Australian Energy Sector Cyber Security Framework – version 2 (AESCSF v2)

Quick Reference Guide – Domain Overview & Key Terms

Domain Domain Description

Establish, operate, and maintain an enterprise cyber security risk management program to identify, analyse, and mitigate cyber security risk to the organisation, including its business units, subsidiaries,
Risk Management RISK
related interconnected infrastructure, and stakeholders.
Establish and maintain an enterprise cyber security program that provides governance, strategic planning, and sponsorship for the organisation’s cyber security activities in a manner that aligns cyber
Cybersecurity Program Management PROGRAM
security objectives with the organisation’s strategic objectives and the risk to critical infrastructure.
Asset, Change, and Configuration Manage the organisation’s operations technology (OT) and information technology (IT) assets, including both hardware and software, commensurate with the risk to critical infrastructure and
ASSET
Management organisational objectives.
Create and manage identities for entities that may be granted logical or physical access to the organisation’s assets. Control access to the organisation’s assets, commensurate with the risk to critical
Identify and Access Management ACCESS
infrastructure and organisation objectives.

Cybersecurity Architecture ARCHITECTURE Establish and maintain clear mapping of your IT and OT assets and a plan as to where and how controls should be implemented to protect your environment in the event of a cyber security attack.

Establish and maintain plans, procedures, and technologies to detect, identify, analyse, manage and respond to cyber security threats and vulnerabilities, commensurate with the organisation’s
Threat and Vulnerability Management THREAT
infrastructure (e.g., critical, IT, operational) and organisational objectives.
Establish and maintain activities and technologies to collect, analyse, alarm, present, and use operational and cyber security information, including status and summary information from the other model
Situational Awareness SITUATION
domains, to form a common operating picture (COP).
Event and Incident Response, Establish and maintain plans, procedures, and technologies to detect, analyse, and respond to cyber security events and to sustain operations throughout a cyber security event, commensurate with the
RESPONSE
Continuity of Operations risk to critical infrastructure and organisational objectives.
Supply Chain and External Establish and maintain controls to manage the cyber security risks associated with services and assets that are dependent on external entities, commensurate with the risk to critical infrastructure and
THIRD-PARTIES
Dependencies Management organisational objectives.
Establish and maintain plans, procedures, technologies, and controls a culture of cyber security and to ensure that ongoing suitability and competence of personnel, commensurate with the risk to critical
Workforce Management WORKFORCE
infrastructure and organisational objectives.
Establish and maintain plans, procedures, and technologies to reduce privacy related risks, and manage personally identifiable information through its lifecycle - collection, storage, use and disclosure,
Australian Privacy Management PRIVACY
and disposal (including de-identification).

Term Definition

Ability and means to enter a facility, to communicate with or otherwise interact with a system, to use system resources to handle information, to gain knowledge of the information the system contains,
Access
or to control system components and functions.
In the context of this model, ad hoc (i.e., an ad hoc practice) refers to performing a practice in a manner that depends largely on the initiative and experience of an individual or team (and team
leadership), without much in the way of organisational guidance in the form of a prescribed plan (verbal or written), policy, or training. The methods, tools, and techniques used, the priority given a
Ad hoc particular instance of the practice, and the quality of the outcome may vary significantly depending on who is performing the practice, when it is performed, and the context of the problem being
addressed. With experienced and talented personnel, high-quality outcomes may be achieved even though practices are ad hoc. However, because lessons learned are typically not captured at the
organisational level, approaches and outcomes are difficult to repeat or improve across the organisation.
Anomalous Inconsistent with or deviating from what is usual, normal, or expected.
Something of value to the organisation. Assets include many things, including technology, information, roles performed by personnel, and facilities. For the purposes of this model, assets to be
Asset
considered are IT and OT hardware and software assets, as well as information essential to operating the function.
The preservation of authorised restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. For an information asset, confidentiality is
Confidentiality
the quality of being accessible only to authorised people, processes, and devices.
 Australian Energy Sector Cyber Security Framework – version 2 (AESCSF v2)
Quick Reference Guide – Domain Overview & Key Terms (continued)
Term Definition

