Frameworks

NIST, CMMC and CIS in Australia: which ones actually apply to you.

Three US frameworks turn up in Australian contracts and questionnaires. Most businesses need none of them as a requirement. Some need one because a customer says so. Here is what each is, how they line up with the Essential Eight and the ISM, and where CMMC stands after the Phase II suspension.

CMMC status checked 30 October 2026. Confirm against your contract.

Check what your contract needs Find which apply 07 3114 2808

CMMC Phase II status
Mapped to Australian frameworks
Which ones you need

Reviewed by Blake Bath, General Manager, on 30 October 2026.

An operations manager at a precision engineering firm reads a tabbed contract with a highlighter, with machinists working on the shop floor behind the office window. — **Start with the contract**The clause decides the framework, the version and the assessment. Not the sales pitch.

In one line each

What each framework is for.

They answer different questions, so they are not competing choices.

NIST CSF 2.0

A way to describe and improve your security, organised into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

Any size, any sector
No certification
Good for board reporting

Framework picker

Which frameworks does your business actually need?

Answer four questions about your customers and contracts. The list shows what to focus on, in order, and what you can leave alone.

Four questions. The answer is the shortest list of frameworks that actually applies to you.

Do you hold, or bid for, a US defence contract or subcontract?

Has a US or multinational customer asked about NIST?

Do you do Australian Defence or government work?

Do insurers or customers want proof you do the basics?

Focus on

3frameworks, in this order

Essential EightThe Australian baseline. Start here whatever else applies.
SMB1001An Australian certificate built for small and medium businesses, so you can show your work.
CIS Controls IG1 as a checklist56 practical safeguards that help you implement the above. A reference, not a requirement.

You can ignore for now

CMMC. It only applies when a US defence contract requires it.
NIST CSF as a goal in itself. Use it only if a customer asks for it or you want its structure for board reporting.

Check it against your contract

Where CMMC stands

CMMC after the Phase II suspension.

10 November 2025Phase I began. Contracts could require Level 1 and Level 2 self-assessments, entered in SPRS with an annual affirmation.
13 July 2026The US Department of War suspended Phase II, which would have required third-party Level 2 assessments from 10 November 2026, and set up a 60-day reform review.
3 September 2026A class deviation carried the pause into contract clauses, removing third-party assessment requirements at the next option or modification.
Still in forcePhase I self-assessments, annual affirmations, DFARS 252.204-7012 and NIST SP 800-171 Revision 2. Third-party Level 2 assessments remain available if a prime asks for one.
Still pendingThe review's recommendations, and a planned rule to move CMMC to NIST SP 800-171 Revision 3. Neither had been published by late October 2026.

If you supply US defence work, read your current subcontract clause and ask the prime what they expect. Do not buy a certification you may not need yet.

Mapping

How they line up with Australian frameworks.

US framework	Closest Australian match	What carries over
NIST CSF 2.0	ASD ISM	Both organise security by outcome, so ISM controls map into the CSF functions for reporting. Check controls and evidence within each scope.
CIS Controls	Essential Eight	Patching, admin access, configuration and recovery overlap. CIS also covers inventory, training and service providers.
NIST SP 800-171	ISM	Control families overlap, but US CUI and Australian classifications are not the same thing.
CMMC	DISP	Separate US and Australian schemes. One does not satisfy the other. Some suppliers need both.

A mapping helps you reuse evidence. It does not mean an assessor will accept it automatically.

Our view

Do the Australian baseline well, then map to what customers ask.

For most Australian businesses, the Essential Eight is the work, and SMB1001 is the certificate that shows it. When a customer sends a NIST or CIS questionnaire, we answer it from the same controls and keep one evidence register mapped to each framework, rather than running separate projects.

For CMMC, we help with readiness: scoping where CUI lives, a Revision 2 gap assessment, the system security plan and remediation. We are not a C3PAO and do not issue CMMC certification.

If a customer asks

What to do when a framework turns up in a contract.

Step 1Get the clause
The exact framework, version, level, assessment method and deadline.
Step 2Map the data
Where the customer's information is received, stored and sent, including suppliers.
Step 3Set the boundary
Which systems and people are in scope, before buying tools or audits.
Step 4Assess the gaps
Against the version the contract names, not the newest one.
Step 5Keep one register
One set of evidence, mapped to each framework that applies.
Step 6Review yearly
Affirmations, contract changes and framework updates.

Australian frameworks

The US frameworks sit on top. These come first.

Start with the Australian baseline and certificate.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about NIST, CMMC and CIS.

Is there an Australian version of the NIST framework?

Not as such. Australia's government baselines are ASD's Essential Eight and the Information Security Manual. NIST CSF 2.0 is a US framework that many Australian organisations use for its structure, especially for board reporting. Its six functions give a simple structure you can map Essential Eight and ISM controls into.

Does an Australian business need CMMC?

Only when a US defence contract or subcontract requires it. Confirm the information you handle, the contract clauses, the required level and the system scope with the prime. Australian Defence work does not automatically require CMMC, and DISP membership is not a substitute for it.

Is CMMC Phase II still starting on 10 November 2026?

No. The US Department of War suspended Phase II on 13 July 2026 and started a 60-day review. Phase I self-assessments, annual affirmations and DFARS 252.204-7012 still apply. As at late October 2026 the review's recommendations had not been published.

Does CMMC Level 2 use NIST SP 800-171 Revision 2 or 3?

Revision 2, with 110 requirements. NIST published Revision 3 in May 2024, and a rule to move CMMC to Revision 3 is listed as planned but had not been published by late October 2026. Check which revision your contract names before paying for a gap assessment.

Can we get NIST certified?

No. NIST CSF 2.0 is a framework, not a certification. You describe where you are with a Current Profile and where you need to be with a Target Profile. The gap between them is your improvement plan.

CIS Controls or the Essential Eight?

The Essential Eight for Australian requirements, and CIS Controls as a broader implementation checklist. CIS Implementation Group 1 has 56 safeguards. They overlap a lot, but meeting one does not prove the other.

Next step