48 entries
Privacy Act APP 11. Reasonable steps to protect personal information you hold, and to destroy or de-identify it when it is no longer needed. Technical and organisational measures (APP 11.3 from 11 Dec 2024). OAIC Chapter 11 + Guide to securing personal information.
CPS 230 is APRA's operational risk standard for banks, insurers, private health insurers and super trustees. It asks each entity to name its critical operations, set how long and how badly each may be disrupted, prove it can stay inside those limits through a severe disruption, and manage the suppliers it depends on. Here is what it requires, the three notices it creates, and how it sits beside CPS 234.
Banks, insurers, health funds and super trustees regulated by APRA must hold an information security capability that matches their threats, classify and protect information assets including those run by suppliers, have independent specialists test controls, and tell APRA within 72 hours of a material incident and within 10 business days of a material control weakness they cannot fix in time. Here is who is covered, what each obligation asks for, and how the clocks interact with other notifications.
The operational technology chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight. iTnews and techpartner.news report that the series covers OT alongside enterprise IT and cloud; neither reported the OT chapter's specific contents.
The cloud chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight. iTnews and techpartner.news report that the series covers cloud alongside enterprise IT and OT; neither reported the cloud chapter's specific contents.
The enterprise IT chapter of ASD Essentials, the framework ASD launched on 15 October 2026 to replace the Essential Eight, according to iTnews and techpartner.news. Priority phases set an implementation order, not a rating (iTnews).
ASD’s name for everything around the LLM — tools, memory, permissions. Prompt injection is not a model patch. Control what the harness can reach and do.
From 10 December 2026, an organisation covered by the Privacy Act that lets software, including AI, make or materially shape decisions that significantly affect people must say so in its APP privacy policy. The three-part test, why human review does not get you out of it, what the policy has to list, and a six-week readiness checklist.
Chrome and Edge auto-update means a bought extension can turn hostile overnight. Inventory, least privilege, and remove what you do not need.
Part 2A of the SOCI Act. If you are a responsible entity for a covered critical infrastructure asset, you must have a written risk management program, keep it current, and report on it each year.
Board-approved CIRMP annual attestation under SOCI Part 2A/2AA. FY 2025–26 90-day window closed 28 September 2026 — if you missed it, treat late lodging as a compliance failure and close the evidence pack now.
Known Exploited Vulnerabilities catalogue plus BOD 26-04 deadlines. If it is on KEV and you are internet-facing, treat exposure as an incident trigger, not a backlog item.
CVE names a flaw. CVSS scores a severity model. EPSS estimates exploit likelihood. KEV records known exploitation. Your triage joins all four to exposure and asset value.
Victim becomes the delivery path: fake Cloudflare/reCAPTCHA verify stages a command on the clipboard, then Win+R → Ctrl+V → Enter. No malicious download needed. Pair with third-party.com placeholder abuse and browser-extension supply chain.
Getting a vendor critical into change control the same day — including record Patch Tuesday bundles. Owner, source list, exploited-first triage, evidence. ASD patching meets the NDB clock.
Part 5 of the Cyber Security Act 2024 sets up an independent board that reviews significant cyber incidents after the response is over and publishes lessons and recommendations. It does not assign blame, but it can compel documents from private entities, so know how a review works before you are asked to take part.
OAIC Part 2 (updated February 2025). Write the plan before the incident. Roles, containment, assessment, notify, and records — so the NDB clock is not where you invent process.
Your supplier was breached, but whose breach is it? Under the NDB scheme, every entity that holds the record shares the duty. One can assess and notify for all, but if nobody does, all of you are exposed. Agree who does what in the contract, before the incident.
Victim completes a real Microsoft (or other IdP) device-code login for an attacker-controlled client. No fake password form required. Pair with AiTM and helpdesk-impersonation playbooks.
How to show you actually did the Essential Eight. Scope, artefact, date, owner. Overall maturity is the weakest strategy, not the average.
The Commonwealth rule set for where sensitive government data may live. Sensitive data, whole-of-government systems and PROTECTED systems must sit on HCF-certified services; Strategic certification gives the most ownership and control protection, Assured less, Uncertified almost none. New registrations have been paused since 3 November 2025 while the framework is reformed.
Infosec Registered Assessors Program. ASD-endorsed assessors test systems and cloud against the ISM. The report is evidence. Authorisation stays with you.
ASD's control catalogue for Australian government systems — and the shared dialect for anyone who needs to speak the same language. Applicability, tailoring, and dated exceptions are the work.
Part 4 of the Cyber Security Act 2024. What you voluntarily tell the National Cyber Security Coordinator about a cyber incident can be used to help you and to manage national risk, but not to investigate or penalise you for civil or regulatory breaches. It does not replace any report you are legally required to make.
