Does passing a CPS 234 audit mean our cyber risk is managed?

No. CPS 234 sets a minimum standard for information security capability. Meeting it demonstrates compliance with a floor, not that the specific attack scenarios facing your environment have been assessed or mitigated. A risk-based assessment maps obligations to your actual threat profile and identifies which controls matter and which do not.

We comply with CPS 234. What does CPS 230 add?

A different question. CPS 234 asks whether your information security capability is adequate. CPS 230 asks whether your critical operations survive disruption, including disruption originating with a third party. It requires you to identify critical operations, set tolerance levels for how long and how badly each can degrade, and manage material service provider arrangements against those tolerances, with the board accountable for the outcome. The practical difficulty is rarely the documentation. It is that most entities cannot demonstrate the dependency chain beneath a critical operation, particularly where a material service provider has its own material service providers. Meeting CPS 234 tells you nothing about whether that chain has been mapped.

We already have a CIRMP. Does it still meet our SOCI Act obligations?

Not necessarily. The Enhanced CIRMP Rules commenced on 10 June 2026, introducing additional cyber security, personnel, supply chain and resilience requirements for specified critical infrastructure assets. Transitional compliance dates extend into 2027 and 2028, depending on the asset and applicable provision. The enhanced requirements include stronger controls addressing credential compromise, lateral movement and supply chain risks, alongside updated cyber security framework requirements, including Essential Eight Maturity Level 2 as one recognised option. The 2024 SOCI Act amendments also expanded the scope of relevant critical infrastructure assets to include certain data storage systems holding or processing business-critical data. Telecommunications security obligations were integrated into the SOCI framework in April 2025. Separately, ASD has released ASD Essentials, but this does not automatically replace Essential Eight references in current CIRMP legislation. Organisations should reassess their asset classification, CIRMP scope, applicable requirements, implementation deadlines and supporting evidence to determine whether their existing programme remains compliant.

Do we need DISP membership to bid for Defence work, and what does it require?

Not always. Defence Industry Security Program (DISP) membership is mandatory for certain Defence activities and contracts, including work involving classified information or assets, weapons or explosive ordnance, and security services for Defence facilities, subject to specified exceptions. DISP operates under the Defence Security Principles Framework and covers four domains: security governance, personnel security, physical security, and ICT and cyber security. Membership has four levels: Entry Level for OFFICIAL and OFFICIAL: Sensitive, Level 1 for PROTECTED, Level 2 for SECRET and Level 3 for TOP SECRET. Organisations select appropriate levels across the domains, with higher levels requiring business justification. There is no membership fee, although implementing and maintaining security controls involves costs. All DISP members are now required to achieve and maintain the full Essential Eight Maturity Level 2 standard across corporate ICT systems used to correspond with Defence. Defence assesses compliance through its Cyber Security Questionnaire and assurance processes, with maturity action plans and conditional membership pathways available in certain circumstances. Although ASD Essentials has been released, Defence continues to require Essential Eight ML2 for DISP until its requirements are formally updated. Organisations should select membership levels based on contractual and operational needs rather than seeking higher levels unnecessarily. However, it is fair to expect that DISP requirements will align to those of ASD Essentials in the near future, especially for their third-party providers and suppliers.

ASD has introduced Essentials. Should we stop investing in Essential Eight?

No. ASD has released ASD Essentials as the successor to Essential Eight, with dedicated guidance for enterprise IT, cloud and operational technology. ASD recommends continuing approved cyber security uplift programmes while assessing their alignment with the new framework. Existing Essential Eight controls, tools and assessment evidence remain valuable and can support the transition. Organisations should establish their current baseline, map existing controls to ASD Essentials principles and actions, identify gaps and prioritise improvements based on risk and control effectiveness. Essential Eight maturity levels do not automatically convert into ASD Essentials effectiveness ratings. Organisations should continue meeting existing regulatory and contractual Essential Eight obligations until the relevant requirements change. ASD has not announced a definitive mandatory transition date.

If we pay a ransom, what are we legally required to do?

Report it within 72 hours, if you are captured. Under Part 3 of the Cyber Security Act 2024, the obligation applies to entities carrying on business in Australia with turnover above 3 million dollars in the previous financial year, and to responsible entities for critical infrastructure assets regardless of turnover. It is triggered by payment, not by demand, and a payment made on your behalf by an insurer, negotiator or incident response firm is still your report to file. Three things are frequently misunderstood. Reporting is separate from notifiable data breach obligations to the OAIC, and the same incident can trigger both on different clocks. Home Affairs moved from an education-first posture to active enforcement on 1 January 2026. And sanctions screening must happen before funds move, because paying a sanctioned entity is a distinct and more serious problem than late reporting.

