2023-2030 Australian cyber security strategy starts to take shape

Enhancing and harmonising regulatory frameworks

• What ideas would you like to see included in the Strategy to make Australia the most cyber secure nation in the world by 2030? 
• What legislative or regulatory reforms should Government pursue to enhance cyber resilience across the digital economy? 
  • What is the appropriate mechanism for reforms to improve mandatory operational cyber security standards across the economy (e.g. legislation, regulation, or further regulatory guidance)? 
  • Is further reform to the Security of Critical Infrastructure Act required? Should this extend beyond the existing definitions of ‘critical assets’ so that customer data and ‘systems’ are included in this definition? 
  • Should the obligations of company directors specifically address cyber security risks and consequences? 
  • Should Australia consider a Cyber Security Act, and what should this include?
  • How should Government seek to monitor the regulatory burden on businesses as a result of legal obligations to cyber security, and are there opportunities to streamline existing regulatory frameworks? 
  • Should the Government prohibit the payment of ransoms and extortion demands by cyber criminals by: (a) victims of cybercrime; and/or (b) insurers? If so, under what circumstances? i. What impact would a strict prohibition of payment of ransoms and extortion demands by cyber criminals have on victims of cybercrime, companies and insurers? 
  • Should Government clarify its position with respect to payment or non-payment of ransoms by companies, and the circumstances in which this may constitute a breach of Australian law? 

Strengthening Australia’s international strategy on cyber security

• How can Australia, working with our neighbours, build our regional cyber resilience and better respond to cyber incidents? 
• What opportunities exist for Australia to elevate its existing international bilateral and multilateral partnerships from a cyber security perspective? 
• How should Australia better contribute to international standards-setting processes in relation to cyber security, and shape laws, norms and standards that uphold responsible state behaviour in cyber space?

Securing Government Systems

• How can Commonwealth Government departments and agencies better demonstrate and deliver cyber security best practice and serve as a model for other entities?

Improving public-private mechanisms for cyber threat sharing and blocking

• What can government do to improve information sharing with industry on cyber threats? 
• During a cyber incident, would an explicit obligation of confidentiality upon the Australian Signals Directorate (ASD) and the Australian Cyber Security Centre (ACSC) improve engagement with organisations that experience a cyber incident so as to allow information to be shared between the organisation and ASD/ACSC without the concern that this will be shared with regulators? 
• Would expanding the existing regime for notification of cyber security incidents (e.g. to require mandatory reporting of ransomware or extortion demands) improve the public understanding of the nature and scale of ransomware and extortion as a cybercrime type? 
• What best practice models are available for automated threat-blocking at scale?

Supporting Australia’s cyber security workforce and skills pipeline

• Does Australia require a tailored approach to uplifting cyber skills beyond the Government’s broader STEM agenda? 
• What more can Government do to support Australia’s cyber security workforce through education, immigration, and accreditation? 

National frameworks to respond to major cyber incidents

• How should the government respond to major cyber incidents (beyond existing law enforcement and operational responses) to protect Australians? 
• Should government consider a single reporting portal for all cyber incidents, harmonising existing requirements to report separately to multiple regulators? 
• What would an effective post-incident review and consequence management model with industry involve? 

Community awareness and victim support

• How can government and industry work to improve cyber security best practice knowledge and behaviours, and support victims of cybercrime? 
• What assistance do small businesses need from government to manage their cyber security risks to keep their data and their customers’ data safe? 

Investing in the cyber security ecosystem

• What opportunities are available for government to enhance Australia’s cyber security technologies ecosystem and support the uptake of cyber security services and technologies in Australia?
• How should we approach future proofing for cyber security technologies out to 2030? 
• Are there opportunities for government to better use procurement as a lever to support and encourage the Australian cyber security ecosystem and ensure that there is a viable path to market for Australian cyber security firms? 

Designing and sustaining security in new technologies

• How should the Strategy evolve to address the cyber security of emerging technologies and promote security by design in new technologies? 

Implementation governance and ongoing evaluation

• How should Government measure its impact in uplifting national cyber resilience?
• What evaluation measures would support ongoing public transparency and input regarding the implementation of the Strategy?