Australian Government Cyber Security Policies by State (2026)

Every Australian government now has a cyber security policy for its own agencies, and most have rewritten theirs in the last two years. If you are a government agency, these policies set your minimum controls and your annual reporting. If you supply services to government, they matter almost as much: the requirements flow down into contracts, security questionnaires and tender evaluations.

Policy advisor reviewing cyber security requirements — NSW agencies now report against the NSW Cyber Security Policy by 31 October each year.

Short answer

The Commonwealth and every state set mandatory cyber security requirements for their own agencies. Most build on the same three foundations: the ASD Essential Eight, the Australian Government Information Security Manual (ISM), and an information security management system aligned to ISO/IEC 27001. What differs is the target Essential Eight maturity level, whether an ISO 27001-based ISMS is required, and when the annual report or attestation is due. None of these policies applies directly to private businesses, but suppliers are routinely asked to show equivalent controls.

At a glance

Jurisdiction	Policy	Essential Eight	ISMS / ISO 27001	Annual reporting
Commonwealth	Protective Security Policy Framework (PSPF), with the ISM	Maturity Level Two for non-corporate Commonwealth entities	ISM-based controls	PSPF self-assessment
New South Wales	NSW Cyber Security Policy 2026-2027	Maturity Level One controls embedded	Not mandated by name	Report to Cyber Security NSW by 31 October
Queensland	Information and cyber security policy (IS18), v9.0.0	Required; maturity target set by risk appetite	ISMS based on ISO 27001 required	Annual return by 30 September, attestation published in the annual report
Victoria	Victorian Protective Data Security Standards (VPDSS) V2.0	Not mandated by name	Not mandated by name	Protective Data Security Plan every two years, attestation every year
South Australia	South Australian Cyber Security Framework (SACSF) V2.0	Separate reporting guideline	Tiered requirements	Annual security attestation under the SA Protective Security Framework
Western Australia	WA Government Cyber Security Policy 2024	Maturity Level One minimum, Level Two where appropriate	Not mandated by name	Annual implementation report
Tasmania	Tasmanian Government Cyber Security Policy V1.1	Not referenced	ISMS required for service delivery agencies; references ISO 27001	Annual report to the Secretaries Board

Commonwealth: PSPF and the ISM

The Protective Security Policy Framework (PSPF) sets protective security requirements for Australian Government entities. Its cyber security policy requires non-corporate Commonwealth entities to implement the Essential Eight to Maturity Level Two, and to consider higher levels where the threat warrants it.

The Information Security Manual (ISM), published by the Australian Signals Directorate, is the detailed control catalogue behind it. It is updated regularly; the current release is September 2026. The ISM is not mandatory for private organisations, but it is the reference most government contracts point to when they ask for “appropriate” security, and it is worth knowing if you handle government information. The Essential Eight is ASD’s prioritised set of eight mitigation strategies, measured against maturity levels zero to three.

The Essential Eight is being replaced. On 15 October 2026 ASD launched ASD Essentials, its successor. There is no single maturity score: each security area is reported separately, with effectiveness ratings backed by evidence such as independent testing and simulated exercises. The Essential Eight stays in place during the transition, no mandatory start date has been set, and ASD advises checking existing Essential Eight controls against the new framework rather than assuming they are equivalent. The state policies below still refer to the Essential Eight, so expect them to change as each government updates its policy.

New South Wales

The NSW Cyber Security Policy 2026-2027 is mandatory for all NSW Government agencies. Its mandatory requirements are grouped under govern and identify; protect; and detect, respond and recover. The protect requirements embed the Essential Eight Maturity Level One controls, and agencies are expected to add safeguards based on their own threat and risk assessments.

Agencies report to Cyber Security NSW by 31 October each year. The report covers an assurance assessment against every mandatory requirement for the previous financial year, cyber risks rated high or extreme, an attestation on the agency’s cyber security posture, an assessment against whole-of-government cyber risks, and an inventory of crown jewel assets.

The policy is not mandatory for local councils, state-owned corporations or universities, but they may adopt it as a standard, and many councils do.

Queensland

The Information and cyber security policy (IS18), version 9.0.0 from February 2025, is mandatory for Queensland Government departments and accountable officers, and applies to statutory bodies for internal controls and risk management. Local governments are encouraged to apply it as better practice.

IS18 is the most explicit of the state policies about ISO 27001. Its five requirements are:

Implement and operate an ISMS based on the current version of ISO 27001, covering all services, information, applications and technology assets.
Apply a systematic, repeatable approach to security risk, integrated with corporate governance and including operational technology.
Meet the minimum security requirements and implement the Essential Eight, with maturity targets set according to risk appetite.
Obtain security assurance scaled to system criticality, and run a cyber incident simulation at least once a year.
Have the accountable officer endorse an annual return and attest to the agency’s security posture, with the attestation published in the annual report.

The annual return for each financial year is due to the Cyber Security Unit by 30 September.