Is post-quantum migration something we need to act on now, or is it a 2030 problem?

Now. ASD's Information Security Manual sets three milestones: a refined transition plan by the end of 2026, migration underway for critical systems by the end of 2028, and traditional asymmetric cryptography including RSA, Diffie-Hellman, ECDH and ECDSA out of use by the end of 2030. That is five years earlier than comparable NIST timelines, and the first milestone is months away. Two points are commonly missed. Inheriting hybrid post-quantum encryption from a cloud provider is a reasonable first step but not a destination, because the widely deployed hybrid configuration uses parameter sets the ISM does not approve beyond 2030, so stopping there commits you to a second migration on the same deadline. And the harvest-now-decrypt-later threat is active today, which means data with a confidentiality life beyond 2030 is already exposed.

We have AI governance in place. Does it cover agentic AI?

Usually not. Most AI governance frameworks were written for models that produce outputs a human then reviews. An agent invokes APIs, writes to systems and chains actions across trust boundaries without a human in the loop, which makes it closer to a non-human identity with standing privileges than to a content tool. The controls that matter are therefore different: scoping of the agent's credentials, what it can authorise without escalation, how tool calls are logged for reconstruction after an incident, and what happens when an agent is manipulated through data it was asked to process rather than through the interface. ISO 42001, the NIST AI RMF, MITRE ATLAS and the OWASP LLM Top 10 each cover part of this and none covers all of it. A policy that governs model use is not a threat model for an agent that acts.

Does the ISM now impose specific requirements on AI agents?

Yes. The September 2026 ISM release extended the AI control set into agentic AI and added controls on non-human identity. The practical requirements are that each agent holds its own identity rather than authenticating as the invoking user or a shared service account, that a register records which tools and data each agent can reach, that access is scoped to the minimum needed, that tool calls are logged, and that a human approves sensitive actions. These sit in the system access chapter, which signals the underlying position: an agent is treated as something holding access, not as a feature of an application. Because they carry control numbers, IRAP assessors can now raise findings against them, and the obligations flow through to PSPF-bound entities and DISP members whose ICT requirements reference the ISM. Most existing deployments fail the identity and register controls immediately.

How should our board be responding to frontier AI cyber threats?

Not with new tooling. ASD's August 2026 board guidance, published with the AICD, directs organisations to fundamentals first: reduce attack surface, replace legacy systems, reinforce identity and access management, restrict unnecessary privileges, and prepare properly for incidents. The reasoning is that frontier models do not invent new attack techniques, they collapse the cost, time and skill required to find and exploit weaknesses, which shortens your patch window rather than changing what you defend. Testing referenced in ASD's guidance found models struggled against environments with active defenders, endpoint detection and meaningful segmentation, particularly between IT and operational technology. The board questions that follow are whether risk tolerance has been reassessed in light of a faster threat tempo, and whether reliance on AI providers has been assessed as a supply chain and foreign ownership, control and influence risk.

CPS 230, Essential Eight and SOCI Advisory

Our Perspective

Risk first. Compliance follows.

Hundreds of cyber security standards exist. Most address the same practices. Organisations that genuinely manage their real risks find that regulatory compliance is a natural consequence, not a separate workstream.

First Principles Are Universal

Govern your risk. Know your assets. Control access. Detect threats. Respond and recover. These principles underpin every framework on this page. Align to a small number of globally recognised frameworks and you will satisfy most requirements across most jurisdictions.

Compliance Is Necessary But Not Sufficient

Ticking compliance boxes without addressing your real threat profile is the most reliable path to a breach. Organisations that focus narrowly on audit outcomes rather than genuine control effectiveness are the ones that get compromised first. If compromised, it hardly matters which boxes were ticked.

Peer Benchmarking Matters

Regulatory compliance sets a floor. Effective security means operating ahead of your peers in your sector and geography. Attackers choose the path of least resistance. Our advisory incorporates peer benchmarking as a standing consideration across all engagements.

The Law of the Digital Jungle

A line often attributed to economist Dan Montano captures it:

Every morning in Africa, a gazelle wakes up. It knows it must run faster than the fastest lion or it will be killed. Every morning a lion wakes up. It knows it must outrun the slowest gazelle or it will starve to death. It doesn’t matter whether you are a lion or a gazelle: when the sun comes up, you’d better be running.

In cyber security, the rules of the jungle change. The gazelle doesn’t need to outrun the fastest lion. It needs to outrun the slowest gazelle in its herd.

Opportunistic cyber criminals look for the easiest, most vulnerable targets. To avoid and survive devastating cyber incidents, your organisation needs to maintain a stronger defence posture than your peers.

