Tag: #iso27001

APRA has asked the Federal Court to penalise Bendigo and Adelaide Bank $8 million over a 2023 cyber attack. Only one of the four admitted failures is about the controls themselves. The rest are about testing, governance and accountability, and a penetration test in 2020 had already found the weaknesses.

Awareness is a certifiable requirement: clause 7.3 of both ISO 27001 and ISO 42001. How cyber threats have evolved beyond the office, and two free resources (KnowBe4 CAPY and cyber.gov.au) that build a security-aware team at work and at home.

The OAIC recorded 1,205 notifiable data breaches in 2025, the highest since the scheme began. The number that matters isn’t the headline. It’s the 489 that weren’t attacks.

Outlook autocompletes scott@unwanted.com instead of scott@mycompany.com. The stranger’s AI notetaker joins on their behalf, and records the lot. How it happens, and the Teams setting that stops it.

Most business continuity plans nominate mobile as the failover when the primary connection drops. Today’s nationwide Telstra outage showed why that’s a hidden single point of failure, and what a real BCP does about it.

Ask most businesses how they handle security awareness and you will hear the same answer: an annual slide deck and a quiz nobody remembers by lunchtime. It ticks a box. It changes almost nothing. When a well-crafted phishing email lands three months later, the slide deck is not in the room. The habit is, or […]

Claude reliability incidents highlight a new continuity risk: what happens when business-critical AI agents and their underlying providers become unavailable?

ISO 27001 and SOC 2 both prove you manage information security, but they suit different markets. Here’s the difference, and how one system can support both.

From 29 July 2026, around 80,000 Australian firms must enrol with AUSTRAC and hold clients’ identity documents. An ISO auditor on the security exposure most of them will miss.