Companies ‘must lead from top on security’

A new set of governance principles has been released to help organisations strengthen their cyber security in the wake of the Optus and Medibank Private hacks.

Cyber Security Minister Clare O’Neil. Picture: NCA NewsWire / Martin Ollman

A new set of governance principles has been released to help organisations strengthen their cyber security in the wake of the Optus and Medibank Private hacks, with the Albanese government arguing company directors have a critical role to play.

The new principles have been developed by the Australian Institute of Company Directors and the Cyber Security Cooperative Research Centre in consultation with government and industry experts.

Cyber Security Minister Clare O’Neil commended the new rules to all organisations and said building up the nation’s cyber defences would require a “huge collective effort across government and industry.” She pushed company directors to “lift their own cyber literacy levels”.

“As Australians entrust their most sensitive data to organisations, there is a legitimate expectation that it will be protected,” Ms O’Neil said. “It is the responsibility of all organisations across Australia to make stronger cyber security practices a priority and make the necessary investments where needed.”

The principles call for cyber risk and strategy to be included on board agendas and the establishment of clear lines of management responsibility for cyber resilience. A strategy should be developed based on an understanding of the key digital assets of a company, who has access to them and how they should be protected.

The report says cyber risks should be reflected in the existing risk management frameworks of organisations and in the key performance indicators of leaders. Directors should also prepare and plan for cyber incidents, including through the running of exercises.