Skip to main content

Cyber resilience

ASIC cyber resilience resources

Being cyber resilient helps ensure that businesses can adapt to disruptions caused by cyber security incidents while maintaining continuous business operations.

Importance of cyber resilience in the digital age

Cyber resilience is essential to all businesses operating in the digital economy. As digital services become more interconnected, the increasing sophistication and frequency of cyber-attacks has the potential to cause widespread disruption and damage. A material cyber incident may cause significant harm to consumers, destabilise markets and affect trust and confidence in Australia’s financial system.

Cyber resilience is the ability to adapt to disruptions caused by cyber security incidents while maintaining continuous business operations. This includes the ability to detect, manage and recover from incidents.

For the financial sector and markets, obligations on licensees, and the people that run them, to properly manage cyber risks are set out in the Corporations Act 2001, National Consumer Credit Protection Act 2009 and ASIC Market Integrity Rules. ASIC is responsible for the supervision and enforcement of compliance with these obligations.

ASIC has published information and guidance to help entities improve their cyber security and resilience and comply with their licence obligations.

Cyber resilience good practices

We have compiled a set of good practices to help businesses improve their cyber resilience posture. These good practices were identified as part of a previous self-assessment process by a sample of financial entities against the NIST Cybersecurity Framework, as well as more detailed follow-up discussions we conducted. We have summarised these good practices in the flow diagram below. For more information see: Cyber resilience good practices.

Key questions for Boards

Recognising and managing risk is a crucial part of the role of an entity’s board of directors and senior management. To enable boards to do this, entities must have an appropriate framework to identify and manage risk on an ongoing basis.

Given the magnitude and prominence of cyber risk for most entities, informed oversight of risk involves the board being satisfied that cyber risks are adequately addressed by the entity’s risk management framework. Important controls include ensuring the entity has appropriate safeguards in place against malicious cyber activities, and that recovery capabilities are adequate.

Risk management framework

Are cyber risks an integral part of the organisation’s risk management framework?

The board should ensure that cyber risk is an element of the broader risk framework and that exposures are recognised, assessed for impacts based on clearly defined metrics such as response time, cost and legal or compliance implications, and planned for to attract investment commensurate to a risk-based assessment.

How often is the cyber resilience program reviewed at the board level?

Given the rate of change in the cyber risk landscape, and the speed at which a business can be severely compromised (potentially within hours or days); the board should consider whether periodic reviews (that are more frequent than for other risks forming part of the risk management framework) should be adopted.

Identifying cyber risk

What risk is posed by cyber threats to the organisation’s business?

Different businesses will be exposed to different cyber risks and different potential consequences. It is important for the board to reflect on risks relevant to the particular business of the organisation. Without understanding the nature of the risk and its consequences it is difficult for a board to set a suitable risk tolerance for the risk and to ensure that cyber risks are adequately dealt with by the organisation’s risk management framework.

Does the board need further expertise to understand the risk?

Although boards may not require general technology expertise, for many companies it may be advisable to have one or more directors who have a strategic understanding of technology and its associated risks, or who have a background in cybersecurity.

In some circumstances, the board should consider the use of external cyber experts to review and challenge the information presented by senior management.

Monitoring cyber risk

How can cyber risk be monitored and what escalation triggers should be adopted?

Trying to identify a cyber risk may pose particular challenges. Organisations at the forefront of good practice are using intelligence-driven solutions to deal with this challenge.

For some organisations malicious cyber activities may be devastating to the organisation’s business operations, therefore, it is important to consider what might lead to the provision of more detailed information on the risk to senior management and the board.

Controls

What is the people strategy around cyber security?

Despite significant advances in cybersecurity technology; products, lack of staff awareness of safe cyber practices, social engineering or negligent behaviours remain a major source of cyber issues.

Boards should satisfy themselves that there is sufficient investment in staff awareness training given its prominence as a source of risk—and because a collective effort against cyber threats will better serve an organisation.

What is in place to protect critical information assets?

The board should be satisfied that critical information assets of the organisation are appropriately secure. There should be transparency surrounding the location of all critical assets (including third-party partners and service providers), how they are protected and how protection is being assured.

Response

What needs to occur in the event of a breach?

Boards should ask themselves:

  • If and when a problem arises, what processes are in place for communicating effectively, internally and externally, and managing the situation?
  • Has there been a sufficient level of scenario planning and testing to ensure that response plans are valid and up to date, including with third-party suppliers and dependants?

Boards may need to ensure that security and customer trust are central considerations as companies strive to deliver innovative products and services through technology.

More information

Regulatory resources

Key points:

  • Licensees must adequately manage cyber security risks as part of their licence obligations.
  • Adequate technological systems, policies and procedures should be in place to ensure sensitive consumer information is protected and to minimise the risk of consumer harm.
  • ASIC will take enforcement action when an AFS licensee does not meet these obligations.

We encourage entities to review our regulatory resources (including guidance, reports, speeches and media articles) on the topic of cyber resilience to better understand their licence obligations.

Reports from ASIC’s entity cyber resilience self-assessment surveys

We have historically asked firms to complete self-assessment surveys on their cyber resilience. The following reports identify key trends from the surveys and highlight existing good practices and areas for improvement.

  • Report 776 Spotlight on cyber: Findings and insights from the cyber pulse survey 2023
  • Report 716 Cyber resilience of firms in Australia’s financial markets: 2020–21

ASIC Newsletters

Stay informed on cyber resilience via articles in our Market Integrity Update (MIU):