Group A — AI and Emerging Technology

AI and Emerging Technology Security

The threat surface is changing faster in AI and quantum than in any other domain. These standards define the emerging front line of cyber security — and the regulatory frameworks are moving from guidance to obligation. Organisations that establish strong AI governance and begin post-quantum migration planning now will be positioned ahead of the compliance curve across every major jurisdiction.

Section 1

Artificial Intelligence Security Standards

AI systems introduce new attack surfaces — prompt injection, data poisoning, model extraction, adversarial inputs and autonomous agent exploitation. Security for AI extends your existing controls into new territory. ISO IEC 42001 is the management system standard for AI; NIST AI RMF is the governance framework adopted by most major financial and government regulators. OWASP LLM, Agentic AI and ML Top Ten frameworks address the practical risks of deploying generative AI, AI agents and machine learning systems in enterprise environments.

THE RISK IS IN THE HARNESS

The EU AI Act is in force, NIST AI RMF is referenced in major financial regulation, and ISO/IEC 42001 provides the most direct path to evidenced AI governance. The threat side is moving faster. Frontier AI is changing what attackers can do and how quickly they can do it, and agentic AI, autonomous systems that take actions across multiple tools and systems, is the most rapidly evolving attack surface in enterprise cyber security. Most of that risk, and most of the available control, sits in the agent harness, not the model.

We are aligned with the Australian Signals Directorate's Agentic AI Harnesses: The layer above the model and the Five Eyes guidance Careful adoption of agentic AI services. High risk deadlines for EU AI Act moved to December 2027 and August 2028. Transparency obligations applied from August 2026. Current as at 30 September 2026.

Standard / Framework	Type	Primary Focus	Also In
ISO IEC 42001	Standard	AI Management System — governance, risk management and lifecycle control of AI systems. The ISO/IEC 27001:2022 equivalent for AI.	ISO/IEC 27001:2022 , NIST AI RMF
ISO/IEC 42005:2025	Standard	AI system impact assessment. Guidance on assessing the impacts of an AI system on individuals, groups and society across its lifecycle. The operative companion to ISO/IEC 42001.	ISO 42001, NIST AI RMF
ISO/IEC 42006:2025	Standard	Requirements for bodies auditing and certifying AI management systems. Defines competence and process requirements for certification bodies, which makes ISO/IEC 42001 certifiable.	ISO 42001, ISO 27001
NIST AI Risk Management Framework	Framework	Risk management for AI systems across design, development and deployment — four core functions: Govern, Map, Measure, Manage	ISO 42001
MITRE ATLAS	Framework	Adversarial threat modelling for AI — tactics and techniques used to attack machine learning models and AI pipelines	MITRE ATT&CK
OWASP LLM Top Ten	Framework	Security risks for generative AI and large language model systems — prompt injection, insecure output handling, data leakage and supply chain risks	OWASP ASVS
OWASP Agentic AI Top Ten	Framework	Security risks specific to autonomous AI agents that perform actions across systems and multi-step workflows — the fastest-developing area as agentic AI enters enterprise environments	MITRE ATLAS
OWASP ML Security Top Ten	Framework	Key security weaknesses in machine learning systems — model poisoning, adversarial attacks and training data manipulation	NIST AI RMF
SANS Critical AI Security Guidelines	Framework	Security practices for designing and deploying AI systems and machine learning pipelines in enterprise environments	NIST AI RMF

Section 2

Post-Quantum Cryptography

Post-quantum cryptography is now an active programme requirement. NIST finalised three standards in August 2024 with a fourth under review. Organisations should begin migration assessments now, prioritising long-lived keys, sensitive data with extended confidentiality requirements, and systems connected to defence, critical infrastructure or financial supply chains.

⚡ NIST PQC Standards — Finalised August 2024

Three algorithms have been fully ratified by NIST. A fourth (FIPS 206) remains under review and has not yet been fully ratified. The NSA CNSA 2.0 suite mandates PQC adoption for US national security systems by 2030. Australian defence and intelligence community requirements are aligning to similar timelines.

FIPS 203 — Finalised

ML-KEM (CRYSTALS-Kyber)

Primary key encapsulation standard. Recommended replacement for RSA and elliptic curve Diffie-Hellman key exchange.

FIPS 204 — Finalised

ML-DSA (CRYSTALS-Dilithium)

Primary digital signature standard. Recommended replacement for RSA and ECDSA signature schemes.

FIPS 205 — Finalised

SLH-DSA (SPHINCS+)

Hash-based digital signature. Conservative backup standard with security grounded in hash function properties, not lattice mathematics.

