External attack surface management (EASM) in Australia

PSPF Requirement 0211: the technology asset stocktake

PSPF Release 2026 carries Requirement 0211, effective for all non-corporate Commonwealth entities from 1 July 2025. It requires a Technology Asset Stocktake and a Technology Security Risk Management Plan that identify and manage the entity’s internet-facing systems and services, with continuous visibility and monitoring of the technology estate as the stated outcome. The requirement absorbed the earlier Direction 002-2024.

How fast that inventory needs to work was shown in February 2026. PSPF Direction 001-2026, signed on 26 February, gave entities until 28 February to inventory their Cisco SD-WAN systems, patch them and report back. Two days leaves no time to start looking.

The Essential Eight, still the November 2023 model

The Essential Eight Maturity Model remains the version last updated in November 2023. From Maturity Level One it expects an automated method of asset discovery at least fortnightly, daily vulnerability scanning of online services and internet-facing servers and network devices, and patches for internet-facing systems within 48 hours when a vulnerability is critical or a working exploit exists.

ASD opened consultation on a successor "Essentials" series in June 2026, closing on 12 July 2026. That was a consultation, not a replacement, and the Essential Eight remains current. Commonwealth entities must reach Maturity Level Two under PSPF Requirements 0099 to 0106. ASD’s own posture report found 22 per cent of entities achieved it in 2025.

SOCI and the Enhanced CIRMP Rules 2026

The Enhanced CIRMP Rules commenced on 10 June 2026 for nine asset classes, including electricity, gas, water, liquid fuel, freight and domain name systems. They require responsible entities to identify and maintain an inventory of critical systems and their connections (section 8C), minimise the risk of late patching and unsupported technology (section 8A), map major suppliers (section 10A) and adopt one of five named frameworks, such as ISO/IEC 27001:2023 or the Essential Eight at Maturity Level Two.

Grace periods apply: patching and legacy technology duties from 10 June 2027, and the inventory, supply chain and framework duties from 10 June 2028. The annual CIRMP report is due 90 days after the end of the financial year and must be approved by the board.

APRA CPS 234 and CPS 230

CPS 234 requires APRA-regulated entities to classify all information assets, including those managed by third parties, and to test controls at a frequency that matches how quickly threats and assets change. Material incidents must be notified within 72 hours. CPS 230, in force since 1 July 2025, adds a register of material service providers and expects entities to monitor the health of their information assets.

Both standards assume the entity knows which systems face the internet, including systems a supplier runs on its behalf. That is where most inventories are weakest.

What ASD sees from the outside

ASD’s edge device guidance reports 17.9 million Australian devices visible on the public internet, 212,000 of them edge devices, and notes that edge devices often sit outside enterprise asset management. ASD’s Annual Cyber Threat Report 2024 to 2025 counted more than 120 incidents involving edge devices. ASD already watches the Commonwealth’s internet-facing systems and email posture from the outside through its CHIPs programme. EASMLens gives any organisation the same outside-in view of its own estate.