A short AI-narrated film with English captions. Pressing play loads the YouTube player. Watch on YouTube
/arckit:au-aescsf generates an Australian Energy Sector Cyber Security Framework (AESCSF) maturity assessment for Australian electricity, gas, energy-market, DER, OT, or energy-sector supplier projects.
AESCSF is energy-specific, but it should not be run as an isolated cyber checklist. It reads the AU federal community overlay's artefacts when they exist: au-e8-posture and au-ism-controls provide the ASD cyber baseline, and au-ot-security and au-soci-cirmp add connected OT and critical-infrastructure evidence where they apply. All four are optional inputs; the au-energy recipe runs them first. au-energy-compliance reads the finished assessment as cyber-posture context, so run this command before it.
Prerequisites
| Artefact | Requirement | Why it helps |
|---|---|---|
/arckit:requirements |
Recommended | Source for resilience, safety, customer, market, and regulatory requirements |
/arckit:stakeholders |
Recommended | Identifies responsible entity, operator, accountable officer, market participants, suppliers, and regulators |
/arckit:au-e8-posture (ARC-<id>-AUE8-v1.0.md) |
Optional | Enterprise cyber baseline for AESCSF maturity evidence |
/arckit:au-ism-controls (ARC-<id>-AUISM-v1.0.md) |
Optional | Broader ASD control evidence and IRAP/cloud inheritance context |
/arckit:au-ot-security (ARC-<id>-AUOT-v1.0.md) |
Optional | OT evidence for IT/OT convergence, segmentation, remote access, telemetry, and recovery constraints |
/arckit:au-soci-cirmp (ARC-<id>-AUSOCI-v1.0.md) |
Optional | SOCI/CIRMP evidence for critical asset and all-hazards governance |
/arckit:dfd and /arckit:diagram |
Optional | IT/OT, market, DER, customer, vendor, and telemetry data-flow evidence |
/arckit:data-model |
Optional | NMI, meter, DER, customer, life-support, outage, settlement, and network-constraint data relationships |
/arckit:traceability |
Optional | Links AESCSF findings to requirements, obligations, controls, and evidence |
/arckit:risk |
Optional | Existing risk register entries for maturity gaps and treatments |
/arckit:servicenow |
Optional | CMDB and service inventory for asset, dependency, owner, and support-criticality evidence |
/arckit:maturity-model |
Optional | Maturity criteria to calibrate AESCSF capability levels and evidence thresholds |
/arckit:principles |
Optional | Architecture principles the assessment should respect |
Usage
/arckit:au-aescsf 001
/arckit:au-aescsf "DNSP ADMS/DERMS Program"
Output: projects/<id>/ARC-<id>-AUAESCSF-v1.0.md
What It Produces
- Energy context and AESCSF scope, with applicability assumptions.
- Criticality and target maturity profile.
- Domain maturity assessment: current and target maturity, evidence, gaps, and owners for each AESCSF capability domain.
- OT/IT and grid-edge findings, IT/OT and market data flows, and energy data-model dependencies.
- Architecture evidence status, and an asset, interface, and evidence inventory naming the source-of-truth register for each class.
- Diagram and traceability handoffs listing the DFD, diagram, data-model, ServiceNow, traceability, risk, and graph-report updates needed.
- AESCSF anti-pattern register.
- Federal baseline cross-reference to the E8, ISM, OT security, and SOCI/CIRMP artefacts.
- Maturity gaps converted into risk treatments, and an uplift roadmap (immediate, 30-90 days, 90-180 days, strategic).
Source Currency
AEMO source material can be intermittently unavailable. At run time, verify the current AESCSF package, version, guidance material, and source availability rather than relying on cached assumptions.
Evaluation Fixtures
The public AU energy fixture corpus under tests/fixtures/au-energy is synthetic, including organisations, scenarios, evidence, and personas. It is intended for public evaluation, regression testing, and community improvement.