FIPS 206 — Under Review

FN-DSA (FALCON)

Compact lattice-based signature for constrained environments including IoT and embedded systems. Draft standard pending final ratification.

Standard / Framework	Type	Primary Focus	Also In
ISO 19790	Standard	Security requirements for cryptographic modules	FIPS 140-3
ISO 11770	Standard	Key management frameworks and cryptographic key lifecycle governance	ISO 19790
NIST IR 8547	Transition	Transition to Post-Quantum Cryptography Standards. Quantum vulnerable algorithms at the 112 bit security level, including RSA 2048 and ECC P-256, are deprecated after 2030 and disallowed after 2035.	FIPS 203, FIPS 204, CNSA 2.0
FIPS 203 — ML-KEM	PQC	NIST post-quantum key encapsulation — CRYSTALS-Kyber based. Primary replacement for RSA and ECDH key exchange. Fully ratified August 2024.	FIPS 204, CNSA 2.0
FIPS 204 — ML-DSA	PQC	NIST post-quantum digital signature — CRYSTALS-Dilithium based. Primary replacement for RSA and ECDSA signatures. Fully ratified August 2024.	FIPS 205, CNSA 2.0
FIPS 205 — SLH-DSA	PQC	NIST post-quantum hash-based digital signature — SPHINCS+ based. Conservative backup signature algorithm. Fully ratified August 2024.	FIPS 204, CNSA 2.0
FIPS 206 — FN-DSA Under Review	PQC	NIST post-quantum lattice-based signature — FALCON based. Compact signatures for constrained environments. Draft pending final ratification.	FIPS 204, CNSA 2.0
HQC	PQC	Code based key encapsulation mechanism selected by NIST in March 2025 as a backup to ML-KEM. Security does not rest on lattice mathematics. Selected and pending standardisation.	FIPS 203
NSA CNSA 2.0	PQC	Commercial National Security Algorithm Suite 2.0 — mandates PQC migration timelines for US national security systems. Full adoption target: 2030.	FIPS 203, 204, 205
TLS 1.3	Standard	Current encryption protocol securing data in transit. Post-quantum TLS hybrid modes already deployed by major browsers and services.	ISO 19790, FIPS 203

First Principles Still Hold

While artificial intelligence and quantum computing fundamentally reshape the attack surface — introducing new vectors, new modes of exploitation and new categories of risk — the first principles of cyber security remain unchanged. Identify your assets. Govern your risk. Control access. Detect threats. Respond and recover. Organisations that implement these principles rigorously, adapted for emerging technology environments, remain cyber-resilient regardless of how the technology landscape evolves. The controls evolve. The principles do not.

Group B — Foundations

Governance, Architecture and Risk

The foundations that AI governance and quantum-resistant systems are built on remain unchanged. ISO/IEC 27001:2022 , NIST CSF 2.0 and CIS Controls together cover the core obligations of most jurisdictions and sectors. Align to a small number of these frameworks and most regulatory requirements become straightforward to meet.

Section 1

Governance and Risk Management

These standards structure enterprise cyber strategy, governance models, risk management processes and security control frameworks. ISO/IEC 27001:2022 , NIST CSF 2.0 and CIS Controls are the most broadly adopted globally and serve as the foundation for most compliance frameworks across all jurisdictions.

Standard / Framework	Type	Primary Focus	Also In
ISO 31000	Standard	Enterprise risk management principles and governance structures	NIST CSF v2.0, ISO/IEC 27001:2022
ISO/IEC 27001:2022	Standard	Information security management system — policies, governance and controls	NIST SP 800-53, CIS Controls
ISO 27002	Standard	Security control guidance supporting ISO/IEC 27001:2022 implementation	NIST SP 800-53
ISO 27005	Standard	Information security risk management methodology	ISO 31000, NIST CSF v2.0
ISO 27004	Standard	Measurement of information security performance and metrics	NIST CSF v2.0
ISO 38500	Standard	Governance of information technology at board and executive level	COBIT 2019
COBIT 2019	Framework	Enterprise governance of information and technology including cyber oversight	ISO 38500
NIST CSF 2.0	Framework	Cyber risk management and maturity framework — six functions: Govern, Identify, Protect, Detect, Respond, Recover	ISO/IEC 27001:2022
NIST SP 800-53	Standard	Comprehensive catalogue of security and privacy controls for federal and enterprise environments	ISO 27002, CIS Controls
CIS Critical Security Controls v8.1	Framework	Prioritised set of 18 cyber security controls providing a practical baseline for organisations of all sizes	NIST CSF v2.0
SMB1001:2026 Cybersecurity Framework	Standard	Cyber security maturity framework designed for small and medium businesses in Australia	NIST CSF, CIS Controls
CMMI	Framework	Capability Maturity Model Integration — organisational process maturity covering development, services and program governance	COBIT 2019, NIST CSF v2.0

Section 2

Security Architecture, Engineering and Identity

These standards guide the design of secure enterprise technology environments including networks, infrastructure, cloud services and identity management systems. Cloud security and identity federation are among the highest-priority architectural concerns for most organisations. As organisations migrate to post-quantum cryptography, identity systems and federated authentication protocols will require parallel update cycles.

