Australian businesses can face IT and cybersecurity requirements from several directions at once. Privacy legislation, APRA prudential standards, the SOCI Act, government security requirements and standards such as ISO 27001 each use different terminology and ask for different forms of evidence.
The search for IT compliance services often starts when a client questionnaire, an insurance renewal or a regulator’s letter arrives with a deadline attached. That is a practical starting point, but the work becomes easier when you understand which requirements apply and where their controls overlap.
This guide explains what IT compliance means, which requirements may apply to your business, what the work involves and how to assess your position before engaging a provider. The central point is simple: you need controls that meet your obligations and current evidence that those controls work.
What is IT compliance
IT compliance means meeting the legal, regulatory, contractual and industry requirements that apply to your technology systems, data handling and security practices, and being able to demonstrate that you meet them.
Cybersecurity focuses on protecting your environment. Compliance focuses on meeting defined obligations and demonstrating that you have done so. The two overlap: effective cybersecurity also needs testing, records and assurance. Both rely on evidence, but compliance is assessed against the requirements that apply to your organisation.
Compliance does not guarantee protection. An assessment has a defined scope and set of requirements, so a business can meet one standard while still carrying risks outside that scope. A well-defended business can also fall short if it cannot demonstrate that required controls are implemented and operating effectively.
Why IT compliance matters in Australia
Applicable obligations can carry significant penalties, regulatory scrutiny and consequences for winning or retaining business. Four commonly encountered sources of requirements are:
The Privacy Act 1988 generally covers Australian Government agencies and organisations with annual turnover above $3 million, as well as some smaller organisations. For a body corporate’s serious interference with privacy, the maximum civil penalty is the greater of $50 million and three times the attributable benefit, where the court can determine that benefit. If it cannot, the comparison is with 30 per cent of adjusted turnover during the statutory breach turnover period.
APRA CPS 234 sets information security requirements for APRA-regulated entities, including banks, credit unions, insurers and superannuation trustees. It includes requirements for security capability, control testing and oversight of information assets managed by third parties.
The Essential Eight is ASD’s set of eight cybersecurity mitigation strategies, supported by a maturity model. Under the Protective Security Policy Framework, non-corporate Commonwealth entities must implement the strategies to at least Maturity Level Two. Private-sector requirements depend on applicable contracts, policies and regulation.
The Security of Critical Infrastructure Act 2018 imposes obligations that depend on the asset class and the entity’s role. These can include a written critical infrastructure risk management program and mandatory cyber incident reporting. Where reporting obligations apply, incidents having a significant impact on an asset’s availability must be reported within 12 hours of awareness. Other incidents having, or likely to have, a relevant impact must be reported within 72 hours of awareness.
A regulator may not be the first to ask. Customers can request security evidence before signing a contract, and cyber insurers can ask about controls such as multi-factor authentication when assessing cover. A current evidence pack helps you answer those questions consistently and identify gaps before a deadline arrives.
Which requirements apply to your business
Start with the data you hold, the sector you operate in, the services you provide and the commitments in your contracts. The following are common starting points, rather than a complete list.
If you handle personal information
First establish whether the Privacy Act applies to your organisation. If it does, the 13 Australian Privacy Principles are a starting point. APP 11 is particularly relevant to IT and security teams, but its delivery involves the wider business. It requires reasonable technical and organisational measures to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.
Organisations must also take reasonable steps to destroy or de-identify personal information they no longer need for a purpose permitted by the APPs, subject to exceptions for Commonwealth records and retention required by Australian law or a court or tribunal order.
Under the Notifiable Data Breaches scheme, an entity with reasonable grounds to believe an eligible data breach has occurred must notify the OAIC and individuals at risk of serious harm as soon as practicable, unless an exception applies. Suspected eligible breaches require a reasonable and expeditious assessment, with all reasonable steps taken to complete it within 30 calendar days.
If you are regulated by APRA
CPS 234 addresses information security. CPS 230 addresses operational risk management, business continuity and service-provider risk. Together, they require attention to the resilience and security of services delivered through external providers, as well as your own environment. Our guide to APRA CPS 234 explains the implications for IT.
If you supply government or operate critical infrastructure
Government buyers may specify an Essential Eight target maturity level or other security requirements. The maturity model runs from Level Zero to Level Three. Check the actual tender and contract requirements rather than assuming one level applies to every supplier.
For critical infrastructure, confirm which SOCI obligations and risk management rules apply to your asset. Where a cyber framework requirement applies, check the prescribed framework, version, maturity or security profile, and any transition deadline. Options can include the Essential Eight, ISO 27001, NIST and the Australian Energy Sector Cyber Security Framework, depending on the applicable rules. Choosing a framework does not, by itself, satisfy all SOCI obligations.
Our comparison of Essential Eight, ISO 27001 and NIST explains their different purposes. For critical infrastructure obligations, see our SOCI compliance page.
