30 Days, No Excuses: Australia’s New Cyber Reality for IT Providers
Australian privacy and cyber rules are tightening, and small IT service firms and MSPs are squarely in scope. Here’s the playbook to stay compliant, protect customers, and keep sales and insurance moving.
What’s Really Going On: New Compliance + Cyber Risk
This situation is a mix of new compliance obligations, an emerging risk, and a clear cyber and data privacy threat. Under the Privacy Act 1988 (Cth) and Australian Privacy Principles (especially APP 11), you must take reasonable steps to secure personal information. The Notifiable Data Breaches (NDB) scheme requires assessment and notification “as soon as practicable,” generally within 30 days. If you touch critical infrastructure or regulated sectors, expect added obligations via the SOCI Act, APRA CPS 234, and ASD Essential Eight. In November 2024, Australia passed the Cyber Security Act 2024 (Cth), introducing mandatory ransomware payment reporting—another signal that expectations are rising.
The Scenario: Your MSP’s Subcontractor Gets Breached
An MSP’s subcontractor is compromised; attackers reuse stolen RMM credentials and access client personal data. Within days, you must isolate, investigate, notify, and evidence control. Delays, vague policies, or missing logs invite procurement pauses, OAIC scrutiny, and insurance questions.
Within 30 days you’re expected to: assess the breach, decide if it’s notifiable, brief the OAIC and impacted clients, and show evidence of due care.
- Triage endpoints, RMM, and identity systems fast—cut persistence, rotate keys, revoke tokens.
- Coordinate client communications and expectations; avoid conflicting messages from subcontractors.
- Demonstrate third-party due diligence, access controls, logging, and incident response capability.
Your 30‑Day NDB Readiness Check (Do This Now)
Make notification within 30 days a non-event
- Nominate an incident lead and deputies with clear decision rights.
- Validate detection and logging (RMM, identity, email, endpoints, backups) and time-synchronise clocks.
- Prove you can complete breach assessments within 30 days; pre-build assessment templates and evidence lists.
- Maintain a breach register and severity criteria; log near-misses to tighten controls.
- Pre‑approve notification templates, press lines, and contact lists (clients, OAIC, insurers, counsel).
- Run a tabletop that ends with draft OAIC and client notices ready to send.
Standards alignment
Map these tasks to ISO 27001 controls and the ASD Essential Eight to demonstrate reasonable steps under APP 11.
Prove Due Care: Documentation or Bust
Document your business or get out. When regulators and enterprise buyers ask for proof, they want artifacts, not opinions.
- Single source of truth for policies, SOPs, and records—versioned and permissioned.
- Asset and data inventories: where personal data lives, who can access it, and why.
- Access control records: MFA, least privilege, privileged access approvals, and RMM credential vaulting.
- Third‑party due diligence: questionnaires, evidence packs, contract clauses, and risk ratings.
- Incident playbooks: ransomware, credential abuse, business email compromise—roles and steps for remote teams.
- Evidence library: logs, screenshots, tickets, and sign‑offs linked to each control.
Remote Workers: Make Following Instructions Frictionless
Most breaches hinge on small lapses. For distributed teams, clarity beats heroics.
Make it easy to do the right thing
- Task‑based SOPs with checklists embedded in your ticketing system; no hunting across chat and email.
- Pre-approved response steps for common alerts; lock risky choices behind approvals.
- JIT access and auto-expiring RMM credentials; contractor offboarding within 24 hours.
- Field-friendly runbooks with screenshots for remote hands, so instructions—not improvisation—drive actions.
Single source of truth
Keep current policies, diagrams, and client data flows in one maintained repository. If staff can’t find it, it doesn’t exist.
Supply-Chain Controls That Actually Work
Clients and regulators expect supply‑chain assurance you can demonstrate, not just promise.
- Tier suppliers by data sensitivity and blast radius; apply deeper controls to high‑impact vendors.
- Contract for right-to-audit, breach notification timelines, MFA, logging, and vulnerability remediation SLAs.
- Use service accounts sparingly; enforce MFA and least privilege for all console and RMM access.
- Continuously review API tokens, SSH keys, and break-glass accounts; rotate after incidents and on schedule.
- Collect evidence quarterly (MFA screenshots, SOC reports, patch metrics) to avoid scramble during an incident.
- If you service critical infrastructure or regulated sectors, align to SOCI obligations and APRA CPS 234 expectations.
Turn Compliance Into a Sales Advantage
Strong assurance wins deals and accelerates procurement.
- Create a one‑page “Security & Privacy Overview” mapping APP 11, Essential Eight maturity, ISO 27001 alignment, and your incident SLAs.
- Offer clients a breach‑readiness attestation and sample notification templates—proof you can move within 30 days.
- Maintain insurance conditions (MFA, EDR, immutable backups). Share renewal outcomes to build buyer confidence.
- Track regulatory change: the Cyber Security Act 2024 (Cth) adds mandatory ransomware payment reporting—factor it into playbooks and client contracts.
30‑Day Action Plan for Owners
- Appoint incident lead and deputies; publish a phone tree.
- Run an NDB tabletop; practice drafting OAIC and client notices.
- Harden identity and RMM: enforce MFA, rotate secrets, remove dormant accounts.
- Stand up a breach register and decision log.
- Complete a third‑party risk sweep; document evidence for top 10 suppliers.
- Publish SOPs where remote staff work (tickets, wiki); make them searchable.
- Back up and test restores; enable immutable backups for critical data.
- Map Essential Eight maturity and set 90‑day uplift targets.
- Update client contracts with security clauses and notification timelines.
- Prepare a procurement-ready security pack: policy index, control matrix, evidence list.