Standard / Framework	Type	Primary Focus	Also In
ISO 27017	Standard	Cloud security controls and responsibilities between cloud service provider and customer	ISO/IEC 27001:2022
ISO 27018	Standard	Protection of personal data in public cloud services	ISO 27701
CSA Cloud Controls Matrix	Framework	Cloud security control framework used for provider and customer assurance across 17 security domains	ISO 27017
ISO 24760	Standard	Identity management architecture and identity lifecycle governance	NIST SP 800-63
NIST SP 800-63	Standard	Digital identity and authentication framework — identity proofing, authenticators and federation	ISO 24760
FIDO2	Standard	Passwordless authentication and strong user identity verification. Relevant to post-quantum identity migration planning.	NIST SP 800-63
OpenID Connect	Standard	Identity federation protocol used across cloud services and consumer applications	NIST SP 800-63
SAML 2.0	Standard	Identity federation protocol used across enterprise and government systems	NIST SP 800-63

Group C — Build and Operate

Secure Development, Operations and Vulnerability Management

Secure software development, threat detection and vulnerability management are where most breaches originate. OWASP frameworks are critical given the shift to API-first, cloud-native and AI-powered application architectures.

Section 1

Secure Development and Application Security

These standards support secure software engineering, application security testing and integration of security into DevSecOps environments. As organisations adopt AI-generated code, API-first architectures and mobile-first delivery, OWASP frameworks covering LLMs, APIs and mobile security are increasingly material.

Standard / Framework	Type	Primary Focus	Also In
NIST SSDF SP 800-218	Framework	Secure Software Development Framework — integration of security across the full software development lifecycle	ISO 27034
ISO 27034	Standard	Application security governance and secure application design principles	NIST SSDF
OWASP ASVS	Framework	Application Security Verification Standard — security verification requirements for web applications	OWASP SAMM
OWASP SAMM	Framework	Software Assurance Maturity Model — maturity model for improving application security practices	OWASP ASVS
OWASP API Security Top Ten	Framework	Key risks affecting API-based systems — broken authentication, excessive data exposure, BOLA and others	OWASP Top Ten
OWASP MASVS	Framework	Mobile Application Security Verification Standard — security controls for iOS and Android applications	OWASP ASVS
ISO 29147	Standard	Vulnerability disclosure processes between organisations and security researchers	ISO 30111
ISO 30111	Standard	Vulnerability handling and remediation processes within organisations	ISO 29147

Section 2

Security Operations and Threat Management

These frameworks guide threat detection, monitoring, intelligence, incident investigation and cyber response. MITRE ATT&CK is the industry standard reference for adversary tactics and is embedded in SOC tooling, detection engineering and threat hunting programs.

Standard / Framework	Type	Primary Focus	Also In
MITRE ATT&CK	Framework	Knowledge base of adversary tactics and techniques — used for detection engineering, red team planning and threat intelligence mapping	NIST CSF
MITRE D3FEND	Framework	Defensive countermeasure framework mapping mitigation techniques to offensive tactics in MITRE ATT&CK	MITRE ATT&CK
NIST SP 800-61	Standard	Computer security incident handling and response lifecycle — preparation, detection, containment and recovery	ISO 27035
ISO 27035	Standard	Incident management framework — planning, detection, assessment and learning	NIST SP 800-61
ISO 27037	Standard	Digital evidence collection and forensic readiness guidelines	ISO 27035
ISO 27041	Standard	Investigation methods and assurance for digital incidents	ISO 27037
ISO 27042	Standard	Analysis and interpretation of digital evidence in incident investigations	ISO 27037
ISO 27043	Standard	Incident investigation processes and principles for digital forensics	ISO 27035

Section 3

Vulnerability and Patch Management

These standards guide identification, prioritisation and remediation of vulnerabilities. Effective vulnerability management — including the ability to prioritise based on exploitability and exposure — forms the core of Australia's Essential Eight and is one of the highest-return investments available to most organisations.

