ECSO Readiness Assessment
For energy entities designated as Systems of National Significance under SOCI Act Part 2C.
Learn moreWhat AESCSF v2 Asks You to Do — and How the Tool Handles It
AEMO's AESCSF v2 is a comprehensive cyber security maturity model: 11 domains grouped into logical capability areas, each domain composed of objectives that contain practices, with practices scored at Maturity Indicator Levels (MIL) 0 through 3. Three Security Profiles (SP1, SP2, SP3) bundle target MIL expectations across the framework — and an additional layer of 42 anti-patterns identifies practices that undermine effective cyber capability even when other controls are in place.
The tool integrates every element of the v2 framework — including the anti-patterns, the SP-target logic, and the MIL scoring rubric — so the question is never "did we score this correctly?" but rather "what does the evidence support?".
Assessment Domains
All 11 AESCSF v2 domains, structured across three functional categories aligned to the framework:
Governance & Strategy
- Risk Management
- Supply Chain & External Dependencies
- Workforce Management
- Cybersecurity Program Management
Protection & Defence
- Asset, Change & Configuration Management
- Identity & Access Management
- Threat & Vulnerability Management
- Cybersecurity Architecture
Detection & Response
- Situational Awareness
- Information Sharing & Communications
- Event & Incident Response, Continuity of Operations
Anti-Pattern Assessment — Beyond Self-Scoring
One of the most distinctive features of AESCSF v2 is the explicit assessment of anti-patterns: practices or conditions that actively undermine cybersecurity capability, even when other controls appear adequate. The tool integrates the full set of 42 anti-patterns from the official AESCSF v2 Core (AEMO/CSIWG), distributed across nine of the eleven domains — concentrated most heavily in Identity & Access Management (11) and Situational Awareness (11), with additional anti-patterns in Asset, Architecture, Response, Risk, Threat and Workforce.
Anti-patterns are scored binary — present or not present — and contribute to a separate Anti-Pattern Assessment view that surfaces the practices most likely to compromise your overall maturity. This is what separates a real AESCSF assessment from a tick-box exercise.
Multi-Site Portfolio Mode
Most energy responsible entities operate multiple sites — generation, substations, control centres, gas pipelines, market operations — each with its own scope and risk profile. The Site Registry holds every site in your portfolio, each with its own SP target, classification, and assessment status — all visible on a single dashboard. The portfolio-level views go well beyond simple aggregation:
- Site × Domain Heatmap — A colour-coded cross-portfolio matrix showing every site against the 11 AESCSF domains, with average maturity by domain across sites, sortable to surface the weakest domains across the portfolio.
- Maturity by Site Type — Compare maturity across site types (generation, transmission, control centre, etc.) to see whether systemic weaknesses cluster by operational context.
- Common Gaps Across the Portfolio — Practices where multiple sites are non-compliant, with the explicit list of affected sites. Fix one root cause at the policy or platform level, clear many site-level gaps at once.
- Common Evidence Weaknesses — Patterns where evidence quality is consistently weak across sites, pointing at systemic documentation deficiencies worth addressing centrally — plus reference examples of sites with strong evidence for the same practice.
- Common Low-Maturity Practices — The practices that consistently score below their SP target across sites — the structural patterns worth a portfolio-wide programme rather than per-site remediation.
- Portfolio Overview Dashboard — Tile metrics across the top show total sites, average maturity, SP target achievement, and outstanding actions. Programme managers see exactly where to push next.
Evidence Workflow & Reviewer Overrides
Each practice presents the assessor with a structured answer scale (None, Partial, Strong, plus N/A with justification), an inline guide to what good evidence looks like, and a drag-and-drop area for attaching supporting documents — PDFs, Word, Excel, images, CSV — directly to the practice.
An independent reviewer workflow captures observations against the evidence in structured fields. The reviewer can override the self-assessed MIL where the evidence clearly contradicts it, with both the original answer and the reviewer override preserved in the audit trail. When AI is enabled, AI-suggested MIL levels (with confidence rating low/medium/high) sit alongside the self-assessment and the reviewer override — three independent signals, all visible side-by-side, all auditable.
Period Tracking, Baselines & Year-over-Year Comparison
Single-point assessments are necessary but insufficient. The tool treats assessment as a continuous activity, with first-class support for the time dimension:
- Maturity Snapshot & Baseline — Save a point-in-time baseline; capture manual overrides where appropriate; replace, clear or revert baselines as the programme evolves.
- Period Closure — Formally close an assessment period and archive it, freezing the state for audit and historical comparison.
- Year-over-Year Comparison — Improvements, regressions, evidence added or removed, reviewer-decision changes, security profile movement — all surfaced as a structured change report between any two assessment periods.
- Multi-Period Trend Comparison — Load three or more historical periods to visualise compliance trajectory by domain and site across time.
- Per-Site Maturity Trends — Each site's maturity trajectory over multiple closed periods, plus a portfolio-average trend line — the trajectory of improvement that regulators will examine post-incident.
For SOCI Act responsible entities preparing for the now-mandatory SP-2 uplift, this is the evidence trail that demonstrates credible intent — quarter by quarter, not just at year end.
Audit Log, Collaboration & Resilient Storage
Every answer, note, evidence change and reviewer override is captured in a chronological audit log — the complete record of who did what and when, with full version history accessible from the in-app log viewer.
Optional Shared Folder Mode turns the assessment into a team workspace. Multiple assessors work in parallel on a multi-site portfolio via OneDrive, SharePoint, Microsoft Teams, Google Drive, or Dropbox. Per-site file locking prevents conflicting edits; identity stamping records who changed what; live change polling surfaces edits in seconds; and the sync provider conflict detector flags "conflicted-copy" files created by the sync provider so you can resolve them manually rather than discovering them at audit time. A 30-day soft delete with one-click restore prevents accidental data loss.
Evidence storage is resilient by design — content-derived filenames (so evidence titles never leak through the folder browser), per-file and per-question caps, browser-storage quota monitoring, optional encryption-at-rest, a crash-recovery mirror, and a read-only Evidence Health Check audit available from Settings.
Who It's For
- Electricity generators, network operators, and gas pipeline operators
- Energy market participants with AEMO reporting obligations
- SOCI Act responsible entities in the energy sector preparing for the now-mandatory SP-2 uplift
- Multi-site operators needing portfolio-wide AESCSF visibility
- Security teams managing IT/OT convergence in energy environments
- Audit and assurance teams evidencing maturity to AEMO, the AER, or the board