Your best offence is a good defence

Your organisation holds or operates critical infrastructure assets, manages financial systems or handles valuable personal information. It is challenged daily with understanding and meeting an array of current and emerging legal or regulatory responsibilities relating to cyber risk management and security of personal information. 

Australian regulators have moved beyond their initial "raise awareness" phases and are now taking significant enforcement action on non-compliance with cyber risk, cyber security and data privacy laws and regulations.

In recent and high-profile examples, regulators and class action claimants alike have alleged or successfully established that organisations have failed to take reasonable steps or have adequate measures to manage cyber risk, protect the assets or personal information in their custody or control, and comply with their legal obligations.

If a regulator such as OAIC, ASIC, APRA or CISC knocked on your door - or if a shareholder or class action claimant started legal proceedings against your organisation tomorrow - would your organisation's measures pass their tests?

In this presentation, we use recent legal decisions to:

• Understand what are "reasonable steps", "adequate" or "appropriate" systems or measures to satisfy the responsibilities under the SOCI Act, Privacy Act and Corporations Act; 
• Explore the current and emerging state of technical and organisational measures which qualify as being "reasonable", "adequate", or "appropriate" to meet those responsibilities; 
• Unpack the enforcement approaches of regulators such as OAIC, ASIC and CISC; 
• Provide a framework for assessing whether your organisation's measures may pass scrutiny.

​