Standard / Framework	Type	Primary Focus	Also In
ISO 30111	Standard	Vulnerability remediation processes and coordination with internal and external parties	ISO 29147
ISO 29147	Standard	Coordinated vulnerability disclosure processes between researchers and vendors	ISO 30111
NIST SP 800-40	Standard	Enterprise patch management planning and remediation for operating systems and applications	NIST SP 800-53
NIST SP 800-115	Standard	Technical security testing and vulnerability assessment methodology for information systems	NIST SP 800-53
CIS Critical Security Controls	Framework	Vulnerability management and patch management practices within the CIS control set	NIST CSF
OWASP Top Ten	Framework	Application vulnerability risks and mitigation practices — the reference standard for web application security awareness	OWASP ASVS

Group D — Protect and Recover

Data Protection, Resilience and Supply Chain

Data protection, business continuity, supply chain security and OT protection address the second half of the control lifecycle. Regulators globally — GDPR, APRA CPS 230, DORA — are increasingly centred on resilience and recovery, not just prevention.

Section 1

Data Protection and Privacy Governance

These standards support governance of personal information, privacy risk management and cross-border data protection. ISO 27701 extends ISO/IEC 27001:2022 and maps directly to GDPR, the Australian Privacy Act and most other national privacy regulations.

Standard / Framework	Type	Primary Focus	Also In
ISO 27701	Standard	Privacy Information Management System — extends ISO/IEC 27001:2022 with privacy-specific controls and maps directly to GDPR requirements	GDPR
ISO 29100	Standard	Global privacy framework defining eleven privacy principles including consent, data minimisation and accountability	ISO 27701
ISO 29151	Standard	Privacy controls for protection of personally identifiable information — implementing guidance for ISO 29100	ISO 27701

Section 2

Resilience and Recovery

These standards support organisational resilience, disaster recovery and cyber recovery planning. APRA CPS 230, DORA and the UK FCA are materially increasing expectations for tested and evidenced operational resilience — not just plans on paper.

Standard / Framework	Type	Primary Focus	Also In
ISO 22301	Standard	Business Continuity Management System — requirements for planning, implementing and testing continuity programs	ISO 27031
ISO 22313	Standard	Guidance supporting ISO 22301 implementation — practical advice for business continuity professionals	ISO 22301
ISO 27031	Standard	ICT readiness for business continuity and disaster recovery — linking IT resilience to organisational continuity planning	ISO 22301

Section 3

Third Party and Supply Chain Security

Software supply chain attacks and managed service provider breaches represent one of the highest-risk vectors for enterprise organisations. These standards guide governance of supplier relationships and supply chain risk.

Standard / Framework	Type	Primary Focus	Also In
ISO 27036	Standard	Supplier security and supply chain risk management — governance of ICT supply chain relationships	NIST SP 800-161
NIST SP 800-161	Framework	Supply chain cyber risk management for federal and enterprise environments — end-to-end supplier assessment	ISO 27036
SOC 2	Compliance	Independent assurance reporting for service providers — Type I (design) and Type II (operating effectiveness) attestations	ISO/IEC 27001:2022

Section 4

Operational Technology and Critical Infrastructure

OT environments — SCADA, distributed control systems, industrial automation — present a distinct risk profile driven by safety, availability and the convergence of IT and OT networks. These environments are increasingly targeted by nation-state actors.

Standard / Framework	Type	Primary Focus	Also In
IEC 62443	Standard	Cyber security framework for industrial automation and control systems — SCADA, plant control systems and OT environments across all sectors	NIST SP 800-82
NIST SP 800-82	Standard	Security guidance for industrial control systems including SCADA, distributed control systems and OT networks	IEC 62443
ISO 27019	Standard	Information security controls for energy utility control systems and operational technology environments	IEC 62443

Group E — Regional Obligations

Regulatory Compliance by Jurisdiction

Major regulatory obligations across Australia, APAC, the United Kingdom, the European Union, the United Arab Emirates and India. Organisations that implement ISO/IEC 27001:2022 , NIST CSF, ISO 22301 and ISO 27701 with a risk-based approach will find most regional obligations straightforward to meet.

