Frequently Asked Questions
Expert answers to common cybersecurity questions for Australian and New Zealand businesses
Proudly serving Australia and New Zealand
We've compiled answers to the most common questions about cybersecurity compliance, standards, and best practices for organisations across Australia and New Zealand. Can't find what you're looking for? Contact our team for personalised guidance.
-
What is ISO 27001 and why is it important for Australian businesses?
ISO 27001 is an internationally recognised standard for information security management systems (ISMS). For Australian businesses, it demonstrates commitment to protecting sensitive data, helps meet regulatory requirements including APRA CPS 234, reduces cyber insurance premiums, and builds trust with clients and stakeholders. It's particularly important for businesses handling government data or operating in regulated sectors.
-
What is Essential Eight and is it mandatory in Australia?
Essential Eight is a prioritised set of mitigation strategies developed by the Australian Cyber Security Centre (ACSC) to protect organisations from cyber threats. While not legally mandatory for all businesses, it's required for Australian Government entities and is increasingly expected by cyber insurers. The eight strategies include application control, patch applications, configure Microsoft Office macros, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups.
-
What is a Security Operations Centre (SOC) and do we need one?
A Security Operations Centre (SOC) provides 24/7 monitoring, threat detection, and incident response for your organisation's cybersecurity. Australian businesses increasingly need SOC services due to rising cyber threats, regulatory requirements under the SOCI Act and Privacy Act amendments, and the difficulty of maintaining in-house security expertise. A managed SOC service like Insicon Cyber's Adaptive SOC provides enterprise-grade security without the cost of building an internal team.
-
What are the cyber security obligations for Australian company directors?
Australian company directors have increasing personal liability for cyber security under their duty of care and diligence. This includes understanding cyber risks, ensuring adequate security controls are in place, maintaining compliance with regulations (including APRA CPS 234 for regulated entities), responding appropriately to incidents, and ensuring business continuity planning. ASIC has elevated powers for publicly listed companies, and the Privacy Act amendments include provisions around director accountability.
-
How does cyber security compliance affect insurance premiums in Australia?
Strong cyber security posture and compliance certifications like ISO 27001 and Essential Eight implementation can significantly reduce cyber insurance premiums in Australia while increasing coverage limits. Insurers assess your security controls, incident response capabilities, and compliance status when determining premiums. Organisations with robust security frameworks typically receive better rates and more comprehensive coverage.
-
What is the difference between ISO 27001 and Essential Eight?
ISO 27001 is a comprehensive international standard covering all aspects of information security management, while Essential Eight is a focused set of eight prioritised strategies from the Australian Cyber Security Centre. ISO 27001 is harder to implement for smaller organisations but provides broader coverage. Essential Eight is more challenging for larger organisations but offers specific technical controls. Many Australian businesses implement both for comprehensive protection.
-
What is APRA CPS 234 and who does it apply to?
APRA CPS 234 is the Information Security standard from the Australian Prudential Regulation Authority that applies to APRA-regulated entities including banks, insurers, and superannuation funds. It requires organisations to maintain information security capability commensurate with their size, complexity, and risks. Key requirements include board accountability, robust information security controls, incident management, and testing of security controls.
-
How can New Zealand businesses comply with trans-Tasman data protection requirements?
New Zealand businesses operating across the Tasman must navigate both the NZ Privacy Act 2020 and Australian privacy regulations. This includes ensuring proper data handling, implementing appropriate security controls, managing cross-border data flows, and maintaining compliance with both jurisdictions' breach notification requirements. ISO 27001 certification provides a framework that satisfies requirements in both countries.
-
What is the cost of a cyber attack for Australian businesses?
The average cost of a data breach in the financial sector reached $6.08 million in 2024, which is 22% higher than the global average. Beyond direct costs, Australian businesses face regulatory fines, reputational damage, customer loss, operational disruption, and potential director liability. The impact extends to cyber insurance premiums and the cost of remediation and compliance improvements.
-
What is ISO 42001 and why is it important for AI governance?
ISO 42001 is the international standard for Artificial Intelligence Management Systems. As Australian and New Zealand organisations increasingly adopt AI technologies, this standard provides a framework for responsible AI governance, including risk management, ethical considerations, transparency, and accountability. It helps organisations manage AI-related risks while maintaining compliance with emerging AI regulations.
Still have questions?
Our cybersecurity experts are here to help. Get personalised advice tailored to your organisation's unique needs and risk profile.