Victoria

The Victorian Protective Data Security Standards (VPDSS) V2.0, administered by the Office of the Victorian Information Commissioner, set 12 high-level mandatory requirements for protecting public sector information. They apply to Victorian public sector organisations, and to contracted service providers with direct or indirect access to that information.

Organisations submit a Protective Data Security Plan every two years, signed off by the head of the organisation, and an attestation every year confirming that the plan’s activities are continuing.

South Australia

The South Australian Cyber Security Framework (SACSF) V2.0 was approved by Cabinet on 23 June 2025 and applies to public sector agencies under the Public Sector Act 2009. It is built on four principles (governance, information security, personnel security and physical security) and 18 policy statements, with requirements tiered across four levels according to each agency’s risk exposure.

Agencies had until 23 March 2026 to analyse the new requirements for their tier and either implement them, approve a dated plan, or put compensating controls in place with the residual risk formally accepted. Separate SACSF guidelines cover incident reporting and Essential Eight reporting.

Western Australia

The WA Government Cyber Security Policy 2024 replaced the 2021 version and applies to public sector entities, government trading enterprises, health services and a list of other bodies including WA universities. Local government is encouraged to comply.

Entities must implement the Essential Eight to Maturity Level One as a minimum, and Level Two where appropriate. Confirmed incidents must be reported to the Office of Digital Government and to ASD’s ACSC through ReportCyber within 24 hours of detection. Other obligations include annual incident response testing, annual cyber security awareness training and an annual implementation report approved by the accountable authority.

Tasmania

The Tasmanian Government Cyber Security Policy (V1.1, November 2022) applies to agencies under the State Service Act 2000. Heads of agency are accountable for their agency’s cyber risk, and agencies must progressively implement the whole-of-government Cyber Security Standards.

Agencies that deliver whole-of-government or multi-agency services must develop and maintain an ISMS, and the policy references ISO/IEC 27001, ISO 31000 and ISO/IEC 27005. Agencies report annually to the Secretaries Board.

What this means for suppliers

None of these policies binds a private company directly. In practice, they reach you through the contract:

Victoria says so outright. The VPDSS apply to contracted service providers with access to public sector information.
Flow-down clauses. Agencies that must manage supplier risk write it into their contracts: data location, incident notification timeframes, audit rights and minimum controls.
Questionnaires and tenders. Expect questions on Essential Eight maturity, incident response and whether you hold ISO 27001 certification.
Incident timelines. If an agency must report within 24 hours, it will expect to hear from you sooner.

ISO 27001 certification is usually the shortest credible answer to all of these, because it shows an independently audited system rather than a self-assessment. Our guides to supplier and third-party risk and data sovereignty and offshoring clauses cover what agencies look for.

How ISO 27001 and the Essential Eight fit together

They are not alternatives. ISO 27001 is the management system: scope, risk assessment, controls chosen on the basis of risk, internal audit and continual improvement. The Essential Eight is a short list of technical controls that ASD considers the baseline against common attacks. An ISO 27001 system gives you the governance, risk and evidence that every state policy asks for, and the Essential Eight sits inside it as part of your technical control set. See our Essential Eight page for how we assess maturity.

Australian government cyber security policies: FAQs

Do state cyber security policies apply to private businesses?

Not directly. They bind government agencies, but agencies pass requirements to suppliers through contracts, and Victoria’s standards apply to contracted service providers that handle public sector information.

Which states require ISO 27001?

Queensland’s IS18 requires an ISMS based on ISO 27001. Tasmania requires an ISMS for service delivery agencies and references ISO 27001. The other states do not mandate it by name, but their governance and risk requirements map closely to it.

Is the Essential Eight being replaced?

Yes. ASD launched ASD Essentials on 15 October 2026. Both frameworks apply during the transition and no mandatory date has been set yet. See what ASD Essentials means for you.

What Essential Eight maturity level do governments require?

Commonwealth non-corporate entities must reach Maturity Level Two. NSW embeds Maturity Level One controls, WA requires Level One as a minimum and Level Two where appropriate, and Queensland sets targets according to each agency’s risk appetite.

Do these policies apply to local councils?

Generally no. NSW, Queensland and WA encourage councils to adopt their policies as better practice, and many do.

How often do these policies change?

Often. NSW now issues its policy for a defined period, Queensland’s IS18 is on version 9, South Australia moved to SACSF V2.0 in 2025 and the ISM is updated several times a year. Check the current version before relying on any requirement.

Sources

Published 12 March 2020 | Updated and facts checked 19 October 2026 | Next review April 2027, or when a policy changes | Jurisdiction: Australia | Edition: PSPF, ISM (September 2026), NSW Cyber Security Policy 2026-2027, IS18 v9.0.0, VPDSS V2.0, SACSF V2.0, WA Cyber Security Policy 2024, Tasmanian Cyber Security Policy V1.1

Meeting government cyber security requirements

Most of these state frameworks expect agencies and their suppliers to run an information security management system aligned to ISO/IEC 27001, and increasingly to demonstrate Essential Eight maturity. Streamline helps Australian organisations meet both, whether you need to win government work or comply as an agency.