Obligation	Type	Scope	Also In
APRA CPS 234	Compliance	Information security requirements for APRA-regulated financial institutions including banks, insurers and superannuation funds	NIST CSF, ISO/IEC 27001:2022
APRA CPS 230	Compliance	Operational risk and resilience management for APRA-regulated entities. In force since 1 July 2025. The transition period for existing service provider agreements closed on 1 July 2026. Targeted amendments for non-traditional service providers apply from 1 July 2026.	ISO 22301, CPS 234
Protective Security Policy Framework (PSPF)	Compliance	Security governance framework for Australian government agencies — covers personnel, physical and information security. Supported by the ISM for technical controls.	ISO/IEC 27001:2022 , ISM
ASD Essentials	Framework	New, outcome-based, Australian government cyber security framework covering enterprise IT, operational technology and cloud. Structured around principles, actions and domains, with priority phases and effectiveness assessment. While regulatory adoption arrangements are evolving, organisations can assess readiness against the published framework and build on their existing Essential Eight investments.	ASD ISM, NIST CSF 2.0, CIS Controls v8.1, UK NCSC CAF
Essential Eight (E8)	Compliance	ASD baseline cyber security mitigation strategies — four maturity levels (ML0–ML3). Mandatory for Australian government and increasingly expected in supply chains.	CIS Controls
Cyber Security Act 2024	Compliance	Australia's first standalone cyber security legislation. Part 3 requires reporting business entities to report ransomware and cyber extortion payments to the Australian Signals Directorate within 72 hours. Applies to entities with annual turnover above three million dollars and to responsible entities for critical infrastructure assets. No minimum payment threshold. Commenced 30 May 2025.	SOCI, Notifiable Data Breach Scheme
Security of Critical Infrastructure Act (SOCI)	Compliance	Cyber and operational risk obligations for critical infrastructure operators across eleven designated sectors	ISO/IEC 27001:2022
Enhanced CIRMP Rules 2026	Compliance	A second and more prescriptive tier of critical infrastructure risk management requirements for higher risk asset classes. Includes cyber security controls, AusCheck vetting of critical workers, supply chain mapping and FOCI. Commenced 10 June 2026 with staged obligations from December 2026.	SOCI Act, Essential Eight
Defence Industry Security Program (DISP)	Compliance	Security requirements for organisations in the Australian defence supply chain. Four membership levels, being Entry Level, Level 1, Level 2 and Level 3, applied separately across four security domains. Levels map to information classification, and clearance sponsorship is available from Level 1.	ISO/IEC 27001:2022 , ISM, DSPF
Defence Security Principles Framework (DSPF)	Compliance	Security governance framework for Australian defence supply chain organisations — underpins DISP requirements	ISO/IEC 27001:2022 , DISP
Australian Government ISM	Compliance	Technical security controls and operational guidance for Australian government agencies and suppliers handling government information	ISO/IEC 27001:2022 , ASD Essentials, Essential Eight
Australian Privacy Act	Compliance	National privacy regulation — applies to entities with annual turnover exceeding $3M and all agencies handling personal information of Australians	ISO 27701
Privacy Act automated decision-making transparency	Compliance	APP 1.7 requires APP entities to disclose in their privacy policy where a computer program makes or substantially assists decisions affecting an individual's rights. Commences 10 December 2026. A second tranche of reforms is in exposure draft and is not yet law.	Privacy Act, ISO 27701
Notifiable Data Breach Scheme	Compliance	Mandatory breach notification under the Privacy Act. An entity takes all reasonable steps to complete its assessment of a suspected eligible data breach within 30 calendar days. Once it has reasonable grounds to believe an eligible data breach has occurred, it notifies the OAIC and affected individuals as soon as practicable.	ISO 27701
AESCSF	Framework	Australian Energy Sector Cyber Security Framework — cyber security framework for electricity and energy sector operators aligned to NIST CSF	NIST CSF
NESAF v4.0	Framework	National eHealth Security and Access Framework — security and access controls for Australian digital health systems including My Health Record	ISO/IEC 27001:2022 , ISO 27799
Singapore Cybersecurity Act	Compliance	Cyber security governance and reporting for critical information infrastructure operators in Singapore	ISO/IEC 27001:2022
Singapore MAS TRM Guidelines	Compliance	Technology Risk Management Guidelines — cyber risk management and operational resilience for financial institutions regulated by MAS	NIST CSF
Japan Cybersecurity Basic Act	Compliance	National cyber security framework governing government and critical infrastructure protection in Japan	ISO/IEC 27001:2022