The management, operational, and technical methods, policies, and procedures-manual or automated-(i.e., safeguards or countermeasures) prescribed for an IT and ICS to protect the confidentiality, integrity, and availability of the
Controls
system and its information.
Credential An object or data structure that authoritatively binds an identity (and optionally, additional attributes) to a token possessed and controlled by a Subscriber.
Updated at an organisation-defined frequency (e.g., as in the asset inventory is kept 'current') that is selected such that the risks to critical infrastructure and organisation objectives associated with being out-of-date by the maximum
Current
interval between updates are acceptable to the organisation and its stakeholders.
The development and maintenance of the object of the practice (such as a program). For example, 'Establish and maintain identities' means that not only must identities be provisioned, but they also must be documented, have
Establish and maintain
assigned ownership, and be maintained relative to corrective actions, changes in requirements, or improvements.

Event Any observable occurrence in a system or network. Depending on their potential impact, some events need to be escalated for response. To ensure consistency, criteria for response should align with the organisation's risk criteria.

The high-level electricity system activity or set of activities performed by the utility to which the model is being applied. Generally, the function will be generation, transmission, distribution, and/or markets. When using the AESCSF
Function
evaluation survey, the function is the organisational line-of-business (generation, transmission, distribution, or markets) that is being evaluated by completing the model.

An organisational process of providing strategic direction for the organisation while ensuring that it meets its obligations, appropriately manages risk, and efficiently uses financial and human resources. Governance also typically
Governance includes the concepts of sponsorship (setting the managerial tone), compliance (ensuring that the organisation is meeting its compliance obligations), and alignment (ensuring that processes such as those for cybersecurity program
management align with strategic objectives).
Guidelines A set of recommended practices produced by a recognised authoritative source representing subject matter experts and community consensus, or internally by an organisation. See standard.

Identity The set of attribute values (i.e., characteristics) by which an entity is recognisable and that, within the scope of an identity manager's responsibility, is sufficient to distinguish that entity from any other entity.

An event (or series of events) that significantly affects (or has the potential to significantly affect) critical infrastructure and/or organisational assets and services and requires the organisation (and possibly other stakeholders) to
Incident
respond in some way to prevent or limit adverse impacts. See also computer security incident and event.

The extent to which a practice or activity is ingrained into the way an organisation operates. The more an activity becomes part of how an organisation operates, the more likely it is that the activity will continue to be performed over
Institutionalisation
time, with a consistently high level of quality. ('Incorporated into the ingrained way of doing business that an organisation follows routinely as part of its corporate culture.' - CERT RMM). See also maturity indicator level.

Logging typically refers to automated recordkeeping (by elements of an IT or OT system) of system, network, or user activity. Logging may also refer to keeping a manual record (e.g., a sign-in sheet) of physical access by personnel
Logging to a protected asset or restricted area, although automated logging of physical access activity is commonplace. Regular review and audit of logs (manually or by automated tools) is a critical monitoring activity that is essential for
situational awareness (e.g., through the detection of cyber security events or weaknesses).
Collecting, recording, and distributing information about the behaviour and activities of systems and persons to support the continuous process of identifying and analysing risks to organisational assets and critical infrastructure that
Monitoring
could adversely affect the operation and delivery of services.
Periodic review/activity A review or activity that occurs at specified, regular time intervals, where the organisation-defined frequency is commensurate with risks to organisational objectives and critical infrastructure.
Personnel Employees of the organisation. This includes full time, part time, and contracted employees.
A measure of the extent to which an organisation is threatened by a potential circumstance or event, and typically a function of (1) the adverse impacts that would arise if the circumstance or event occurs and (2) the likelihood of
Risk
occurrence.

An external organisation or an internal or external person or group that has a vested interest in the organisation or function (that is being evaluated using this model) and its practices. Stakeholders involved in performing a given
Stakeholder
practice (or who oversee, benefit from, or are dependent upon the quality with which the practice is performed) could include those from within the function, from across the organisation, or from outside the organisation.

