Cyber security requirements for an Australian business depend on who you sell to and who regulates you. Most organisations should reach ASD Essential Eight Maturity Level 1 across all eight strategies, meet Privacy Act and Notifiable Data Breaches obligations, and report ransomware payments within 72 hours if turnover exceeds $3 million. APRA, SOCI and government work add more.
Key takeaways
- The ASD Essential Eight is the Australian default baseline. Even Maturity Level 1 across all eight beats strong scores on a few.
- APRA CPS 234 and CPS 230 flow down to service providers of banks, insurers and super funds.
- The SOCI Act applies to assets in 11 critical infrastructure sectors, with incident reporting within 12 or 72 hours (ASD, 2026).
- The Privacy and Other Legislation Amendment Act 2024 and the Cyber Security Act 2024 have raised the cost of getting it wrong.
- A focused 12-week programme can reach Essential Eight Maturity Level 1 for a typical 100-person, cloud-first organisation.
Why is cyber security now a board-level requirement in Australia?
Cyber security has moved from an IT line item to an operational risk the board owns. Customer contracts, insurer questionnaires, tender prequalification and APRA-regulated supply chains all ask for evidence of specific controls: which framework you run to, at what depth, and how you prove it.
The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 records a cyber incident reported to ASD on average every six minutes, with average self-reported losses of around $97,200 for medium-sized businesses. The OAIC received 1,113 Notifiable Data Breach notifications in 2024, the highest since the scheme began in 2018. Malicious or criminal attack was the leading cause.
This guide is for executives and IT leaders at mid-sized and enterprise Australian organisations, and covers the frameworks that appear on procurement questionnaires and insurance applications.
Why do frameworks matter more than security tools?
A common failure is buying tools without a framework. Endpoint detection, email security, identity governance, backup and SIEM all do real work, but they do not answer the question customers, auditors and insurers ask: what is your baseline, who owns it, and how do you evidence it?
A framework gives you a defined scope, a measurable maturity bar, a control list with owners, and an audit trail on demand.
| Framework | When It Applies | |
|---|---|---|
| ASD Essential Eight | Australian baseline, ASD-published | Default starting point for any AU organisation; required for many federal contracts |
| ISO/IEC 27001:2022 | International ISMS standard | Often required in B2B procurement, global customers, or large enterprise supply chains |
| NIST CSF 2.0 | US-origin risk framework | Common in US-headquartered customers; complements Essential Eight |
| APRA CPS 234 + CPS 230 | APRA-regulated entities and their material service providers | Mandatory if you are an APRA entity; flow-down obligations if you serve banks, insurers, or super funds |
| SOCI Act (2018, as amended) | Critical infrastructure sectors | Mandatory if you operate assets in one of the 11 declared critical sectors |
The framework is rarely a free choice. It follows from who you sell to, who regulates you, and what your insurer requires.
What is the Essential Eight and which maturity level do you need?
The ASD Essential Eight is eight prioritised mitigation strategies, assessed against maturity levels 0 to 3. Commonwealth non-corporate entities target Maturity Level 2 under the Protective Security Policy Framework. In the private sector, Level 1 is the practical entry point, with Level 2 a sensible goal within 18 to 24 months if you sell into government or APRA-adjacent supply chains.
The eight strategies, grouped by objective:
- Prevent malware delivery and execution: application control, patch applications, configure Microsoft Office macro settings, user application hardening.
- Limit the extent of incidents: restrict administrative privileges, patch operating systems, multi-factor authentication.
- Recover data and system availability: regular backups.
Essential Eight maturity levels in plain English
| Maturity Level | What Changes at This Level | Impact | |
|---|---|---|---|
| Level 1 | Opportunistic adversary using widely-available tradecraft | Internet-facing patches within 2 weeks (48 hours if exploited in the wild), MFA on internet-facing services, daily backups, macros blocked from the internet, basic admin separation | |
| Level 2 | Adversary investing more time and capability in a specific target | Phishing-resistant MFA, centralised event logging, admin tasks from privileged access workstations, application control on workstations and servers, immutable backups, OS patches within 2 weeks (48 hours critical) | |
| Level 3 | Adaptive adversary willing to invest substantial effort and resources | Continuous validation of controls, advanced credential hardening, integrity-verified backups tested at scale, application control across user profiles and servers, executable signature validation, full audit logging with retention | Designed for high-value targets and critical infrastructure operators |
Maturity Level 1 across all eight strategies is a more credible position than Level 2 on three and Level 0 on the rest. Even coverage is what procurement questionnaires measure. Full specifications are in the ASD Essential Eight Maturity Model. Expect 8 to 16 weeks of focused effort for a 100-person organisation with a competent internal IT team or partner.
When do you need more than the Essential Eight?
What is the primary driver of your security programme?
