The Australian Cyber Security Centre (ACSC) is the Australian Government's lead agency for cybersecurity. It sits within the Australian Signals Directorate (ASD) and was established in 2018 from the merger of several earlier cyber units.
The ACSC publishes operational cybersecurity guidance for Australian organisations — most notably the Essential Eight mitigation strategies and the Information Security Manual (ISM). It also operates the cyber.gov.au portal, runs ReportCyber for incident reporting, issues threat advisories, and coordinates incident response for significant Australian cyber events.
For mid-market firms, the ACSC matters because its guidance is the de facto baseline that auditors, regulators (including APRA), and cyber-insurance underwriters cite. ACSC publications are free, authoritative, and explicitly written for Australian context — which makes them more relevant than international frameworks like NIST CSF for AU compliance conversations.