Call us now:
Thank you for posting Stephen Pitt-Walker, JD, FGIA. The Australian Critical Infrastructure Asset Class Definition Guidance makes for an interesting read. It is a clear and concise guide to identify if an entity is considered as Critical Infrastructure, whether it needs to implement a risk management program, cybersecurity incident reporting and notify their third-party data storage or processing provider that the provider is storing or processing business critical data for a critical infrastructure asset.
It has some alignment with EU NIS 2.0, DORA and the SEC cyber proposal, but goes further in that it requires covered entities to addresses risks associated with physical, cyber and information, personnel and supply chain security. Responsible entities must identify, and as far as is reasonably practicable, take steps to minimize or eliminate these â¬Ëmaterial risks⬢ that could have a â¬Ërelevant impact⬢ on their asset. One suspects that lawyers in Australia, the EU and U.S are going to have plenty of opportunity to test the application of risk management and cybersecurity.
We have written a cybersecurity risk management program for boards to govern, oversight, assure and attest cybersecuirty risk management. Through a 3 Line of Defense Target Operating Model, to a standard that will meet that required by U.S, EU and Australian regulators. We’ve started to educate U.S attorneys on cybersecurity risk management, regulation, governance, oversight and assurance and 3 Line of Defence.
Time to dust off the NIST SP 800-37, 30 and 39 for risk and cybersecurity framework profiles for cyber.
Ted Dziekanowski Rachel V. Rose, JD, MBA
#cybersecurity #cyberriskmanagement #cyberregulation #cyberlaw #3lod
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7063601692168056832