- ClassificationCategoryCybersecurityDomainCybersecurityFramework FamilyOther
- Regulatory ContextTypeGuidanceLegal InstrumentGuidelineSectorFinancial SectorIndustryFinancial Services
- Region / PublisherRegionAustralia & New ZealandRegion DetailAustraliaPublisherAustralian Securities and Investments Commission (ASIC)
- VersioningVersionASIC cyber resilience good practices (asic.gov.au/cyber-resilience); latest ASIC Cyber pulse survey Report 776, November 2023Effective DateOngoing; good-practice guidance updated by ASIC reports (latest Report 776, November 2023)Issue DateMarch 2015 (Report 429, Cyber resilience: Health check)
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
ASIC cybersecurity guidance and regulatory materials are publicly available through the Australian Securities and Investments Commission.
Framework text is licensed by its publisher and is included only where stated above.
- ASIC's cyber resilience guidance is a body of good practices, Board questions, and survey reports, not a standalone standard.
- The duty to manage cyber risk sits in the Corporations Act 2001, the National Consumer Credit Protection Act 2009, and the ASIC Market Integrity Rules.
- ASIC has taken enforcement action, including the Federal Court finding that RI Advice failed to adequately manage cybersecurity risks.
- The 2023 cyber pulse survey scored six functions from 0 to 4; the weighted average across 697 participants was 1.66.
- SmartSuite Cyber & IT Risk and Compliance Management hold the license obligations, Board questions, and six-function assessment in one place.
Overview
ASIC Cybersecurity and Risk Management Guidance is the Australian Securities and Investments Commission's body of cyber resilience resources for the entities it regulates: good practices, key questions for Boards, and reports from its cyber self-assessment surveys. It is not a standalone standard. The obligations that bind licensees to manage cyber risk sit in the Corporations Act 2001, the National Consumer Credit Protection Act 2009, and the ASIC Market Integrity Rules, and ASIC supervises and enforces compliance with them.
ASIC says licensees must adequately manage cyber security risks as part of their license obligations, and that it will take enforcement action when an AFS licensee does not (see RG 104 AFS licensing: Meeting the general obligations, and Report 429 Cyber resilience: Health check, Section D and Appendix 2). The Federal Court found that RI Advice failed to adequately manage cybersecurity risks, and ASIC has also brought proceedings against FIIG Securities and Fortnum Private Wealth.
Entities work from ASIC's good practices, which came from a sample of financial entities that assessed themselves against the NIST Cybersecurity Framework, and from the six functions used in the cyber pulse survey: governance and risk management, identify, protect, detect, respond, and recover.
Why does it matter?
ASIC's message is that cyber resilience is a license obligation backed by enforcement, and that a Board must be satisfied that cyber risk is covered by the entity's risk management framework.
Key benefits include:
- Board questions you can answer
ASIC's key questions for Boards cover the risk management framework, identifying cyber risk, monitoring and escalation triggers, controls, and response.
- A maturity yardstick
The 2023 cyber pulse survey scored each function from 0 (incomplete) to 4 (optimising); the weighted average across 697 participants was 1.66.
- A third-party focus
In the 2023 survey 44% of participants did not manage third-party or supply chain risk, so supplier oversight is a visible expectation.
- Tested response plans
ASIC says an incident response plan should be tested and updated regularly and should identify regulatory reporting obligations and interactions with critical third parties.
- Standard adoption
ASIC says an entity should adopt a cyber security standard proportionate to its size and complexity, starting with a cyber risk assessment.
How does it work?
ASIC defines cyber resilience as the ability to adapt to disruptions caused by cyber security incidents while maintaining continuous business operations, including the ability to detect, manage, and recover from incidents. Its supervisory strategy is to promote active, continuous, and proportionate management of cyber risks, monitor and supervise regulated entities, share good practices and standards, and take deterrence-based enforcement action where appropriate.
Report 776 Spotlight on cyber (November 2023) reports the findings of the cyber pulse survey. Its questions are divided into 12 cyber risk categories under the six functions, and participants rated their maturity from no capability to optimising. ASIC says the examples in the report are illustrations and do not impose particular rules or requirements.
In SmartSuite, Cyber & IT Risk tracks cyber risks and security controls, Compliance Management holds obligations and evidence, and Enterprise Reporting prepares Board and maturity reporting.
Key Elements
- License obligations and enforcement
The duties to manage cyber risk come from the Corporations Act, the National Consumer Credit Protection Act, and the ASIC Market Integrity Rules. ASIC supervises compliance, and RG 104 explains the general obligations of AFS licensees.
- Cyber resilience good practices
A set of good practices identified from a sample of financial entities that self-assessed against the NIST Cybersecurity Framework, followed by more detailed discussions with ASIC.
