Navigating Australian Defence & Government Cyber Security Frameworks
The landscape of Australian cyber security is defined by key frameworks designed to protect our nation’s most sensitive data and critical infrastructure. For organisations working with Government and particularly within the Defence industry, understanding frameworks like the Essential 8, the Defence Industry Security Program (DISP), and even the US CMMC is not just best practice—it’s a necessity.
This guide breaks down these critical cyber security frameworks, explaining what they are, who they apply to, and how they interact.
Breaking it all down
What is the ACSC (ASD) Essential 8?
The Essential 8 is a series of baseline mitigation strategies for cyber security developed by the Australian Cyber Security Centre (ACSC). It is considered the most effective set of foundational security controls for organisations to protect their systems against a wide range of cyber threats.
It’s important for businesses to note that these are baseline strategies, and should not be adopted as the sole approach to cyber security for in your business.
While mandatory for Australian Government agencies, the Essential 8 is the recommended security standard for all Australian organisations as a baseline strategy.
The Eight Mitigation Strategies
The strategies are designed to prevent attacks, limit the extent of security breaches, and ensure data availability. They are:
-
Application Control: Preventing the execution of unapproved or malicious programs.
-
Patch Applications: Applying security patches to all software in a timely manner.
-
Configure Microsoft Office Macro Settings: Blocking macros from the internet and only allowing vetted macros.
-
User Application Hardening: Configuring web browsers and other applications to block or limit potentially harmful features like ads and Flash.
-
Restrict Administrative Privileges: Limiting powerful access to only those who need it, making it harder for an attacker to gain full control of a system.
-
Patch Operating Systems: Applying security patches to operating systems (e.g., Windows, macOS, Linux) in a timely manner.
-
Multi-factor Authentication (MFA): Requiring a second form of verification to protect user credentials from being stolen.
-
Regular Backups: Creating and regularly testing backups of important data so you can recover quickly from an incident.
Essential 8 Maturity Levels
The ACSC defines four maturity levels to help organisations assess their implementation of the Essential 8:
-
Maturity Level 0: Weaknesses in an organisation’s overall cybersecurity posture are present
-
Maturity Level 1: Baseline controls present
-
Maturity Level 2: Advanced controls present
-
Maturity Level 3: Comprehensive controls present
What is the Defence Industry Security Program (DISP)?
The Defence Industry Security Program (DISP) is a security framework designed to help Australian businesses understand and meet their security obligations when engaging in projects and tenders for the Department of Defence.
Membership is mandatory for any organisation that needs to work with sensitive or classified Defence information or assets. DISP helps businesses uplift their cyber security posture, ensuring the entire Defence supply chain is resilient against threats.
Who Needs DISP Membership?
You need DISP membership if your business:
Intends to work on a Defence contract.
Is part of the supply chain for a prime Defence contractor.
Needs to store or handle sensitive Defence information.
Requires access to Defence sites or facilities.
DISP covers four key security areas: Governance, Personnel Security, Physical Security, and Information & Cyber Security. The cyber security requirements of DISP are directly aligned with the principles of the Essential 8 for Entry Level.
Businesses that intend to work on protected, secret or top-secret defence industry contracts, will need the baseline plus a cyber security framework that addresses the unique risks related to the project.
The Future of DISP: Preparing for 2025 and Beyond
While there isn’t a formal program titled “DISP Cyber 2025,” the framework is constantly evolving to meet new threats. Looking towards 2025 and beyond, Australian businesses in the defence sector should anticipate:
Stricter Enforcement: Defence is increasing its focus on verifying the security claims of its industry partners.
Supply Chain Scrutiny: Prime contractors will be held more accountable for the cyber security of their subcontractors, flowing compliance requirements down the chain.
Greater Alignment: Expect continued alignment between DISP requirements, the Essential 8, and international standards.
Focus on Information Control: An increased emphasis on knowing precisely where sensitive data is stored, who can access it, and how it is transmitted.
- International Influences: Influences from US defence industry such as the Cybersecurity Maturity Model Certification (CMMC)
Preparing for the future means treating DISP not as a one-time certification, but as a continuous program of security improvement.
What is the Cybersecurity Maturity Model Certification (CMMC)?
The Cybersecurity Maturity Model Certification (CMMC) is a framework developed by the United States’ Department of Defense (DoD). Its goal is to protect sensitive, unclassified information that is shared with its contractors and subcontractors.
What Kind of Information Does CMMC Protect?
CMMC is designed to protect two main types of sensitive, but unclassified, information:
Federal Contract Information (FCI): This is information provided by or generated for the US Government under a contract that is not intended for public release.
Controlled Unclassified Information (CUI): This is a more sensitive category of information that requires safeguarding or dissemination controls pursuant to US law, regulations, and government-wide policies. Examples include technical drawings, defence installation details, and other operational information.
The Three Levels of CMMC
The current version, CMMC 2.0, has streamlined the framework into three levels. The level a company must achieve depends on the sensitivity of the information it will handle.
Level 1 (Foundational): This is the most basic level. It focuses on fundamental cyber hygiene practices, such as ensuring employees use good passwords and that antivirus software is installed. This level applies to companies that only handle Federal Contract Information (FCI). Compliance can be achieved through an annual self-assessment.
Level 2 (Advanced): This level is for companies that handle the more sensitive Controlled Unclassified Information (CUI). The requirements are based on the well-known NIST SP 800-171 security standard, which includes 110 specific security controls. Most companies dealing with CUI will need to pass an assessment conducted by a certified third-party organisation every three years.
Level 3 (Expert): This is the highest level, designed for companies working on the DoD’s most critical programs. It includes all the controls from Level 2 plus additional, more advanced security practices based on NIST SP 800-172. These companies will face the most rigorous assessments, conducted by government officials from the Defense Contract Management Agency (DCMA).
Why is CMMC Important for Australian Businesses?
With the strengthening of international defence partnerships like AUKUS, Australian companies are becoming increasingly integrated into the US defence supply chain. If an Australian business provides products or services for a US DoD project—either directly or as a subcontractor to another company—it will be required to meet the CMMC standards specified in the contract.
Achieving CMMC certification is not just about compliance; it demonstrates a commitment to robust cyber security, making a company a more trusted and competitive partner in the global defence market.
Framework Overview: Essential 8 vs. DISP vs. CMMC
How to Get Started with Your Compliance Journey
Navigating these frameworks can seem complex, but the path forward can be broken down into clear steps.
Assess Your Position: Identify which frameworks apply to your business based on your clients and industry. Do you work with Defence? Do you have US partners?
Start with the Essential 8: Regardless of other obligations, implementing the Essential 8 is the best first step for any Australian business to build a strong cyber security foundation.
Conduct a Gap Analysis: Assess your current security posture against the requirements of the relevant framework (Essential 8, DISP, or CMMC).
Develop a Roadmap: Create a clear, actionable plan to address the gaps identified. Prioritise based on risk and compliance deadlines.
Seek Expert Guidance: Partnering with a cyber security expert can streamline the process, ensuring you meet your obligations efficiently and effectively. We can help.