Obligation	Type	Scope	Also In
EU GDPR	Compliance	Protection of personal data, privacy governance and cross-border data transfers for all entities processing personal data of EU residents	ISO 27701, NIST Privacy Framework
NIS2 Directive	Compliance	Cyber security governance, incident reporting and supply chain security for essential and important entities in the EU	NIST CSF v2.0, ISO/IEC 27001:2022
Digital Operational Resilience Act (DORA)	Compliance	ICT risk management, operational resilience testing and oversight of third-party technology providers for EU financial entities — effective January 2025	ISO/IEC 27001:2022 , NIST CSF v2.0
Payment Services Directive PSD2	Compliance	Security requirements for electronic payments and strong customer authentication for payment services in Europe and the UK	PCI DSS
EU Medical Device Regulation (MDR)	Compliance	Safety, data protection and cyber security requirements for medical devices and connected healthcare systems placed on the European market	ISO/IEC 27001:2022 , ISO 27799
UK GDPR and Data Protection Act	Compliance	UK post-Brexit data protection obligations for organisations handling personal data of UK residents	ISO 27701
UK NIS Regulations	Compliance	Cyber security requirements for operators of essential services and digital service providers in the UK	NIST CSF
UK FCA Operational Resilience Rules	Compliance	Operational resilience expectations for UK financial institutions — impact tolerances, self-assessment and testing requirements	ISO 22301
UK Telecommunications Security Act	Compliance	Security obligations for telecommunications operators and network infrastructure providers in the UK	NIST CSF
UK NCSC Cloud Security Principles	Framework	Security principles for government cloud services and suppliers delivering cloud services to UK government	ISO 27017

Obligation	Type	Scope	Also In
UAE Information Assurance Regulation	Compliance	National cyber security control framework governing government and critical sector entities in the UAE	ISO/IEC 27001:2022
Dubai Electronic Security Center Standards	Compliance	Security standards for Dubai government entities and digital services within the Emirate	ISO/IEC 27001:2022
UAE Personal Data Protection Law	Compliance	National personal data protection regulation covering collection, processing and transfer of personal data in the UAE	ISO 27701
DIFC Data Protection Law	Compliance	Data protection regulation for DIFC-regulated entities — modelled closely on GDPR principles	GDPR
UAE National Cybersecurity Strategy Controls	Compliance	National cyber security controls covering government, infrastructure and strategic sectors in the UAE	ISO/IEC 27001:2022
UAE Critical Infrastructure Protection Policy	Compliance	Security requirements for critical infrastructure sectors including energy, utilities, transport and aviation in the UAE	ISO/IEC 27001:2022
UAE Health Information Exchange Standards	Compliance	Security and privacy requirements for digital health information exchange platforms in the UAE	ISO 27701

Obligation	Type	Scope	Also In
Digital Personal Data Protection Act (DPDP)	Compliance	India's national personal data protection legislation — governs collection, processing and transfer of digital personal data	ISO 27701
RBI Cyber Security Framework	Compliance	Cyber security governance requirements for banks and financial institutions regulated by the Reserve Bank of India	NIST CSF
RBI Digital Payment Security Controls	Compliance	Security requirements for digital payment systems and payment infrastructure operators in India	PCI DSS
Indian National Cyber Security Policy	Compliance	National cyber security policy governing government and critical infrastructure protection in India	NIST CSF
CERT-In Cyber Security Directions	Compliance	Mandatory cyber security incident reporting for organisations in India — includes 6-hour reporting requirement for critical infrastructure incidents	ISO/IEC 27001:2022
Indian Power Sector Cyber Security Guidelines	Compliance	Cyber security requirements for electricity generation and power infrastructure operators in India	NIST CSF
Indian Health Data Management Policy	Compliance	Governance and protection of health data within digital healthcare systems in India	ISO 27701

Every framework encodes
the same first principles.

Risk first. Compliance follows.

AI and Emerging Technology Security

Artificial Intelligence Security Standards

Post-Quantum Cryptography

Governance, Architecture and Risk

Governance and Risk Management

Security Architecture, Engineering and Identity

Secure Development, Operations and Vulnerability Management

Secure Development and Application Security

Security Operations and Threat Management

Vulnerability and Patch Management

Data Protection, Resilience and Supply Chain

Data Protection and Privacy Governance

Resilience and Recovery

Third Party and Supply Chain Security

Operational Technology and Critical Infrastructure

Regulatory Compliance by Jurisdiction

Sector-Specific Standards and Obligations

Speak directly with a principal.

Every framework encodesthe same first principles.

Risk first. Compliance follows.

AI and Emerging Technology Security

Artificial Intelligence Security Standards

Post-Quantum Cryptography

Governance, Architecture and Risk

Governance and Risk Management

Security Architecture, Engineering and Identity

Secure Development, Operations and Vulnerability Management

Secure Development and Application Security

Security Operations and Threat Management

Vulnerability and Patch Management

Data Protection, Resilience and Supply Chain

Data Protection and Privacy Governance

Resilience and Recovery

Third Party and Supply Chain Security

Operational Technology and Critical Infrastructure

Regulatory Compliance by Jurisdiction

Sector-Specific Standards and Obligations

Speak directly with a principal.

Every framework encodes
the same first principles.