- Key questions for Boards
Is cyber risk part of the risk management framework, and how often does the Board review the program? Does the Board need more expertise or external experts? What escalation triggers apply, what is the people strategy, are critical information assets protected, and have response plans been tested with third parties?
- Cyber pulse survey 2023 (Report 776)
An anonymous, voluntary survey of 697 participants, 42% of them holders of an Australian financial services license. It measures governance and risk management, identifying and protecting information assets, and detecting, responding to, and recovering from incidents.
- Earlier survey reports
Report 555 and Report 651 (2018 to 2019) and Report 716 (2020 to 2021) surveyed firms in Australia's financial markets, and Report 429 is the earlier Cyber resilience: Health check.
- Small organizations
Small organizations reported lower maturity than medium and large ones, lagging in supply chain risk management, data security, and consequence management.
- Enforcement cases
ASIC's resources list the RI Advice, FIIG Securities, and Fortnum Private Wealth cases as examples of failures to manage cyber risk adequately.
What does it cover?
The resources apply to the entities ASIC regulates, including AFS licensees, credit licensees, and market participants under the Market Integrity Rules. The 2023 survey was open to public companies, large proprietary companies, and entities that hold licenses or authorizations from ASIC, so the good practices are also a reference for organizations outside the financial markets.
What are its objectives?
ASIC's stated vision is that Australia's financial markets and system are resilient to cyber incidents.
Promote good practices for managing cyber and operational risks among ASIC's regulated population.
Ensure technological developments have appropriate cyber safeguards and operational resiliency, to support trust and confidence and market integrity.
Promote active, continuous, and proportionate management of cyber risks.
Share good practices and standards with Government, other regulators, and industry.
Take deterrence-based enforcement action where appropriate.
Framework in Context
ASIC works with the Council of Financial Regulators and supports the Government's 2023-2030 Australian Cyber Security Strategy. Entities that APRA also regulates must meet APRA CPS 234 as well. Because ASIC's good practices come from NIST Cybersecurity Framework self-assessments, firms commonly map them to the NIST Cybersecurity Framework and ISO/IEC 27001.
Common Framework Mappings
Firms that follow ASIC's guidance map it to the frameworks below, which cover the same cyber risk functions.
Mapped frameworks include:
APRA CPS 234
CIS Controls v8.1
EU DORA
ISO 27001:2022
MITRE ATT&CK
NIST CSF 2.0
NIST 800-53 Rev.5
SOC 2
How SmartSuite Supports ASIC
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Cyber & IT Risk and Compliance Management to hold the license obligations, Board questions, and six-function assessment in one place.
Obligations and good practices register
Record the license obligations that drive cyber duties and the good practices ASIC lists, each with an owner.
Board questions tracker
Turn ASIC's key questions for Boards into recurring agenda items with answers and review dates.
Six-function maturity assessment
Score governance and risk management, identify, protect, detect, respond, and recover on the 0 to 4 scale and track improvements.
Third-party risk
Track suppliers with access to confidential information and their cyber controls using Third Party Risk Management.
Response plan testing
Schedule response plan tests, record results, and log the regulatory reporting steps that each plan identifies.
Board and maturity reporting
Use Enterprise Reporting for Board-level cyber risk and maturity views.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
COBIT 2019 is ISACA's framework for governing and managing enterprise IT, with 40 objectives in five domains, six governance principles and 11 design factors.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
MITRE ATT&CK is a free knowledge base of adversary tactics, techniques and sub-techniques from The MITRE Corporation, updated twice a year; the current release is v20.0.
NIST CSF 2.0 (CSWP 29, February 26, 2024) is the voluntary cybersecurity framework with six Functions including Govern, 22 Categories, 106 Subcategories, Profiles and Tiers.
Frequently Asked Questions For ASIC Cybersecurity and Risk Management Guidance
The guidance itself is not law. The obligations to manage cyber risk come from the Corporations Act 2001, the National Consumer Credit Protection Act 2009, and the ASIC Market Integrity Rules, and ASIC says it will take enforcement action when an AFS licensee does not meet them.
RG 104 AFS licensing: Meeting the general obligations, Report 429 Cyber resilience: Health check (Section D and Appendix 2), the cyber resilience good practices, the key questions for Boards, and Report 776 for the latest survey findings.
Governance and risk management, identifying information assets, protecting information assets, detecting cyber security events, responding to cyber security incidents, and recovering from them. Maturity is scored from 0 (incomplete) to 4 (optimising).
Across 697 participants the weighted average maturity score was 1.66 out of 4. 44% did not manage third-party or supply chain risk, 33% had no cyber incident response plan, 58% had limited or no capability to protect confidential information adequately, and 20% had not adopted a cyber security standard.
No. ASIC's good practices came from self-assessments against the NIST Cybersecurity Framework, and it says an entity should adopt a cyber security standard proportionate to its size, nature, and complexity.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.