ASIC's Third Cybersecurity Enforcement Action

ASIC's enforcement action against Fortnum Private Wealth Ltd (Fortnum), its third cybersecurity enforcement action, is yet another reminder for licensees that they must implement robust measures to reduce cybersecurity risk.

The Fortnum Case

ASIC alleged that Fortnum failed to comply with a variety of its obligations under section 912A(1) of the Corporations Act, including the obligation to provide services efficiently, honestly and fairly.

Specifically, ASIC alleged Fortnum did not:

• provide cybersecurity training to its representatives;
• implement any cybersecurity policies in order to mitigate, manage and control the cybersecurity risks faced by the business and its authorised representatives (ARs);