As a director or board member, how can you satisfy yourself that you have taken sufficient steps in this regard?

In this article we provide a concise guide to Six Cyber Security Standards which you should know about. Familiarity with these six standards will:

• give you a basic grasp of cyber security issues in your organisation
• allow you to have appropriate conversations with and to ask the questions that need to be asked of your line management with responsibility for IT and cyber security.

The six cyber security standards

Number 1: The Australian Signals Directorate's Top four mitigation strategies to protect your ICT system

The Australian Signals Directorate (ASD) is the Commonwealth's peak advisory body on cyber security. Its 2012 publication, Top four mitigation strategies to protect your ICT system, sets out four cyber security strategies which it says, if implemented, can address up to 85% of targeted cyber intrusions. The Top four mitigation strategies to protect your ICT system are a subset of a wider suite of ASD's published cyber security strategies.

Number 2: The Australian Government Cyber Security Operations Centre's Questions Senior Management Need to be Asking about Cyber Security

The Cyber Security Operations Centre (CSOC) is a joint agency under the responsibility of the Commonwealth Attorney-General and the Minister for Defence. The CSOC suggests that senior management should be asking the following questions:

1. What would a serious cyber incident cost our organisation?
2. Who would benefit from having access to our information?
3. What makes us secure against threats?
4. Is the behaviour of our staff enabling a strong security culture?
5. Are we ready to respond to a cyber security incident?
6. Has the organisation applied ASD's top four mitigation strategies? (see Number 1, above).

Number 3: ASIC's Cyber Resilience: Health Check (ASIC Report 429)

For directors and officers of corporations and other ASIC regulated entities, this guidance from the regulator should be compulsory reading. The Cyber Resilience: Health Check (ASIC Report 429) contains a number of 'Health Check Prompts' which provide useful guidance as to the questions directors and officers can ask in assessing their organisation's awareness of and preparedness for cyber security issues.

The Report notes:

1. for listed entities, a cyber attack may need to be disclosed as market-sensitive information
2. cyber risks may need to be disclosed in Product Disclosure Statements.

Number 4: The Office of the Australian Information Commissioner's Guide to securing personal information – 'reasonable steps' to protect personal information

The Privacy Act 1988 (Cth) requires regulated entities to 'take such steps as are reasonable in the circumstances' to protect personal information from misuse, interference and loss; and from unauthorised access, modification or disclosure (Australian Privacy Principle (APP) no. 11). But what constitutes 'such steps as are reasonable in the circumstances'?

The OAIC's Guide to securing personal information – 'reasonable steps' to protect personal information provides useful information and should be read in conjunction with the other documents referred to in this article.

Number 5: The Payment Card Industry's Data Security Standard (DSS): Requirements and Security Assessment Procedure

If your organisation processes card payments, it should comply with the PCI Data Security Standard (DSS): Requirements and Security Assessment Procedures. If your organisation outsources card payment processing, your outsourced service provider should comply with this standard.

Number 6: ISO/IEC Standards

The International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC) publish a number of standards used across the IT industry, including specific standards relating to IT security. The key IT and cyber security standards are the ISO 27000 series. These are highly technical and detailed publications and it is not suggested that directors and officers become experts in these standards and their implementation. However directors and officers can ask whether their organisation, suppliers to it and third party products and services are compliant with applicable ISO/IEC standards such as ISO 27000. Such compliance will not be necessary or appropriate in all cases but to ask these questions may serve as a useful prompt for a discussion with your IT manager or CIO about whether you, your suppliers and third party products are or should be ISO/IEC compliant.

Key takeaways

Your organisation's most basic (but arguably not sufficient) cyber-security strategy must include the following:

• implement ASD's top 4 cyber intrusion mitigation strategies
• implement the other ASD published strategies, as applicable
• in respect of any of the ASD strategies that are not implemented, ensure that your organisation has a clearly documented audit trail of the reasons why it decided not to implement a particular strategy. That documentation should include an appropriate risk analysis
• ask CSOC's six questions of your IT manager or CIO – are you happy with the answers you get?
• apply ASIC's "Health Check Prompts" to your organisation – what do the outcomes tell you about your organisation's cyber-preparedness?
• if your organisation collects, stores, handles or processes personal information, ask whether it meets the standards set out in OAIC's Guide to securing personal information – 'reasonable steps' to protect personal information
• if your organisation processes card payments, does it (or its service provider) comply with the PCI Data Security Standard (DSS): Requirements and Security Assessment Procedures?
• does your organisation, its suppliers and third party products meet any applicable ISO/IEC standards, if appropriate?

The Six Cyber Security Standards referred to above are by no means exhaustive. This article is intended as an introductory guide to allow the non-technical director or officer to ask the right questions of those with managerial responsibility for IT and cyber security.

We have not, for example, discussed the publications put out by the Australian Prudential Regulation Authority (APRA). While APRA's publications are aimed particularly at the banking, insurance and superannuation industries, they are of relevance to a wider audience.