Most cybersecurity conversations start with tools: firewalls, endpoint protection, multi-factor authentication. Fewer start with policy, and that’s a gap worth closing. A business can own every security tool on the market and still get caught out, because nobody wrote down who’s responsible for reviewing access, what happens in the first hour of an incident, or what a staff member is and isn’t allowed to do on a personal device connected to the network. Tools enforce rules. Policy decides what the rules are.
We’ve pulled together five resources we point clients towards when they’re building or reviewing their own policy framework. None of them are ours, and that’s deliberate: these are the primary sources, straight from the bodies that set the standards.
The Australian Cyber Security Centre
The ACSC, part of the Australian Signals Directorate, is the first stop for anything cybersecurity-related in Australia. Cyber.gov.au carries current threat alerts, guidance for businesses of every size, and a straightforward way to report a cybercrime if one happens to you. If you bookmark one government resource, make it this one.
The Essential Eight Maturity Model
Also from the ACSC, the Essential Eight sets out eight mitigation strategies that, done properly, stop the large majority of cyber incidents businesses actually face. It’s increasingly showing up as a mandatory requirement in tenders, contracts and cybersecurity policies, not just a nice-to-have. [EDITORIAL NOTE: we cover Essential Eight in far more depth in a separate post, and it’s worth linking the two together once both are live.]
ASIC’s guidance for boards
The Australian Securities and Investment Commission has put together a set of questions board members should be able to answer about cyber risk: whether a risk management framework exists, whether the board understands its organisation’s specific cyber risks, and whether there’s a clear plan for the first hours after an incident. If you sit on a board or report to one, this is a useful checklist to work through before someone else asks you these questions.
A quick-start guide to writing the policy itself
The federal government’s business.gov.au site has a practical guide to drafting a cybersecurity policy from scratch, covering the basics most businesses miss: password requirements, rules around social media and personal device use, and what an incident response plan needs to include. It’s a reasonable starting template if you don’t have a policy at all yet.
A real policy, published in full
The University of Queensland publishes its own Cyber Security Policy in its policy library. Reading a real, working policy from an organisation with genuinely complex requirements is often more useful than a generic template, because it shows you what the finished document actually looks like in practice.
Policy and governance won’t stop every attack. Nothing does. But when something does go wrong, having already decided who does what, and having a documented framework to point to, is often the difference between a contained incident and a chaotic one. If you’re not sure where your own policy stands, that’s a reasonable place to start a conversation with us.
