Frameworks tell you what to do - law decides if it’s enough

Most organisations build their cyber security programs around recognised frameworks - NIST, ISO, the Essential Eight. These frameworks provide structure, maturity models and a sense of comfort that risks are being managed.

But when a cyber incident occurs, organisations are not assessed against frameworks. They are judged against legal obligations, regulatory expectations and contractual commitments.

This session explores the gap between how cyber risk is managed in practice, and how it is evaluated when things go wrong. Through real-world scenarios, we examine how incidents quickly shift from technical events to legal and governance issues, where questions of notification, accountability and "reasonable steps" take priority over control maturity.

It challenges the assumption that framework alignment equals protection, and highlights where organisations are most exposed - particularly at the intersection of cyber security, privacy and governance.

Attendees will leave with a clearer understanding of how law and regulation shape cyber risk outcomes, and practical insights into how to better align cyber programs with the obligations they are ultimately measured against.