCI Act
- Entities operating a CIRMP with an annual board-approved report
- Suppliers supporting critical infrastructure operators
At a glance
- AESCSF owner: AEMO, with industry and government partners
- SOCI regulator: Cyber and Infrastructure Security Centre (Home Affairs)
- Assessment basis: Maturity indicator levels and anti-patterns (AESCSF); CIRMP rules (SOCI)
- Reporting: Annual CIRMP report approved by the board
How GRCLens supports AESCSF / SOCI
AESCSF / SOCI runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Maturity assessment
AESCSF practices assessed with maturity evidence, owners and comments — the working record behind your target security profile.
CIRMP obligation tracking
SOCI risk-management obligations tracked as owned, evidenced controls feeding the annual board report.
Cross-framework reuse
If your CIRMP framework is ISO 27001 or NIST 800-53, the same platform runs it — evidence is reused rather than duplicated.
Board-ready reporting
Exportable posture reports support the board approval and attestation the CIRMP rules require.
AESCSF / SOCI frequently asked questions
Is the AESCSF mandatory?
The AESCSF is the energy sector's framework, used in AEMO-coordinated assessment programs; under the SOCI CIRMP rules it is one of the recognised frameworks an entity can nominate to meet its cyber obligation.
What does a CIRMP require?
Responsible entities must establish and maintain a risk management program addressing material risks including cyber, meet a recognised cyber framework, and provide an annual report approved by the board. GRCLens maintains the underlying evidence.
Can we use Essential Eight or ISO 27001 instead of AESCSF?
The CIRMP rules recognise several frameworks. GRCLens supports the assessment either way, and reuses evidence if you run more than one.
Does this cover non-energy critical infrastructure?
Yes — the SOCI obligations span multiple sectors. The AESCSF component is energy-specific; the CIRMP obligation tracking applies to any responsible entity.
One platform, many obligations
Talk to us about AESCSF / SOCI
Security Solution Consultants provides Critical infrastructure security advisory alongside the platform, so you can combine tooling with hands-on expertise.
Contact us