Leadership in cyber security governance
The complex and evolving risk of cyber incidents presents serious security challenges for owners and operators of Australia’s critical infrastructure assets. Cyber security risk management is an imperative for all levels of management from the Board down. An organisation’s Board, Directors and senior management play a pivotal role in developing frameworks to adequately identify and manage cyber risks.
Australia’s cyber security regulatory framework is designed to support the security and prosperity of our critical infrastructure. Cyber governance obligations are intended to help organisations manage risks and respond to cyber security incidents. This includes obligations under the Security of Critical Infrastructure Act 2018 (SOCI Act), the Privacy Act 1988 and the Corporations Act 2001. These obligations help businesses prepare for cyber incidents, report incidents when they occur, and respond to the consequences of an incident.
Through our consultation on the 2023–2030 Australian Cyber Security Strategy (the Strategy), we heard that there is a need for better clarity on cyber governance obligations. Directors, Boards and business operators feel that they face a complex regulatory environment. Many expectations of cyber governance are unclear. Industry feedback has flagged that more could be done to help businesses understand what good cyber security looks like.
Clarifying public regulatory guidance is a commitment from Government in the Strategy, and this document is a first step on that road. Under Initiative 5 of the Strategy, the Australian Government committed to provide clear cyber guidance for businesses. As a first step, this document provides an overview of corporate obligations for critical infrastructure owners and operators. Next, the Government will consider how best to collaborate with industry to guide good cyber governance. Government systems are also a critical part of the nation’s digital infrastructure. As part of our Strategy, the Government has committed to hold ourselves to the same standards we impose on industry. In parallel to clarifying obligations on industry, we will do the same for government departments and agencies as part of a broader plan to uplift Commonwealth cyber security.
Views: 15
