Navigating Australia's New Cyber Security Act: Insights from Revium

In a significant move towards enhancing national cyber resilience, the Australian government has passed the landmark standalone Cyber Security Act, as part of the 2023–2030 Australian Cyber Security Strategy. This game-changing legislation aims to make Australia a world leader in cybersecurity by addressing vital gaps and promoting closer collaboration between industries and government.

A key part of the Act is the "limited use" obligation. This means that information shared by organisations experiencing cyber-attacks can only be used under specific conditions, protecting entities from possible penalties and encouraging open reporting. The Act also requires mandatory reporting of ransom payments and establishes a Cyber Incident Review Board (CIRB) to assess and learn from major cyber incidents.

Key Aspects of the Legislation

The Cyber Security Act brings in several initiatives to boost Australia's cyber defences:

• Mandatory Reporting: Large organisations now need to report ransom payments, providing valuable insights into threat actor operations for cyber professionals.

• Cyber Incident Review Board (CIRB): This board will conduct post-incident analyses and make strategic recommendations for future incident responses.

• Smart Device Standards: New standards will guide consumers on how to buy secure smart devices, impacting a variety of products from smartwatches to autonomous vehicles.

• Simplified Information Sharing: The reform of the Security of Critical Infrastructure Act 2018 (SOCI) aims to make sharing information between government and the telecom industry smoother.

What This Means for Australian Businesses

Businesses across Australia will need to adapt to the new Cyber Security Act, and it will be vital for leaders to take proactive steps in aligning their strategies with the legislative changes. Here’s a quick overview of the areas to consider:

1. Enhance Cybersecurity Protocols:

• Mandatory Reporting Preparations: Developing a framework for timely ransomware payment reporting, adhering to the 72-hour requirement.

• IoT Compliance: Ensuring IoT devices meet new security standards and obtain supplier compliance statements.

• Incident Response Plan Updates: Updating response plans to reflect the expanded incident management powers under the SOCI Act.

2. Foster Information Sharing and Collaboration:

• Voluntary Reporting Considerations: Encouraging openness in cyber incident reporting to strengthen collaboration with the NCSC.

• Leverage Limited Use Protections: Collaborating with government whilst utilising limited use protections to safeguard sensitive information.

3. Revise Legal and Risk Management Strategies:

• Ransom Payment Policies: Reevaluating ransom payment policies considering legal, reputational, and financial implications.

• Directors' Duties and Board Involvement: Ensuring directors understand their responsibilities related to cyber resilience and strategy.

4. Continued Education and Training:

• Conduct Training Sessions: Providing training to keep staff updated on legislative changes and prepare for cyber incidents.

By taking these steps, Australian businesses can not only comply with the new Cyber Security Act but also strengthen their cybersecurity posture, ensuring they remain robust against evolving cyber threats. Indeed, this new legislation may act as valuable leverage in gaining investment in an area that is often underfunded until it is too late.

Our Thoughts on the new Cyber Security Act

While the updated regulations in the Cyber Security Act are a positive step forward, there are a few concerns with some aspects:

• Reporting Scope: Only focusing on large organisations for mandatory reporting leaves out smaller businesses, who often fall victim to ransomware attacks. It's important that these policies include all businesses to make sure smaller enterprises aren't ignored.

• IoT Device Management: Making sure all IoT products meet cybersecurity standards is a tough job. With such a wide range of devices, ensuring compliance is a daunting task. The rollout seems rushed, and taking a more measured approach would help ensure these standards can be applied effectively.

• The Redundancy of New Boards: Is creating a new board like the CIRB truly needed when existing bodies might already be able to handle these tasks. Adding more layers could just lead to unnecessary bureaucracy.

Despite these points, Revium sees the Act's potential to place Australia at the forefront of global cybersecurity. Its success depends on how well it's put into action and adjusted over time to keep up with the ever-changing cyber threat landscape.

The new Cyber Security Act is a big step forward in securing Australia's digital future. It's crucial for industry leaders and policymakers to keep talking, address any gaps, and make sure all organisations, big and small, can navigate these changes confidently. By working together, we can turn strategic visions into strong, actionable outcomes that protect Australia's digital ecosystem for the future.