Answered first
Answers
Direct answers to the security, compliance and incident questions Australian owners and IT managers ask, each one sourced to the regulator or the standard that decides it.
Compliance readiness
- Does cyber insurance replace controls like the Essential Eight?No.
- What does Essential Eight Maturity Level One require?Maturity Level One means all eight strategies are in place against opportunistic attackers: critical patches for internet-facing systems within 48 hours, MFA on services holding sensitive data, dedicated administrator accounts off the internet and email, application control on workstations, internet macros blocked, browsers blocking Java and web advertisements, tested backups.
- When do law firms have to comply with AML/CTF obligations in Australia?Law firms have had to comply since 1 July 2026 if they provide a designated service listed in table 6 of the AML/CTF Act; enrolment with AUSTRAC opened on 31 March 2026.
- When does a data breach have to be reported to the OAIC?Promptly, once the organisation has reasonable grounds to believe an eligible data breach has occurred: unauthorised access, disclosure or loss of personal information likely to result in serious harm that remedial action has not prevented.