Healthcare providers, repository and portal operators and contracted service providers registered with My Health Record have a breach duty that sits beside the Privacy Act's Notifiable Data Breaches scheme. It starts on suspicion rather than a serious-harm assessment, it goes to both the Australian Digital Health Agency and the OAIC as soon as practicable, and only the Agency may tell patients. Here is what counts, who you tell, what to include and how it differs from an ordinary NDB.
Thirty days to assess a suspicion; notify as soon as practicable once eligible. AGD Privacy Reform Exposure Draft consultation closed 18 Sep 2026 — proposed 72-hour OAIC notify clock is still not law.
The Privacy Act gate for an eligible data breach. Reasonable person, more probable than not, s 26WG factors, then remedial action.
What the Privacy Act requires in an eligible-data-breach statement to the OAIC and to individuals — and how to file it on the OAIC online form.
Part 6A of the NSW PPIP Act. Contain at once, assess within 30 calendar days from when any staff member suspects, tell the Privacy Commissioner immediately on the approved form, notify people as soon as practicable, and keep a register and a public policy. In force since 28 November 2023.
PSPF Release 2025 Policy 14 is the Commonwealth cyber floor (Essential Eight to ML2 for NCEs). Direction 002-2026 adds a hard legacy-tech stocktake deadline of 31 March 2027 — and SoGS measures by 31 December 2026.
Privacy Act 1988, APPs, and the OAIC. Who is an APP entity, the NDB three-limb test, what the notice must say, and which desk pages hold the clocks.
The OAIC now has three levels of enforcement for Privacy Act failures: court-ordered civil penalties for serious or repeated interferences, on-the-spot infringement notices for specific procedural breaches, and compliance notices that tell you what to fix. What triggers each one, what it can cost, and what to check before the OAIC does.
Instructions and data share one channel. ASD and NCSC: no fully reliable model-level fix. Put the controls in the harness.
AGD protective security policy for NCEs. Four domains, PSPF Release 2025 Policy 14 cyber floor, Essential Eight to Maturity Level 2 since July 2022.
Chapter 3A of Queensland's Information Privacy Act 2009. Contain straight away, assess within 30 days, notify the Information Commissioner and people as soon as practicable, and keep a register and a published policy. Councils have been in since 1 July 2026.
Cyber Security Act 2024 Part 3. Pay (or learn someone paid for you) and the clock is 72 hours to ASD's form. Home Affairs watches compliance; the report has use limits.
Software bill of materials plus the CI controls that make it useful. Inventory what you ship, who can publish, and how fast you can patch a dependency.
Security of Critical Infrastructure Act 2018, mapped for practitioners. Eleven sectors, three positive security obligations, extra duties for Systems of National Significance, the 2024 ERP Act changes, and a protected-information offence that catches responsible entities too.
Part 2B of the SOCI Act. Significant impact on availability: 12 hours. Other cyber incidents with a relevant impact: 72 hours. The clock starts when the responsible entity becomes aware, not when root cause is finished.
Firewalls, VPN gateways and edge routers face the internet, are hard to monitor and can reach your internal network, so they are a favourite first foothold. ASD's practitioner guidance gives seven vendor-neutral strategies. In short: know what sits at the edge, buy secure products, patch fast but check for compromise first, use strong authentication, switch off what you don't use, keep management interfaces off the internet, and get logs off the box.
Since 4 March 2026, most internet-connected consumer devices made for the Australian market must ship without guessable shared passwords, with a published way to report security bugs, and with a stated end date for security updates. Suppliers must also hand over a statement of compliance. Here is who is caught, what the three rules mean in practice, and what to check before you stock or buy a device.
A privately declared subset of critical infrastructure assets. SoNS can attract Enhanced Cyber Security Obligations on top of the ordinary SOCI duties.
Since 10 June 2025, individuals in Australia can sue for a serious invasion of privacy under Schedule 2 of the Privacy Act 1988. The five elements, why insider snooping and covert recording are the security cases that matter, the exemptions for reporting to police and ASD, the time limits and damages cap, and what to change in your logging and incident playbooks.
You can outsource the work. You cannot outsource the risk. Cloud shared responsibility, IRAP evidence, ISM procurement — and the vendor update channel that pushes your next plugin build.
What iTnews and techpartner.news report about moving from the Essential Eight to ASD Essentials: existing work remains relevant, every strategy maps to at least one principle, but maturity ratings do not automatically convert.
Western Australia's public-sector breach scheme under the Privacy and Responsible Information Sharing Act 2024. From 1 January 2027: contain immediately, assess and write a report within 30 days of forming a reasonable suspicion, then tell the Information Commissioner and affected people as soon as practicable. Policy, register and annual-report duties come with it.
What to do when a certificate authority's keys are compromised or a root program stops trusting it. Browsers fix themselves within hours; the long tail is everything else that carries its own copy of the trust store, plus any of your own certificates that chain to the distrusted CA.
Hosting platforms, CI/CD services and AI gateways keep your API keys, database passwords and registry tokens. When one of them reports a breach, assume every secret it held is exposed, and remember that a secret is only dead once the service that issued it has revoked it.
Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary