au-compliance frameworks acsc-glossary
ACSC
The Australian Cyber Security Centre, part of ASD. Alerts, advice, assistance. cyber.gov.au and 1300 CYBER1.
Glossary
AllIRacsc-glossaryaiattack-pathau-compliancecloudconceptscryptodetectiondnsframeworkshardeningidentityloggingmalwarenetworkphishingpractitionerprivacyresiliencesocisupply-chainthreat-intelvulnerabilitywindows
44 entries
practitioner au-compliance privacy hardening
APP 11 — security of personal information
Privacy Act APP 11. Reasonable steps to protect personal information you hold, and to destroy or de-identify it when it is no longer needed. Technical and organisational measures (APP 11.3 from 11 Dec 2024). OAIC Chapter 11 + Guide to securing personal information.
practitioner au-compliance resilience supply-chain
APRA CPS 230: operational resilience, critical operations and the 24-hour, 72-hour and 20-day notices
CPS 230 is APRA's operational risk standard for banks, insurers, private health insurers and super trustees. It asks each entity to name its critical operations, set how long and how badly each may be disrupted, prove it can stay inside those limits through a severe disruption, and manage the suppliers it depends on. Here is what it requires, the three notices it creates, and how it sits beside CPS 234.
practitioner au-compliance IR
APRA CPS 234: the information security standard and its 72-hour and 10-day clocks
Banks, insurers, health funds and super trustees regulated by APRA must hold an information security capability that matches their threats, classify and protect information assets including those run by suppliers, have independent specialists test controls, and tell APRA within 72 hours of a material incident and within 10 business days of a material control weakness they cannot fix in time. Here is who is covered, what each obligation asks for, and how the clocks interact with other notifications.
au-compliance acsc-glossary
ASD
Australian Signals Directorate. Foreign signals intelligence and, through the ACSC, national cyber security.
frameworks au-compliance hardening acsc-glossary
ASD Essentials
ASD's framework series, launched on 15 October 2026 to replace the Essential Eight, according to iTnews and techpartner.news. It covers enterprise IT, cloud and operational technology, and uses principles, actions and domains instead of maturity levels.
practitioner frameworks au-compliance network hardening soci
ASD Essentials for OT
The operational technology chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight. iTnews and techpartner.news report that the series covers OT alongside enterprise IT and cloud; neither reported the OT chapter's specific contents.
practitioner frameworks au-compliance cloud hardening
ASD Essentials for cloud
The cloud chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight. iTnews and techpartner.news report that the series covers cloud alongside enterprise IT and OT; neither reported the cloud chapter's specific contents.
practitioner frameworks au-compliance hardening
ASD Essentials for enterprise IT
The enterprise IT chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight, according to iTnews and techpartner.news. Priority phases set an implementation order, not a rating (iTnews).
practitioner ai au-compliance frameworks
Agentic AI harnesses
ASD’s name for everything around the LLM — tools, memory, permissions. Prompt injection is not a model patch. Control what the harness can reach and do.
practitioner au-compliance privacy ai
Automated decisions in your privacy policy (APP 1.7–1.9): what must be disclosed from 10 December 2026
From 10 December 2026, an organisation covered by the Privacy Act that lets software, including AI, make or materially shape decisions that significantly affect people must say so in its APP privacy policy. The three-part test, why human review does not get you out of it, what the policy has to list, and a six-week readiness checklist.
practitioner au-compliance soci
CIRMP (Critical Infrastructure Risk Management Program)
Part 2A of the SOCI Act. If you are a responsible entity for a covered critical infrastructure asset, you must have a written risk management program, keep it current, and report on it each year.
practitioner au-compliance IR supply-chain
CIRMP annual report
Board-approved CIRMP annual attestation under SOCI Part 2A/2AA. FY 2025–26 90-day window closed 28 September 2026 — if you missed it, treat late lodging as a compliance failure and close the evidence pack now.
practitioner au-compliance hardening IR
Critical advisory intake
Getting a vendor critical into change control the same day — including record Patch Tuesday bundles. Owner, source list, exploited-first triage, evidence. ASD patching meets the NDB clock.
practitioner au-compliance IR
Cyber Incident Review Board: no-fault reviews of major incidents
Part 5 of the Cyber Security Act 2024 sets up an independent board that reviews significant cyber incidents after the response is over and publishes lessons and recommendations. It does not assign blame, but it can compel documents from private entities, so know how a review works before you are asked to take part.