Any circumstance or event with the potential to adversely impact organisational operations (including mission, functions, image, or reputation), resources, and other organisations through IT, OT, or communications infrastructure via
Threat
unauthorised access, destruction, disclosure, modification of information, and/or denial of service.
A cyber security vulnerability is a weakness or flaw in IT, OT, or communications systems or devices, system procedures, internal controls, or implementation that could be exploited by a threat source. A vulnerability class is a
Vulnerability
grouping of common vulnerabilities.
Australian Energy Sector Cyber Security Framework – version 2 (AESCSF v2)
Quick Reference Guide – Key Framework Components
Framework Structure MIL and SP Attributes

Framework

Domain
AESCSF contains 11 Domains
See previous page for descriptions.

Each domain contains one or more objectives.

Maturity Indicator Level (MIL)

MIL-1
! The measure of cyber
security maturity
associated with each
practice. Each MIL has
specific characteristics
Objective/s MIL-2 which impact
Objectives are numbered and unique to each domain, assessment for Practices
(See following page)
MIL-3
Practice
Practices

!
Objective contains multiple Practices Anti-Pattern
Practices are lettered and unique to each Security Profile (SP)
Objective
Each Practice and Anti- Security Profiles are the
Pattern has a SP-1 defined target states for
Anti-Patterns corresponding Maturity participants depending on
Indicator Level (MIL) their criticality.
9 of the 11 Domains contain Anti-Patterns. SP-2
and Security Profile (SP)
Applicable Anti-Patterns for each domain are Security Profiles do not
contained in their own Objective SP-3 impact the assessment
approach.

Practice Completion and Anti-Pattern Presence

Practice Anti-Pattern

!
Anti-Patterns are assigned a MIL, however
MIL-1 Practices for MIL-1 are assessed as either MIL-1, 2 & 3 the MIL, and it’s associated Management Characteristics,
Yes or No do not impact assessment of Anti-Patterns

Anti-Patterns are no
No Not Complete Present Not Complete longer attached to
Practice individual Practices,
Yes Complete Not Present Complete however they remain linked
to an AESCSF Domain and
Practices for MIL-2 & 3 are assessed against MIL.
MIL-2 & 3
four levels of implementation

Not Implemented
Not Complete
Partially Implemented

Largely Implemented
Complete
Fully Implemented
3
 Australian Energy Sector Cyber Security Framework – version 2 (AESCSF v2)
Quick Reference Guide - Completion & Management Characteristics
MIL-1 Practice MIL-2 Practice

Not
Implementation Response
The Practice IS NOT performed

Implementation Response
No
Practices performed at

The Practice is NOT performed

The Practice IS performed

Practices performed at
MIL-1

Partially
MIL-2

Management Characteristics
The Practice IS performed 1 The Practice is documented

Yes
Note: For MIL-1 this can be ad-hoc, and may therefore vary in 2 Stakeholders of the Practice are identified and involved

Largely
frequency, accuracy, and completeness, based on the skills and
Any Fully Implemented practice
tools of the personnel completing the activities Adequate resources are provided to support the Practice
at MIL-3 requires all 3 (people, funding, and tools)
Management Characteristics

Fully
from both MIL-2 and MIL-3. Standards and/or guidelines have been identified to guide the
4
MIL-3 Practice implementation of the Practice

Not
The Practice IS NOT performed, OR the Practice is performed HOWEVER
MIL-2 Management Characteristics (1, 2 and/or 3) are MISSING .
Anti-Patterns

Implementation Response
The Practice IS performed, AND
AT LEAST MIL-2 Management Characteristics 1, 2 and 3 are present
Practices performed at

Implementation Response
Present
+ This activity IS exhibited within the function
(either pervasively or within a limited context)
Activities are guided by policies (or other organisational
MIL-3

Management Characteristics

5
Partially

Anti-Patterns at
MIL-1, 2 & 3
directives) and governance
Personnel performing the Practice have adequate skills
6 and knowledge
Policies include compliance requirements for specified

Not Present
7
Fully Largely

standards and/or guidelines

Responsibility and authority for performing the This activity IS NOT exhibited within the function
8 Practice is assigned to personnel
Activities are periodically reviewed to ensure they
9 conform to policy