Regulation explainers, risk guides, and practical articles for Australian businesses, professionals, and their advisers.
Frameworks Explained
A plain-English guide to how the Australian Energy Sector Cyber Security Framework actually works — the 11 domains, the MIL-0 to MIL-3 maturity scale, Security Profiles SP-1/SP-2/SP-3, and the anti-patterns that can quietly cap your result.
Read articleThreat Landscape
The most capable AI models now run multi-stage intrusions, write flawless phishing and clone voices and faces at machine speed — including the first documented AI-orchestrated espionage campaign. What enterprises now face, and why a measured control baseline matters more than ever.
Read articleRegulation & Compliance
Registered 9 June 2026, the enhanced CIRMP Rules bind nine asset classes — energy, gas, fuel, water, broadcasting, DNS and freight — to enhanced cyber, personnel, supply-chain and physical security. For energy that means AESCSF Security Profile 2, with 12 and 24-month grace periods.
Read articleEnterprise & Export
Everyone watches December 2027 — but from 11 September 2026 the EU Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities within 24 hours. What the cascade requires, and where Australian exporters report.
Read articleEnterprise & Export
What Australian businesses that sell or export digital products to Europe need to know about the new mandatory cyber security requirements taking effect in 2027.
Read articleRegulation & Compliance
Now law (registered 9 June 2026). The headline change for energy: lift cyber maturity to AESCSF SP-2 across all 11 domains by around mid-2028. Most responsible entities sit at SP-1 today — here is why that jump is the hard part.
Read articleRegulation & Compliance
CPS 234 has been in force since 2019 — but the bar has moved. The tripartite assessment programme has surfaced six common gaps across 300+ regulated entities. FAR has made executive accountability explicit. CPS 230 has added overlapping obligations. Here's where compliance sits now.
Read articleRegulation & Compliance
Hong Kong's Protection of Critical Infrastructures (Computer Systems) Ordinance came into force on 1 January 2026, alongside the Commissioner's Code of Practice. Here's what designated CIOs across the eight covered sectors must do — three obligation categories, supply-chain ripple, penalties up to HK$5 million.
Read articleEU Regulation & Financial Sector
DORA is already in force. What financial entities and ICT providers need to know about the EU's Digital Operational Resilience Act — who is in scope, the five pillars, and what to do now.
Read articlePayment Card Security
The transition window has closed. v4.0.1 is the only active version of the standard and the 51 future-dated requirements have been mandatory since 31 March 2025. Here's what changed, what every assessment is now scoring against, and how to verify your environment is current.
Read articleRegulation & Compliance
What your professional conduct obligations actually require — the confidentiality duty, minimum expectations from Law Societies, trust account risks, and the new ransomware reporting obligation.
Read articleRegulation & Compliance
What your ACL, Best Interests Duty, and Privacy Act obligations require — covering client data, aggregator portal risk, settlement fraud, and breach reporting.
Read articleRegulation & Compliance
ASIC has now won Federal Court penalties against two AFSL holders for cyber security failures. What financial planners and advice licensees must do to meet their Corporations Act obligations.
Read articleRegulation & Compliance
What changed with the 2024 legislation, which obligations are already in force, and what's coming in the next round of reforms — explained for business owners.
Read articleRegulation & Compliance
From 1 July 2026, real estate agents become AML/CTF reporting entities for the first time. Settlement fraud is already active. Here's what the combined risk landscape means for your agency's data security and compliance obligations.
Read articleRegulation & Compliance
Bookkeepers hold TFNs, payroll records, and direct access to client banking environments. The TPB's 2024 Code Determination explicitly requires you to protect that data — and a compromised bookkeeper account can expose every client they manage.
Read articleFramework Guide
Australia's most important cyber security baseline — what the eight controls require, what maturity levels mean in practice, and who must comply.
Read articleRegulation & Compliance
Disability services report more data breaches than any other industry in Australia. Here's what your NDIS Commission, Privacy Act, and Cyber Security Act obligations require you to do to protect participant data.
Read articleRegulation & Compliance
NQF digital technology policies are now mandatory, CCTV requirements have changed, and the way your service handles images of children is under regulatory scrutiny. Here's what approved providers need to do.
Read articleRegulation & Compliance
What the Tax Practitioners Board Code of Conduct requires from accountants and BAS agents — and what evidence you need if something goes wrong.
Read articleInsurance & Due Diligence
What insurers are actually asking in applications, which controls they check for, and why claims get denied when the answers don't match reality.
Read articleCyber Threats & Risk
The real costs of a cyber attack — downtime, legal obligations, and why 1 in 5 small businesses don't recover. What you're required to do if it happens.
Read articleRegulation & Compliance
What GP clinics and allied health providers must do to protect patient data under AHPRA's Code of Conduct — and why the small business exemption doesn't apply.
Read article