AESCSF v2 Maturity Assessment Tool

Overview

The AESCSF v2 Site Assessment Tool gives energy sector security teams a structured, evidence-backed way to evaluate their cybersecurity maturity — at the individual site level and across the entire site portfolio. Whether you are preparing for an AEMO submission, a Board briefing, a SOCI Act CIRMP attestation, or your own internal gap analysis, the tool does the heavy lifting: scoring, gap identification, risk prioritisation, evidence management, and report generation — entirely within your browser, with no data leaving your environment unless you explicitly enable an AI feature.

The assessment covers 161 practices and 42 anti-patterns across the 11 AESCSF v2 domains, with Security Profile targeting that auto-filters to the right MIL targets for your profile. Multi-site portfolio mode aggregates assessments across every site you operate, surfacing cross-portfolio patterns no single-site view can show. Period tracking and year-over-year comparison turn point-in-time scoring into a defensible trajectory of improvement — exactly the evidence regulators look for post-incident under the SOCI Act.

What AESCSF v2 Asks You to Do — and How the Tool Handles It

AEMO's AESCSF v2 is a comprehensive cyber security maturity model: 11 domains grouped into logical capability areas, each domain composed of objectives that contain practices, with practices scored at Maturity Indicator Levels (MIL) 0 through 3. Three Security Profiles (SP1, SP2, SP3) bundle target MIL expectations across the framework — and an additional layer of 42 anti-patterns identifies practices that undermine effective cyber capability even when other controls are in place.

The tool integrates every element of the v2 framework — including the anti-patterns, the SP-target logic, and the MIL scoring rubric — so the question is never "did we score this correctly?" but rather "what does the evidence support?".

Assessment Domains

All 11 AESCSF v2 domains, structured across three functional categories aligned to the framework:

Anti-Pattern Assessment — Beyond Self-Scoring

One of the most distinctive features of AESCSF v2 is the explicit assessment of anti-patterns: practices or conditions that actively undermine cybersecurity capability, even when other controls appear adequate. The tool integrates the full set of 42 anti-patterns from the official AESCSF v2 Core (AEMO/CSIWG), distributed across nine of the eleven domains — concentrated most heavily in Identity & Access Management (11) and Situational Awareness (11), with additional anti-patterns in Asset, Architecture, Response, Risk, Threat and Workforce.

Anti-patterns are scored binary — present or not present — and contribute to a separate Anti-Pattern Assessment view that surfaces the practices most likely to compromise your overall maturity. This is what separates a real AESCSF assessment from a tick-box exercise.

Multi-Site Portfolio Mode

Most energy responsible entities operate multiple sites — generation, substations, control centres, gas pipelines, market operations — each with its own scope and risk profile. The Site Registry holds every site in your portfolio, each with its own SP target, classification, and assessment status — all visible on a single dashboard. The portfolio-level views go well beyond simple aggregation:

• Site × Domain Heatmap — A colour-coded cross-portfolio matrix showing every site against the 11 AESCSF domains, with average maturity by domain across sites, sortable to surface the weakest domains across the portfolio.
• Maturity by Site Type — Compare maturity across site types (generation, transmission, control centre, etc.) to see whether systemic weaknesses cluster by operational context.
• Common Gaps Across the Portfolio — Practices where multiple sites are non-compliant, with the explicit list of affected sites. Fix one root cause at the policy or platform level, clear many site-level gaps at once.
• Common Evidence Weaknesses — Patterns where evidence quality is consistently weak across sites, pointing at systemic documentation deficiencies worth addressing centrally — plus reference examples of sites with strong evidence for the same practice.
• Common Low-Maturity Practices — The practices that consistently score below their SP target across sites — the structural patterns worth a portfolio-wide programme rather than per-site remediation.
• Portfolio Overview Dashboard — Tile metrics across the top show total sites, average maturity, SP target achievement, and outstanding actions. Programme managers see exactly where to push next.

Evidence Workflow & Reviewer Overrides

Each practice presents the assessor with a structured answer scale (None, Partial, Strong, plus N/A with justification), an inline guide to what good evidence looks like, and a drag-and-drop area for attaching supporting documents — PDFs, Word, Excel, images, CSV — directly to the practice.

An independent reviewer workflow captures observations against the evidence in structured fields. The reviewer can override the self-assessed MIL where the evidence clearly contradicts it, with both the original answer and the reviewer override preserved in the audit trail. When AI is enabled, AI-suggested MIL levels (with confidence rating low/medium/high) sit alongside the self-assessment and the reviewer override — three independent signals, all visible side-by-side, all auditable.

Period Tracking, Baselines & Year-over-Year Comparison

Single-point assessments are necessary but insufficient. The tool treats assessment as a continuous activity, with first-class support for the time dimension:

• Maturity Snapshot & Baseline — Save a point-in-time baseline; capture manual overrides where appropriate; replace, clear or revert baselines as the programme evolves.
• Period Closure — Formally close an assessment period and archive it, freezing the state for audit and historical comparison.
• Year-over-Year Comparison — Improvements, regressions, evidence added or removed, reviewer-decision changes, security profile movement — all surfaced as a structured change report between any two assessment periods.
• Multi-Period Trend Comparison — Load three or more historical periods to visualise compliance trajectory by domain and site across time.
• Per-Site Maturity Trends — Each site's maturity trajectory over multiple closed periods, plus a portfolio-average trend line — the trajectory of improvement that regulators will examine post-incident.

For SOCI Act responsible entities preparing for the proposed SP-2 uplift by 30 June 2028, this is the evidence trail that demonstrates credible intent — quarter by quarter, not just at year end.

Audit Log, Collaboration & Resilient Storage

Every answer, note, evidence change and reviewer override is captured in a chronological audit log — the complete record of who did what and when, with full version history accessible from the in-app log viewer.

Optional Shared Folder Mode turns the assessment into a team workspace. Multiple assessors work in parallel on a multi-site portfolio via OneDrive, SharePoint, Microsoft Teams, Google Drive, or Dropbox. Per-site file locking prevents conflicting edits; identity stamping records who changed what; live change polling surfaces edits in seconds; and the sync provider conflict detector flags "conflicted-copy" files created by the sync provider so you can resolve them manually rather than discovering them at audit time. A 30-day soft delete with one-click restore prevents accidental data loss.

Evidence storage is resilient by design — content-derived filenames (so evidence titles never leak through the folder browser), per-file and per-question caps, browser-storage quota monitoring, optional encryption-at-rest, a crash-recovery mirror, and a read-only Evidence Health Check audit available from Settings.

Who It's For

• Electricity generators, network operators, and gas pipeline operators
• Energy market participants with AEMO reporting obligations
• SOCI Act responsible entities in the energy sector preparing for the proposed SP-2 uplift
• Multi-site operators needing portfolio-wide AESCSF visibility
• Security teams managing IT/OT convergence in energy environments
• Audit and assurance teams evidencing maturity to AEMO, the AER, or the board