APRA’s annual report sets out what it will check next
APRA has published its annual report for 2025-26. Most coverage will focus on the big numbers. Assets under APRA supervision passed $10 trillion for the first…
Read the article →The score is gone. ASD published the replacement on Thursday.
All year we have been saying the Essential Eight was going. We could not tell you what replaced it, or when. We said so every time…
Read the article →The Reserve Bank’s language just hardened. APRA’s work plan says what comes next.
Here are three sentences from the Reserve Bank, written three years apart. Potential. Then probability. Now likelihood, and it’s rising. Central banks pick these words carefully,…
Read the article →The AI inquiry heard four days of evidence. It decided nothing. Here is what to do anyway.
The Joint Select Committee on Artificial Intelligence finished four days of public hearings on Friday. Two days in Sydney, two in Melbourne. It decided nothing, and…
Read the article →AUSTRAC went looking for the businesses that didn’t show up
The last piece on this was about firms that enrolled under Tranche 2, wrote a program, and assumed that was the hard part done. AUSTRAC’s own…
Read the article →AUSTRAC isn’t waiting for 2027
A firm that has enrolled with AUSTRAC, written an AML/CTF program and briefed its board understandably feels like the hard part is done. Two things AUSTRAC…
Read the article →150 on the register. Thousands beneath. A handful that everyone shares.
What really sits under a financial institution’s material service providers, and why the tools most teams still use cannot cope. TL;DR We undertook this research for…
Read the article →Three months, disconnected: what CI Fortify really asks of energy and gas operators
TL;DR. New national guidance now expects critical infrastructure operators to be able to run essential services for three months while completely cut off, from corporate networks,…
Read the article →You did the Essential Eight. AESCSF now wants Security Profile 2 by 2028.
TL;DR. Many energy operators started the Essential Eight, stalled at Maturity Level One, and are now looking at a hard new obligation: AESCSF Security Profile 2…
Read the article →The week cyber, physical and people became one problem
Somewhere in the noise of the last few weeks, the obligation sitting over Australia’s critical infrastructure quietly changed shape, and not many people seem to have…
Read the article →