How organisations are expected to manage cyber-risk is a
constantly evolving area of discussion with no easy or clear
answers. Corporate regulators both in Australia and internationally
have identified cyber resilience as one of the critical issues
impacting investors' trust and confidence in global
economies.
Courts are also increasingly being asked to assess the
reputational damage and commercial harm caused by cyber incidents
and to allocate responsibility where companies and management fail
to protect their stakeholders and manage IT assets.
Together with regulator, industry and judicial
commentary, the fallout from recent incidents is slowly beginning
to point towards the need for at least some minimum standards and
procedures organisations should be aware of and adopt when managing
cyber-risks. These issues are explained below.
