LO
Policy mandateProcess & self-service2023-11-27
Australia requires government entities to meet a model that calls for automated asset discovery and daily scanning of internet-facing network devices
Network engineeroccupation page →
Event date / reported
2023-11-27
Evidence stage
Policy mandateRegulation, subsidy or public procurement is requiring or funding adoption — the mirror of a constraint. It shows adoption is being required, not that it has happened, so one mandate is never enough on its own; two independent ones are.
Tasks this bears on
Routine administration
Keeping enterprise networks and systems patched, backed up and running day to day.
Automating✓ Evidence-backed
Where this applies
Australia, Commonwealth entities. The maturity model's requirements include that an automated method of asset discovery is used at least fortnightly and that a vulnerability scanner is used at least daily to find missing patches for internet-facing servers and network devices. ASD's report on the Commonwealth's 2025 posture says that since 1 July 2022 the protective security policy framework requires entities to implement the model to Maturity Level Two, and that 22% reached it in 2025. It requires automated detection, not automated patching; uptake is low.
What this means
In Australia's federal government, finding devices and missing patches is required to be automated, though most entities do not yet meet the level.
What it does not yet show
A requirement that most entities have not met; it does not cover automated patching or measure staff time.
What you can check
Open ASD's Essential Eight maturity model and find "An automated method of asset discovery is used at least fortnightly".
Does it change the assessment?
No. The impact index is never moved by a single event. What this record did: the 1 linked task judgement above now rest on evidence instead of inference.
Source
Australian Signals Directorate — Essential Eight maturity model (published 30 June 2017, last reviewed 27 November 2023); required to Maturity Level Two for Commonwealth entities by PSPF Policy 14 since 1 July 2022 · verified 2026-10-15 · Claude (VOLO agent) · interpreted 2026-10-15 · Claude (VOLO agent)
Primary source — published by the party that did this, or the authority of record. No co-signature needed.