IR au-compliance acsc-glossary
Data breach
Data lost, peeked, changed, or leaked without authorisation. In Australia the NDB clock may also be running.
practitioner au-compliance IR
Data breach response plan
OAIC Part 2 (updated February 2025). Write the plan before the incident. Roles, containment, assessment, notify, and records — so the NDB clock is not where you invent process.
practitioner au-compliance IR
Data breaches involving more than one entity (NDB)
Your supplier was breached, but whose breach is it? Under the NDB scheme, every entity that holds the record shares the duty. One can assess and notify for all, but if nobody does, all of you are exposed. Agree who does what in the contract, before the incident.
frameworks au-compliance hardening
Essential Eight
ASD's baseline of eight mitigation strategies. Maturity 0 to 3. The work is picking a level you can actually hold.
practitioner au-compliance hardening frameworks
Essential Eight evidence
How to show you actually did the Essential Eight. Scope, artefact, date, owner. Overall maturity is the weakest strategy, not the average.
practitioner au-compliance supply-chain cloud
Hosting Certification Framework (HCF): which hosting Australian Government data needs, and what Strategic vs Assured means
The Commonwealth rule set for where sensitive government data may live. Sensitive data, whole-of-government systems and PROTECTED systems must sit on HCF-certified services; Strategic certification gives the most ownership and control protection, Assured less, Uncertified almost none. New registrations have been paused since 3 November 2025 while the framework is reformed.
practitioner au-compliance frameworks cloud
IRAP
Infosec Registered Assessors Program. ASD-endorsed assessors test systems and cloud against the ISM. The report is evidence. Authorisation stays with you.
practitioner frameworks au-compliance acsc-glossary
Information Security Manual (ISM)
ASD's control catalogue for Australian government systems — and the shared dialect for anyone who needs to speak the same language. Applicability, tailoring, and dated exceptions are the work.
practitioner au-compliance IR
Limited use: telling the National Cyber Security Coordinator
Part 4 of the Cyber Security Act 2024. What you voluntarily tell the National Cyber Security Coordinator about a cyber incident can be used to help you and to manage national risk, but not to investigate or penalise you for civil or regulatory breaches. It does not replace any report you are legally required to make.
practitioner au-compliance IR privacy
My Health Record data breaches: the separate notification duty under section 75
Healthcare providers, repository and portal operators and contracted service providers registered with My Health Record have a breach duty that sits beside the Privacy Act's Notifiable Data Breaches scheme. It starts on suspicion rather than a serious-harm assessment, it goes to both the Australian Digital Health Agency and the OAIC as soon as practicable, and only the Agency may tell patients. Here is what counts, who you tell, what to include and how it differs from an ordinary NDB.
practitioner au-compliance IR
NDB clock
Thirty days to assess a suspicion; notify as soon as practicable once eligible. AGD Privacy Reform Exposure Draft consultation closed 18 Sep 2026 — proposed 72-hour OAIC notify clock is still not law.
practitioner au-compliance IR privacy
NDB serious harm test
The Privacy Act gate for an eligible data breach. Reasonable person, more probable than not, s 26WG factors, then remedial action.
practitioner au-compliance IR privacy
NDB statement contents
What the Privacy Act requires in an eligible-data-breach statement to the OAIC and to individuals — and how to file it on the OAIC online form.
practitioner au-compliance IR
NSW mandatory notification of data breach scheme (MNDB)
Part 6A of the NSW PPIP Act. Contain at once, assess within 30 calendar days from when any staff member suspects, tell the Privacy Commissioner immediately on the approved form, notify people as soon as practicable, and keep a register and a public policy. In force since 28 November 2023.
practitioner au-compliance frameworks hardening
PSPF Policy 14 — Cyber Security Strategies
PSPF Release 2025 Policy 14 is the Commonwealth cyber floor (Essential Eight to ML2 for NCEs). Direction 002-2026 adds a hard legacy-tech stocktake deadline of 31 March 2027 — and SoGS measures by 31 December 2026.
