New Cyber Risk Management Protocol to Cost over $10 Billion

The Australian government has recently implemented a new Risk Management Protocol that requires critical infrastructure suppliers in the country to increase their investment in cybersecurity protections.

The protocol applies to companies in sectors such as energy, healthcare, water, food transport, and communications that are deemed to be running infrastructure critical to the country’s national interest.

Under the new protocol, board members of these companies will be held accountable for any failure to secure their assets against cyber threats properly.

The protocol sets baseline standards related to cybersecurity, physical security, personnel security, and supply chain security.

These standards are equivalent to the Australian Cyber Security Centre’s Essential Eight mitigation strategies, which can prevent 85-90% of cyberattacks if followed.

Affected companies provided cost impact statements as part of consultations, which estimated the burden on businesses would be more than $9 billion over ten years.

However, these costs were significantly less than projected losses if they experienced service outages.

The government hopes the protocol will prevent irreparable damage to Australia’s national security and the reputational risk to critical infrastructure assets.

Hamish Hansford, head of the Department of Home Affairs’ Cyber and Infrastructure Security Centre, said that 47 cybersecurity incident reports were received since new mandatory reporting requirements started.

The Department is also creating a national register of critical infrastructure to analyse foreign investment from a national risk perspective.

There are nearly 1000 registered critical infrastructure companies, some already following sector-specific requirements similar to the new protocol.

Source: AFR

Tags: cybersecurity; cyberattack; hacking; risk management