This document is well worth reading of you are an organisation covered under U.S, EU and APAC cyber regulation.

← Back to Blog

This document is well worth reading of you are an organisation covered under U.S, EU and APAC cyber regulation. The Australian Information Commission has provided clarity over its charges against Medibank, following the 2021 – 2022 cyber attack. The filing furthers the timeline and understanding of what happened to Medibank and how the attack affected its customers.

The reports raises questions over the companies management of cybersecurity and the role of the board in the oversight of cybersecurity risk for the company and is shareholders. The enclosed highlights audits that were completed by external organisations in 2020 that the board through its 3rd line would have been aware and should have acted upon. Such are excessive number of individuals who had access to Active Directory; a need to ‘enhance its processes for assessing the information security capabilities of third parties managing Medibank information’; and the companies maturity of compliance to CPS 243 as developing, and several reports that highlighted control gaps and some controls with maturity levels of Zero, one or two.

One questions board governance and the level of 1st, 2nd and 3rd oversight for an organisation whose revenues were in the order of $7billion, with a cyber budget of $1million and headcount of 13.

For organisations affected by U.S, EU and APC cyber regulations, the Medibank cyber attack presents a reasonable case study. As covered organisations must demonstrate oversight, assurance and attestation of cybersecurity risk, including control effectiveness and maturity.

@Thaddeus DziekanowskiBrian D. McCarthy Rachel V. Rose, JD, MBA Ryan Buckner

Veritas GRC

#cybersecurity #cyberriskmanagement #cyberattack

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7209106970019069952