Cyber security priorities for boards of directors 2025-26

The cyber threat environment is constantly changing with new and evolving threats posing significant risks to all sizes and types of Australian organisations. Boards play a key role in overseeing the cyber resilience of their organisations, including engaging with management on how the organisation is responding to current threats.

This guidance from the ASD and AICD provides an extensive list of threshold and supplementary technical questions for boards to ask of management in four priority areas. Informed by the ASD’s intelligence gathering these priority areas are; implementing effective event logging, managing legacy IT risks, overseeing cyber supply chain risks and preparing for post-quantum cryptography.

We encourage directors to read these questions in conjunction with the Cyber Security Governance Principles (Version 2) and Governing Through a Cyber Crisis publications. These publications provide an overview of the core principles of effective cyber security governance, including allocating roles and responsibilities and preparing for significant cyber and data incidents.