· By Nicholas “Nick” O'Sullivan, Townsville
ASD and ACSC explained: who actually protects Australian businesses online
If you’ve spent any time on an Australian government cyber security page, you’ve almost certainly seen two names used interchangeably: ASD and ACSC. They get mentioned in the same sentence so often that it’s easy to assume they’re just two names for the same thing. They’re related, but they’re not identical, and knowing the difference actually matters when you’re trying to work out which resource to trust for what.
The Australian Signals Directorate (ASD) is Australia’s national signals intelligence and offensive/defensive cyber agency, sitting within the Defence portfolio. Its remit is broad and includes intelligence functions that go well beyond anything a business would ever interact with directly. For a small business, charity or church, ASD itself is mostly the name behind the curtain.
The Australian Cyber Security Centre (ACSC) is ASD’s public-facing cyber security capability — the part actually built to talk to businesses, government agencies and the public. cyber.gov.au, the Essential Eight, the Small Business Cyber Security Hub, alerts and advisories, and the ReportCyber portal are all ACSC-branded, even though ACSC sits inside ASD organisationally. When people say “the ASD guidelines” about patching or MFA, what they usually mean is ACSC guidance published under the ASD umbrella.
For a small-to-medium business, charity or church, the practical takeaway is simple: cyber.gov.au is the front door, regardless of which name is on the letterhead. That’s where the free, plain-English guidance actually lives.
The Essential Eight is probably ACSC’s best-known publication: eight baseline mitigation strategies (things like application control, patching, MFA, restricting admin privileges and regular backups) ranked by maturity level. It was originally written with larger organisations in mind, but the underlying logic — MFA, patch things, back things up, limit who has admin access — applies just as well to a five-person office or a volunteer-run charity, even if the full maturity-model scoring doesn’t.
The Small Business Cyber Security Hub is the more approachable, right-sized version: practical steps rather than a maturity framework, aimed squarely at organisations without a dedicated IT team. It’s a genuinely good starting point, and it’s free. We built our own Small Business Cyber Security Hub self-assessment to sit alongside it as a practical checklist, not a replacement for it.
ACSC also publishes alerts and advisories when a significant vulnerability or active campaign is affecting Australian organisations. Most small businesses won’t read these directly, but they’re a useful thing for whoever manages your technology to have on their radar — and it’s one of the things a Leadership Technology Review checks as part of understanding whether your setup is exposed to anything currently being actively exploited.
None of this replaces getting your own house in order. ASD and ACSC publish guidance and resources; they don’t configure your Microsoft 365 tenant, review your admin access or test your backups for you. That part is still a local, practical job — which is exactly where a Leadership Technology Review fits in, translating national guidance into a plan specific to your organisation.
This is the first in a short series demystifying who’s who in Australian cyber security. Next: who to actually call when something goes wrong.