practitioner au-compliance IR
Privacy Act and OAIC
Privacy Act 1988, APPs, and the OAIC. Who is an APP entity, the NDB three-limb test, what the notice must say, and which desk pages hold the clocks.
practitioner au-compliance IR privacy
Privacy Act penalties after a breach: civil penalties, infringement notices and compliance notices
The OAIC now has three levels of enforcement for Privacy Act failures: court-ordered civil penalties for serious or repeated interferences, on-the-spot infringement notices for specific procedural breaches, and compliance notices that tell you what to fix. What triggers each one, what it can cost, and what to check before the OAIC does.
practitioner au-compliance frameworks
Protective Security Policy Framework
AGD protective security policy for NCEs. Four domains, PSPF Release 2025 Policy 14 cyber floor, Essential Eight to Maturity Level 2 since July 2022.
practitioner au-compliance IR
Queensland mandatory data breach scheme (MNDB)
Chapter 3A of Queensland's Information Privacy Act 2009. Contain straight away, assess within 30 days, notify the Information Commissioner and people as soon as practicable, and keep a register and a published policy. Councils have been in since 1 July 2026.
practitioner au-compliance IR
Ransomware payment reporting
Cyber Security Act 2024 Part 3. Pay (or learn someone paid for you) and the clock is 72 hours to ASD's form. Home Affairs watches compliance; the report has use limits.
practitioner au-compliance frameworks
SOCI Act obligations
Security of Critical Infrastructure Act 2018, mapped for practitioners. Eleven sectors, three positive security obligations, extra duties for Systems of National Significance, the 2024 ERP Act changes, and a protected-information offence that catches responsible entities too.
practitioner au-compliance IR
SOCI cyber incident clock
Part 2B of the SOCI Act. Significant impact on availability: 12 hours. Other cyber incidents with a relevant impact: 72 hours. The clock starts when the responsible entity becomes aware, not when root cause is finished.
practitioner hardening network au-compliance
Securing edge devices: ASD's seven mitigation strategies for firewalls, VPNs and routers
Firewalls, VPN gateways and edge routers face the internet, are hard to monitor and can reach your internal network, so they are a favourite first foothold. ASD's practitioner guidance gives seven vendor-neutral strategies. In short: know what sits at the edge, buy secure products, patch fast but check for compromise first, use strong authentication, switch off what you don't use, keep management interfaces off the internet, and get logs off the box.
practitioner au-compliance hardening
Smart device security standard: what makers and sellers must do
Since 4 March 2026, most internet-connected consumer devices made for the Australian market must ship without guessable shared passwords, with a published way to report security bugs, and with a stated end date for security updates. Suppliers must also hand over a statement of compliance. Here is who is caught, what the three rules mean in practice, and what to check before you stock or buy a device.
practitioner au-compliance soci
Systems of National Significance (SoNS)
A privately declared subset of critical infrastructure assets. SoNS can attract Enhanced Cyber Security Obligations on top of the ordinary SOCI duties.
practitioner au-compliance privacy
The statutory privacy tort (Privacy Act Schedule 2): what security and incident teams need to know
Since 10 June 2025, individuals in Australia can sue for a serious invasion of privacy under Schedule 2 of the Privacy Act 1988. The five elements, why insider snooping and covert recording are the security cases that matter, the exemptions for reporting to police and ASD, the time limits and damages cap, and what to change in your logging and incident playbooks.
practitioner au-compliance hardening
Third-party and supply chain
You can outsource the work. You cannot outsource the risk. Cloud shared responsibility, IRAP evidence, ISM procurement — and the vendor update channel that pushes your next plugin build.
practitioner frameworks au-compliance hardening
Transitioning from the Essential Eight to ASD Essentials
What iTnews and techpartner.news report about moving from the Essential Eight to ASD Essentials: existing work remains relevant, every strategy maps to at least one principle, but maturity ratings do not automatically convert.
practitioner au-compliance IR
WA notifiable information breach scheme (PRIS Act Part 2 Division 6): starts 1 January 2027
Western Australia's public-sector breach scheme under the Privacy and Responsible Information Sharing Act 2024. From 1 January 2027: contain immediately, assess and write a report within 30 days of forming a reasonable suspicion, then tell the Information Commissioner and affected people as soon as practicable. Policy, register and annual-report duties come with it.
Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary