Update, 28 September 2026: it has happened again, and this time the other side of the table was the Australian Government. On 24 September the Prime Minister disclosed that on 18 June an OpenAI agent, running an internal research task on public medicine spending, gained unauthorised access to Services Australia’s Medicare statistics reporting portal. When […]
Information security and cyber
The OAIC Just Cleared Qantas Over a 5.7 Million Record Breach: What “Reasonable Steps” Means
The OAIC closed its inquiry into the Qantas breach with no action. In doing so it published the clearest picture yet of what “reasonable steps” under APP 11 looks like, and how you evidence it.
Who’s Backing Up Your Cloud Data? The SaaS Backup Gap
Most businesses assume Xero, Microsoft 365 and Google back up their data. Under the shared responsibility model, they don’t. The SaaS backup gap and how to close it.
Securing Personal Information Under APP 11.3: Where ISO 27001 and ISO 42001 Fit
Australia’s new APP 11.3 says the reasonable steps to secure personal information include technical and organisational measures: exactly what ISO 27001 delivers. Here’s what the OAIC guide requires, and why ISO 42001 closes the AI gap it leaves open.
Cyber.gov.au: How to Protect, Report and Recover from Cyber Threats
Cyber.gov.au is Australia’s free cyber security resource from ASD’s ACSC. Here’s how to use it to understand threats, protect your business, and report and recover from a cyber incident.
From 10 December 2026, Your Privacy Policy Has to Name the Decisions Your Software Makes
From 10 December 2026, new APP 1.7 to 1.9 require your privacy policy to disclose automated decisions about people. The OAIC is reading “computer program” broadly enough to catch spreadsheets, and a human in the loop does not get you out of it.
Your Cyber Insurer Is Asking the Same Questions an ISO 27001 Auditor Does
Cyber insurers now underwrite on the controls ISO 27001 contains, and APRA’s CPS 230 pushes the same demands down financial-services supply chains. How certification answers both.
ISO 27001 Risk Assessment and the Statement of Applicability: The Gap Auditors Find
The most common finding on an ISO 27001 audit is not a missing control. It is a Statement of Applicability that does not reconcile with the risk assessment. Controls sit there marked applicable while treating no identified risk, and identified risks sit there with a treatment option chosen and nothing in the SoA actually doing […]
What You Govern Is the Harness, Not the Model
Short answer Most AI governance effort goes into choosing and restricting the model. The Australian Signals Directorate’s position, published on 11 September 2026, is that the risks an organisation can genuinely control sit in the layer around the model: the software that decides what the model sees, what tools it can reach, what it is […]
Origin Says the Breach Is “Potential”. That Word Starts a 30-Day Clock.
Origin Energy said on 22 July that it is “currently investigating a potential security incident which may involve unauthorised access to some customers’ data”. It added that it does not believe the affected data includes credit card or bank details, and that it has notified the Australian Cyber Security Centre and the Australian Federal Police. […]
- « Previous Page
- 1
- …
- 4
- 5
- 6
- 7
- 8
- Next Page »