- We need an Australian baseline and may sell to governmentEssential Eight Maturity Level 1 to 2
- Enterprise B2B customers ask for security certification in contractsISO/IEC 27001:2022 (often layered on top of Essential Eight)
- We have US-based customers or are part of a US groupNIST CSF 2.0, mapped to Essential Eight
- We are APRA-regulated or a material service provider to oneAPRA CPS 234 (and CPS 230 from July 2025)
- We operate in a declared critical infrastructure sectorSOCI Act obligations plus Essential Eight
- We sell to Commonwealth Government at PROTECTED levelIRAP assessment against the ISM
ISO/IEC 27001:2022 and NIST CSF 2.0
ISO 27001 is a management system standard. It requires a defined scope, risk assessment, controls selected from Annex A (93 controls in the 2022 revision), and continual improvement. First certification commonly takes 9 to 18 months, and it is the most requested credential in enterprise B2B procurement.
NIST CSF 2.0, released in 2024, organises security around six functions: Govern, Identify, Protect, Detect, Respond, Recover. Many Australian organisations use it as the board reporting narrative and map Essential Eight controls into it.
APRA CPS 234 and CPS 230
APRA CPS 234 (Information Security) applies to banks, insurers and super funds, and extends to information assets managed by related or third parties. If you process data for an APRA-regulated entity, CPS 234 flows down through your contract. Obligations include defined roles, controls proportionate to criticality, notifying APRA within 72 hours of a material incident, and annual control testing.
CPS 230 (Operational Risk Management) took effect on 1 July 2025. It tightens third-party risk management with service provider registers, continuity testing with critical providers and APRA notification of material arrangements. Expect more rigorous due diligence if you sit in an APRA supply chain.
SOCI Act and critical infrastructure
The Security of Critical Infrastructure Act 2018, as amended, covers 11 sectors: communications; financial services and markets; data storage or processing; defence industry; higher education and research; energy; food and grocery; health care and medical; space technology; transport; and water and sewerage.
Responsible entities must register critical assets, maintain a Critical Infrastructure Risk Management Program (CIRMP), and report incidents to ASD within 12 hours (significant) or 72 hours (relevant). If you run a data centre, a managed platform processing critical data for others, or assets in a declared sector, get legal advice on whether you are a responsible entity. Our guide to SOCI Act CIRMP compliance goes deeper.
IRAP and the ISM
The Information Security Manual (ISM) is ASD's detailed control catalogue. Selling PROTECTED-level services to the Commonwealth requires an IRAP assessment against it, a significant step up from the Essential Eight.
Which recent regulatory changes matter most?
Privacy Act reforms
The Privacy and Other Legislation Amendment Act 2024 received assent in December 2024. Key changes:
- A statutory tort for serious invasions of privacy where the invasion is intentional or reckless.
- Tiered civil penalties beneath the existing maximum (the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover).
- Expanded OAIC enforcement powers, including infringement notices.
- Automated decision transparency obligations, commencing 10 December 2026.
- A developing Children's Online Privacy Code.
Organisations above $3 million turnover are APP entities and should treat the reforms as raising the cost of a privacy failure.
Notifiable Data Breaches scheme
The Notifiable Data Breaches scheme requires APP entities to notify the OAIC and affected individuals as soon as practicable after becoming aware of an eligible breach: unauthorised access, disclosure or loss of personal information, likely to cause serious harm, where remedial action has not removed that risk. A suspected breach triggers a 30-day assessment obligation.
- DetectAnomaly, alert, report, or third-party notification
- ContainIsolate affected systems, revoke credentials, preserve evidence
- AssessDetermine scope and whether 'serious harm' threshold is met (within 30 days)
- NotifyOAIC and affected individuals as soon as practicable; ASD for critical infrastructure; APRA if CPS 234 entity
- RemediateRoot cause analysis, control uplift, post-incident review and board report
Cyber Security Act 2024 ransomware reporting
The Cyber Security Act 2024 commenced in stages. If your annual turnover exceeds $3 million and you, or someone on your behalf, make a payment or provide a benefit to a cyber extortion actor, you must report it to the Department of Home Affairs within 72 hours. Failure to report is a civil penalty matter.
The Act also creates a Cyber Incident Review Board and a "limited use" protection for information shared voluntarily with government. In practice, every organisation needs a documented process for ransom decisions: who has authority, and how reporting will be lodged on time. More in our article on ransomware reporting under the Cyber Security Act.
Who should own cyber security in a mid-sized organisation?
Frameworks fail when ownership is unclear. A defensible model:
- Board: risk appetite and quarterly oversight.
- CEO: accountable for cyber resilience and material incident steering.
- CIO or fractional CISO: owns the control environment and maturity roadmap.
- Privacy Officer (often Legal or COO): owns Privacy Act compliance and breach notifications.
- External assurance: independent annual assessment, penetration testing, IRAP or ISO audit support.
Few organisations outside the ASX 200 justify a full-time CISO. A fractional CISO or security partner with defined deliverables often achieves more than one internal hire covering strategy, operations and incident response.
How do you reach Essential Eight Maturity Level 1 in 12 weeks?
For a 100-person, cloud-first organisation on Microsoft 365, Level 1 across all eight is achievable in about 12 weeks. The sequence front-loads the controls that reduce risk fastest.
