There is a line in the alert ASD’s Australian Cyber Security Centre published today that most people will skim past. It says the alert “is intended for a technical audience”. A few lines on: “Small to medium business should engage with their MSP or Enterprise IT provider to understand if they use the N-able N-central […]
Tag: #informationsecurity
Cyber.gov.au: How to Protect, Report and Recover from Cyber Threats
Cyber.gov.au is Australia’s free cyber security resource from ASD’s ACSC. Here’s how to use it to understand threats, protect your business, and report and recover from a cyber incident.
From 10 December 2026, Your Privacy Policy Has to Name the Decisions Your Software Makes
From 10 December 2026, new APP 1.7 to 1.9 require your privacy policy to disclose automated decisions about people. The OAIC is reading “computer program” broadly enough to catch spreadsheets, and a human in the loop does not get you out of it.
Everyone Heard 2030. The First Post-Quantum Milestone Is the End of 2026.
Quantum computing arrives in most boardrooms as a 2030 problem, which is a comfortable place to file it. Four years is somebody else’s budget cycle. The date worth writing down is nearer than that. ASD’s recommended transition timeline puts the first milestone at the end of 2026, and what it asks for is not a […]
TLS Certificates Drop to 100 Days in March 2027. Can Your Asset Register List Them?
Most security deadlines arrive as a consultation, a speech or a draft Bill, and the honest advice is usually to wait and see. This one is different. The schedule is already running, the first step took effect six months ago, and the organisations that enforce it have already voted. From 15 March 2026, publicly trusted […]
The Essential Eight Explained (Maturity Levels 0-3)
The Essential Eight is the ACSC’s baseline set of cyber mitigation strategies. Here’s what the eight are, how the maturity levels work, and how it relates to ISO 27001.
Essential Eight vs ISO 27001: Which Does Your Australian Business Need?
The Essential Eight is a focused set of technical controls; ISO 27001 is a full certifiable security management system. Here’s how they differ and which your business needs.
ASD Essentials Is Live: What Replaces the Essential Eight and What It Means for You
The Australian Signals Directorate will retire the Essential Eight within two years, replacing it with a broader, outcomes-based “Essentials” series covering enterprise IT, operational technology, cloud and possibly agentic AI. Here’s what’s changing, the timeline, and what Australian businesses should do now.
Your Cyber Insurer Is Asking the Same Questions an ISO 27001 Auditor Does
Cyber insurers now underwrite on the controls ISO 27001 contains, and APRA’s CPS 230 pushes the same demands down financial-services supply chains. How certification answers both.
ISO 27001 Risk Assessment and the Statement of Applicability: The Gap Auditors Find
The most common finding on an ISO 27001 audit is not a missing control. It is a Statement of Applicability that does not reconcile with the risk assessment. Controls sit there marked applicable while treating no identified risk, and identified risks sit there with a treatment option chosen and nothing in the SoA actually doing […]
