AICD submission on Horizon 2 of the 2023-2030 Australian Cyber Security Strategy

Our submission was supportive of the focus of Horizon 2 on building the cyber resilience of small and medium sized businesses (SMBs) and not-for-profits (NFPs). These organisations do face structural barriers to enhancing cyber and data controls associated with their size, competing priorities and limited resources.

The key points in our submission were:

• We supported a concentrated and well-resourced campaign to boost the cyber and data resilience of SMBs and NFPs. We recommended this includes expanded guidance, targeted training programs that are differentiated by role (e.g. managers, owners and directors) and focused on particular sectors and industries, expansion of the Small Business Cyber Resilience Service and micro grants or funding streams for specific NFPs and charities to make targeted cyber investments.
• We supported a focus on the key upstream digital providers of SMBs and NFPs, notably managed service providers and software as a service vendors, for the development of a standard and certification pathway.
• We did not recommend any further regulatory change to address cyber and data risk weaknesses across the Australian economy, including through changes to the Privacy Act 1988. Given the current complexity of cyber and data regulatory obligations and recent significant changes any further amendments would be counterproductive and premature.

We noted that the Security of Critical Infrastructure Act 2018 is relatively new and has undergone significant amendment and a broadening of scope since it commenced with new layers of compliance and complexity.

It is appropriate for Home Affairs to continue to support the regime with further guidance, however we strongly recommended that there are no further legislative changes prior to the independent review later in 2025.