The frameworks that govern
Australian cybersecurity.
A quick reference to the frameworks Vectra assesses and builds programs against - what each one is, who it applies to, and where the source sits. For regulatory detail, treat the issuing body's publication as the definitive word; the pages here are our field notes, not legal advice.
Australian
Government
Mandatory for Commonwealth entities; widely adopted across state, territory and regulated private sector.
Essential Eight
The eight baseline mitigation strategies the ASD considers most effective against targeted cyber intrusion.
Information Security Manual
The ASD's cybersecurity framework used by Australian Government agencies to protect their information and systems.
Protective Security Policy Framework
The framework that sets how Commonwealth entities protect people, information and assets from trusted-insider and external threats.
Information Security Registered Assessors Program
The ASD-endorsed program that certifies cybersecurity professionals to assess ICT systems against the ISM.
Privacy Act & Australian Privacy Principles
The 13 Australian Privacy Principles (APPs) govern how APP entities handle personal information under the Privacy Act.
Notifiable Data Breaches Scheme
Mandatory notification of eligible data breaches likely to cause serious harm to individuals.
Critical
Infrastructure
Obligations under the SOCI Act, plus sector-specific overlays for energy, water, transport, healthcare and communications.
Security of Critical Infrastructure Act
The legislative framework that imposes cyber-security and risk-management obligations on responsible entities across 11 critical-infrastructure sectors.
Critical Infrastructure Risk Management Program
The risk-management program responsible entities must set up under the SOCI Act, covering cyber, personnel, physical and supply-chain hazards.
Australian Energy Sector Cyber Security Framework
A tailored assessment framework used across the Australian electricity, gas and liquid-fuels sectors to measure cyber-security maturity.
IEC 62443 Industrial Automation and Control Systems Security
The international standard series for securing industrial automation and control systems (IACS) across the IT/OT boundary.
Financial
Services
Prudential standards for ADIs, insurers, superannuation trustees and RSE licensees, plus payment-scheme overlays.
APRA Prudential Standard CPS 234
APRA's information-security standard: regulated entities must match their security capability to the threats they face.
APRA Prudential Standard CPS 230
APRA's operational-risk standard, covering business continuity and service-provider obligations.
SWIFT Customer Security Controls Framework
The mandatory and advisory security controls that SWIFT users must implement and self-attest against each year.
Global
Standards
ISO, IEC and NIST frameworks widely adopted in Australia and commonly accepted as CIRMP-equivalent.
ISO/IEC 27001 Information Security Management
The international standard for information-security management systems (ISMS), certifiable by accredited certification bodies.
NIST Cybersecurity Framework
A risk-based framework structured around six functions - Govern, Identify, Protect, Detect, Respond and Recover.
Payment Card Industry Data Security Standard
The global standard that sets security requirements for any entity that stores, processes or transmits payment-card data.
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.