The wrong question, the right question
The wrong question is "which framework should we pick?" The right question is "what role does each framework play in our control story?" Essential Eight is the operational baseline. ISO 27001 is the management system. NIST CSF is the strategic narrative. They are not substitutes — they are layers.
Side-by-side
| Framework | What it is | Why it matters in Australia |
|---|---|---|
| ACSC Essential Eight | Operational baseline — eight mitigation strategies, maturity model. | Australian regulatory expectation; clear, measurable. |
| ISO/IEC 27001:2022 | Management system — full ISMS with Annex A controls. | Certifiable; recognised globally; required by many tenders. |
| NIST CSF 2.0 | Strategic framework — Govern, Identify, Protect, Detect, Respond, Recover. | Useful for board narrative and US-aligned obligations. |
When to lead with Essential Eight
Lead with Essential Eight when the audience is the ACSC, the audit committee, a federal-government customer or an APRA assessor. Maturity Level One is the floor; Maturity Level Two is the expectation for most regulated entities; Maturity Level Three is reserved for systems handling sensitive data or supporting critical functions.
When to lead with ISO 27001
Lead with ISO 27001 when the audience is a global customer, an insurance underwriter or a tender that requires certification. The 2022 revision aligns Annex A with ISO/IEC 27002:2022 — 93 controls grouped into four themes — and remains the most widely recognised information security certification globally.
When NIST CSF earns its place
NIST CSF 2.0 added a Govern function that maps cleanly to APRA, ASIC and ASX governance expectations. Use it as the board-level narrative layer that explains how Essential Eight and ISO 27001 deliver against the six CSF functions.
FOR LEADERS PICKING A FRAMEWORK STACK
Get three ranked framework strategies in under 60 seconds.
FORTE/CYBERx maps your challenge against Essential Eight, ISO 27001, NIST CSF and APRA CPS 234 so the recommendation is defensible to the audit committee on day one.
Start a free missionThe decision rule
- Default: Essential Eight as baseline, ISO 27001 as management system.
- Add NIST CSF when the board narrative or US-aligned reporting requires it.
- Add ISO 42001 when AI systems materially influence decisions or customer outcomes.
- Map to APRA CPS 234 if you are an APRA-regulated entity.
- Map to SOCI if you operate critical infrastructure assets.
FAQ
Should an Australian organisation use Essential Eight or ISO 27001?
For most Australian organisations the answer is both. Essential Eight is the ACSC-recommended baseline and the de facto regulatory expectation; it focuses on eight mitigation strategies. ISO/IEC 27001:2022 is the broader information security management system standard. Use Essential Eight as the operational baseline and ISO 27001 as the management framework that wraps around it.
Is NIST CSF relevant in Australia?
Yes. NIST CSF is widely used by Australian organisations with US parent companies, US customers or global supply-chain obligations. It is also a useful structuring framework — Identify, Protect, Detect, Respond, Recover — that pairs well with Essential Eight at the control layer and ISO 27001 at the management layer.
Do APRA-regulated entities need to follow Essential Eight?
APRA CPS 234 does not mandate Essential Eight by name but expects information security capability commensurate with the size, business mix and complexity of the entity. In practice, APRA-regulated entities are now expected to map their controls to Essential Eight maturity and to demonstrate Maturity Level Two or above for in-scope systems.
Can you certify against Essential Eight?
You cannot certify against Essential Eight the way you can against ISO 27001 — but you can be independently assessed for Essential Eight maturity level. Many Australian organisations now publish both an ISO 27001 certificate and an Essential Eight maturity attestation as part of their assurance pack.