Australian Cyber Essentials (ACE)
The practical pathway for suppliers to prove their security posture, and the consistent framework enterprises need for defensible third-party risk oversight.
I Manage a Supply Change
I am a supply chain manager and would like to learn more about verifying my suppliers
I'm a Supplier
I am a third-party supplier and would like to commence my certification journey.
Your Cyber Security Is Only as Strong as Your Weakest Supplier
Enterprise Challenge:
Third-party cyber security risk cannot be managed by questionnaires alone. Yet most organisations face:
- Inconsistent supplier questionnaires with no standardisation
- Self-attestation without verification or evidence
- No defensible audit trail for boards and regulators
- Assessment fatigue causing supplier pushback
- Inability to scale oversight across hundreds of suppliers
Supplier Challenge:
Proving your security posture shouldn’t be this hard. Yet most suppliers face:
- Questionnaire overload from every customer
- Duplicated effort rebuilding similar responses
- Unclear requirements and vague expectations
- Limited cyber security resources and expertise
- Competitive disadvantage against larger suppliers with dedicated compliance teams
Purpose-Built for Supply Chain Assurance
ACE doesn’t replace existing frameworks, it’s purpose-built to solve the specific challenge of supply chain cyber security assurance.
Existing frameworks are valuable, but each leaves critical gaps when applied to supply chain risk:
- Comprehensive frameworks are excellent for internal security management, but often too resource-intensive and costly for SMEs to achieve and maintain.
- Technical guidance provides highly effective mitigation strategies, but lacks the governance, risk management, and business context needed for holistic supplier assurance.
- SME-focused standards provide a practical on-ramp, but can miss nuances of the modern threat landscape and may include outdated practices superseded by current best practice.
- Platform-specific tools are powerful within their ecosystem, but provide no visibility into broader infrastructure, third-party applications, or policy and procedure.
The result?
Enterprises struggle to consistently assess suppliers. Suppliers face conflicting requirements. Neither achieves defensible, scalable assurance.
The Solution?
Australian Cyber Essentials (ACE), certified by Bureau Veritas, is moving the industry from ‘trust’ to ‘verify’.
What makes ACE different:
- Curated, not comprehensive: Focuses on essential controls that matter for supply chain risk, not every possible control
- Evidence-based, not self-attested: Independent Bureau Veritas certification provides defensible assurance
- Practical for SMEs: Achievable with structured support, not requiring dedicated compliance teams or expensive consultants
- Reusable across customers: One certification, multiple customer relationships
- Modern threat-aware: Reflects current best practice for today’s evolving risk landscape
- Holistic: Combines technical controls with governance and business context