Essential Eight is the floor. AUKUS is where the bar is heading.
AUKUS is reshaping defence trade between Australia, the UK and the United States. Since 1 September 2024 the ITAR's AUKUS exemption has allowed many US defence articles and services to move between authorised users in the three countries without an export licence, and the US State Department finalised the rule in December 2025. Essential Eight ML2 is the mandatory DISP baseline. Separately, the US Department of Defense's CMMC program applies to prime contractors and subcontractors, wherever they are based, whose systems handle Federal Contract Information or Controlled Unclassified Information on a DoD contract. CMMC Level 2 assesses the security requirements of NIST SP 800-171.
Your specific challenges
Two compliance regimes, one environment
DISP membership requires Essential Eight ML2. US DoD work that involves Federal Contract Information or Controlled Unclassified Information brings CMMC, whose Level 2 assesses the 110 security requirements of NIST SP 800-171 Rev 2. Both apply to the same IT environment, and you need to satisfy both.
The ITAR exemption raised the stakes
Since 1 September 2024, many US defence articles and services can move between authorised users in Australia, the UK and the US without an export licence under the ITAR's AUKUS exemption, finalised in December 2025. More controlled technology in Australian hands means more for attackers to target.
CMMC is already in US contracts
CMMC requirements began appearing in DoD solicitations and contracts on 10 November 2025. Third-party Level 2 certification phases in from November 2026, with full implementation from November 2028. The requirements flow down to subcontractors that handle Federal Contract Information or Controlled Unclassified Information, regardless of where the company is headquartered.
No single standard across all three
There is no single cyber security standard across the three AUKUS nations. Australian contractors may need to satisfy the Essential Eight, NIST SP 800-171 through CMMC, and potentially UK Cyber Essentials Plus — with no single framework covering all three.
Built for your situation
The platform behind the NSA's CAPT program
NodeZero powers the NSA Cybersecurity Collaboration Center's Continuous Autonomous Penetration Testing (CAPT) program for US Defense industrial base suppliers. CAPT is a US program for US contractors, not something you enrol in, but it runs on the same platform. Horizon3 describes NodeZero as aligning with CMMC, and Drochaid's coverage kit maps its evidence to Essential Eight ML2.
Shared technical ground
The Essential Eight and NIST SP 800-171 are structured differently, and meeting one does not satisfy the other. But they overlap in technical territory — access control, identification and authentication, configuration, and flaw remediation. Evidence that those controls hold under attack is useful under both.
Evidence for the technical requirements
NodeZero exercises the technical controls both frameworks rely on — how access is granted, whether credentials can be abused, whether exploitable weaknesses remain — and shows whether they hold under a real attack.
Build your AUKUS readiness now
See how NodeZero's attack-based evidence supports Essential Eight ML2 and the technical requirements CMMC assesses