Navigating Cyber Threats:

In the face of increasing cyber threats and potential legislative changes, directors and boards have found an ally in the recently developed Governing Through A Cyber Crisis framework.

Introduction to the Cyber Security Landscape

Strong cyber security governance is now a board-level obligation for Australian organisations. As speculation increases about potential amendments to the Corporations Act, placing greater accountability on directors for cyber security and breach management, businesses are on high alert.

However, a momentary reprieve has been granted with the government’s endorsement of the Governing Through A Cyber Crisis framework. Developed collaboratively by the Australian Institute of Company Directors (AICD), the Cyber Security Cooperative Research Centre (CSCRC), and Ashurst, this framework offers a strategic roadmap to enhance organisational resilience against cyber threats.

Framework Fundamentals

Drawing on insights from senior Australian directors, cyber security advisors and government officials, the framework provides practical guidance to help directors navigate Australia’s evolving cyber threat environment and improve their cyber resilience. It advocates for a comprehensive approach, underlining the need for both reactive and preventive measures in cyber incident management.

Enhancing Cyber Maturity

Despite the anxiety surrounding legislative changes, including concerns about the form such legislation might take – and its ramifications from a cost and governance perspective, it’s essential to stay informed and proactive. The evolving regulatory environment highlights the need for boards and directors to familiarise themselves with the recommendations outlined in the framework.

Starting early to enhance the cyber maturity of your organisation at both board and management levels is a crucial step towards mitigating the risks associated with cyber threats.

Director obligations under the Cyber Security Act 2024

The Governing Through A Cyber Crisis framework arrived alongside significant legislative change. The Cyber Security Act 2024 introduced mandatory ransomware reporting within 72 hours for entities meeting the reporting threshold. Directors cannot delegate this obligation away — boards need direct visibility over incident response readiness before a crisis occurs.

Practically, boards need clear visibility over three things: which systems are critical and what they depend on, who has authority to make decisions during an incident, and how the organisation communicates with regulators, staff, and stakeholders when systems are down. The AICD framework provides a structure for building that clarity before an incident forces it.

All IT works with leadership teams on cyber governance readiness, incident response planning, and ACSC Essential Eight implementation. Speak with our team about building a cyber resilience posture that satisfies both the Cyber Security Act 2024 and director obligations under the Corporations Act.