- Week 1-2Baseline and quick winsAsset inventory, current-state assessment against the Essential Eight, enable MFA on all internet-facing services, enable conditional access policies
- Week 3-4Backups and recoveryValidate backup scope, configure immutable retention, run a documented restoration test, document RTO and RPO for tier-1 systems
- Week 5-6Patching programmeStand up automated patching for OS and key applications, define SLAs (2 weeks routine, 48 hours critical), retire vendor-unsupported software
- Week 7-8Office hardeningBlock internet-source macros, document trusted locations, harden browsers via group policy, disable Java and Flash, enable application reputation services
- Week 9-10Administrative privilege controlSeparate privileged and standard accounts, remove local admin from workstations, restrict privileged accounts from email and web, log privileged activity
- Week 11Application controlDeploy execution blocking from user-writable directories in audit mode, then enforce; centralise logs
- Week 12Evidence pack and uplift planComplete the Essential Eight self-assessment, produce evidence pack for procurement and insurance, plan Level 2 uplift items for next quarter
This assumes a single-site, cloud-first environment. Add 4 to 8 weeks for on-premise Active Directory, a major ERP, operational technology in scope, or multiple sites.
What should a cyber security budget cover?
Vendor pricing varies too much to quote usefully, so budget by category. A baseline programme typically covers identity and MFA, endpoint protection and EDR, email security, patch and configuration management, backup and recovery, security awareness, SIEM or managed detection and response, external assessment and penetration testing, and cyber insurance. First-year implementation adds professional services and internal time on top. CPS 234, SOCI and IRAP raise the upper bound.
- Average self-reported loss per cyber incident, medium business (ASD 2024-25)$97,200
- Notifiable data breach: legal, forensic, notification and remediation effortSignificant
- Privacy Act maximum civil penalty for serious or repeated interferenceGreater of $50m, 3x benefit, or 30% adjusted turnover
- Lost contracts from unanswerable security questionnairesReal, often unseen
Beyond direct losses, the cost compounds through failed insurance applications, lost contracts and the distraction of unstructured incident response.
How does AI change cyber security requirements?
Offensive AI is industrialised. Generative AI has cut the cost and skill needed for convincing phishing, business email compromise lures, deepfake voice impersonation and tailored social engineering. The response: phishing-resistant MFA (FIDO2 or passkeys, never SMS), out-of-band verification for payment instructions, and executive deepfake drills.
Defensive AI is standard. EDR, email security and SIEM products now use AI for anomaly detection, alert triage and incident summaries. The risk is over-reliance on opaque vendor models without governance: who validates the model, where data is sent, and what happens on a misclassification.
The National AI Centre's Guidance for AI Adoption (October 2025) gives a governance scaffold for any AI in your environment, including security tools. See our AI agent governance guide and our 50-point AI security checklist.
What should the board see each quarter?
A defensible quarterly cyber report covers seven areas: threat and regulatory change; Essential Eight maturity by strategy against target; the top five cyber risks against appetite with owners; material incidents, including ransom decisions and breach assessments; third-party risk across critical providers; insurance position and exclusions; and progress against the annual roadmap.
Third-party risk management
If you serve APRA-regulated customers, CPS 230 raises the bar on every material provider in your stack. Even outside APRA, treat critical providers (cloud, managed services, payroll, finance) as if CPS 230 applied: register and classify them, run annual due diligence, collect evidence of controls (ISO 27001, SOC 2 Type II, IRAP where relevant), and contract for incident notification and audit rights. For data residency, see our data sovereignty guide and Privacy Act vs GDPR comparison.
Cyber insurance
Insurers now commonly require MFA on external and privileged access, EDR, tested immutable or offline backups, awareness training and a documented incident response plan, and many ask for Essential Eight self-assessment results. Treat the application as a free external audit.
Where should you start this quarter?
- This week: run an Essential Eight self-assessment against Maturity Level 1 using ASD's guide. Summarise the gap in two pages.
- This month: name the accountable executive, approve a 12 to 16-week uplift, and confirm whether APRA, SOCI or government supply obligations apply.
- This quarter: deliver the uplift, run a tabletop exercise including a ransom decision and a breach notification, and refresh your insurance application with the evidence pack.
- This year: decide whether ISO 27001, NIST CSF or IRAP are commercially worth it, document third-party risk management and set the board reporting cadence.
How Solve8 can help
Our consultants and engineers help mid-sized organisations run the operational side of security uplift and govern AI tools that touch sensitive data, with AI kept on your infrastructure in Australia. See our managed services, private AI infrastructure and security approach, or talk to us.
Related reading
- AI Security Checklist: 50 Essential Points for Australian Businesses
- Financial Services AI Compliance: APRA and ASIC Requirements
- Privacy Act vs GDPR for Australian Business
- AI Government Contracts and Compliance Requirements
- AI Agent Governance, Data Access, Privacy and Human Override
Sources: Australian Signals Directorate, Annual Cyber Threat Report 2024-25; ASD, Essential Eight Maturity Model; ASD, Information Security Manual; OAIC, Notifiable Data Breaches Reports; APRA, CPS 234 and CPS 230; Department of Home Affairs, Cyber Security Act 2024 and SOCI Act 2018; NIST, Cybersecurity Framework 2.0.
