For any organisation trying to provide services to the public sector in Australia, navigating the procurement process can feel like entering a compliance maze. If you deal with a local council, you might be asked for one set of parameters; a state education department will demand another; federal agencies will insist on something entirely different.
This fragmented approach to cybersecurity creates immense administrative overhead for businesses. More importantly, it often fails to deliver the actual security outcomes that protect data and infrastructure. Let us explore why the current multi-framework landscape is broken, and how standardising around a risk-based model can deliver a clearer path forward.
The Alphabet Soup of Australian Cyber Requirements
Right now, commercial enterprises face an overwhelming array of competing standards depending on which agency or tier of government they look to serve:
- Essential Eight: Widely promoted across federal and state levels as a baseline.
- ST4S (Safer Technologies for Schools): Frequently demanded by primary and secondary education departments.
- ISM (Information Security Manual) & IRAP: The federal benchmark for high-security environments.
- SOC2: An American standard increasingly appearing in commercial and public contracts.
- ISO 27001: The global benchmark for information security management systems.
- and more …
This scattergun approach forces businesses to dedicate valuable time and financial resources to satisfying varying compliance checklists, rather than focusing on genuine risk reduction.
The Flaws in the Current Frameworks
When we evaluate these requirements closely, significant structural issues emerge regarding how they are applied to modern commercial operations.
The Problem with Watered-Down Checklists
The Essential Eight is often treated as a comprehensive security strategy, but it represents only 8 of the 37 mitigation strategies originally outlined by the Australian Signals Directorate. It is a baseline technical framework, not a complete governance standard, which is why the government has actively moved toward updating and expanding its approach.
Attempts to create further watered-down models for small and medium-sized businesses suffer from the same foundational flaws. When a business provides services to government clients, utilising a surface-level checklist creates a false sense of security. Attackers do not look for a watered-down target; they look for any exploitable vulnerability.
Subjectivity and Rigid Mandates
The federal government’s Information Security Manual (ISM) is exceptionally rigid and prescriptive. While highly appropriate for high-security areas like defence, it is entirely unsuited to the agile, cloud-native architectures of modern commercial businesses.
Furthermore, the Information Security Registered Assessors Program (IRAP), which validates alignment with the ISM, suffers from substantial variation. Because evaluations rely heavily on the individual interpretation of the specific IRAP assessor, the process can feel less like an objective framework and more like a subjective assessment of what feels right at the time.
The Limitations of Self-Defined Scope
SOC 2 is an American reporting framework that essentially allows a business to define its own security controls. While it confirms that an organisation is adhering to the goals it set for itself, it lacks strict, globally standardised architectural baselines. Unless paired directly with a rigorous global standard like ISO 27001, a standalone SOC 2 report may leave significant international security gaps unaddressed.
Why ISO 27001 is the Practical Path Forward
To resolve this fragmentation, Australia requires a single, globally recognised framework that adapts to the realities of modern enterprise. ISO 27001 stands out as the most practical choice for protecting organisations.
Unlike rigid checklists, ISO 27001 is a risk-based framework. It does not force a business to implement generic, irrelevant technologies simply to tick a box. Instead, it requires management to thoroughly assess their specific threat landscape and systematically manage the risks they discover. If a control is truly impractical or impossible for an organisation to execute, the framework allows them to document, mitigate, and manage that risk responsibly.
The Role of Technical Verification through CREST Penetration Testing
A critical component of any robust ISO 27001 implementation is ensuring that technical controls are not just documented on paper, but are thoroughly validated in practice. A framework is only as good as its real-world implementation. To achieve genuine assurance, an ISO 27001 strategy should always incorporate a rigorous penetration test and a cyber audit conducted by a CREST Australian approved company.
Utilising a provider with CREST Australia approval ensures that your security audit and testing is conducted by certified professionals operating under strict technical and ethical standards. This validation process uncovers hidden technical vulnerabilities across networks, applications, and cloud environments, providing the definitive proof of security maturity that public sector procurement teams increasingly look for.
A Realistic Pathway for Small Business
The primary objection to mandating ISO 27001 universally is its scope, as the full standard contains over 100 separate controls. This can place an unsustainable administrative burden on small businesses with fewer than 10 people, provided they are not operating a highly complex technology platform.
To build a unified national pathway without locking out smaller suppliers, the solution is not to create a completely separate, flawed standard. Instead, we can utilise a structured, mandatory subset of ISO 27001. A streamlined framework of approximately 25 core controls provides an ideal stepping stone, allowing small businesses to build a strong foundation that naturally scales toward full certification over time.
As example the core controls allowed by exemption for small non-technical businesses could be:
Governance and Framework Foundation
- 5.1 Policies for information security: Establishing clear guidelines for organisational protection.
- 5.4 Management responsibilities: Ensuring leadership remains accountable for security directives.
- 5.11 Return of assets: Implementing procedures for the orderly return of devices when personnel depart.
- 5.15 Access control: Restricting system visibility and privileges strictly to authorised users.
- 5.17 Password manager: Authentication information – specifically outlines utilising approved password vault tools to manage and protect authentication records.
- 5.23 Information security for use of cloud services: Setting clear standards for how third-party cloud applications protect business data.
- 5.36 Compliance with policies, rules and standards for information security: Ensuring regular reviews to verify that internal protocols are followed.
Human Resources Security
- 6.1 Screening: Performing appropriate background checks on personnel prior to employment.
- 6.2 Terms and conditions of employment: Defining clear security expectations within employee contracts.
- 6.3 Information security awareness, education and training: Delivering ongoing training to help staff recognise phishing and operational risks.
- 6.5 Responsibilities after termination or change of employment: Defining post-employment obligations to safeguard proprietary data.
Physical and Asset Protection
- 7.7 Clear desk and clear screen: Ensuring unattended devices are locked and physical records are secured.
- 7.14 Secure disposal or re-use of equipment: Preventing data exposure when retiring or repurposing obsolete hardware.
Operational Technical Controls
- 8.1 User endpoint devices: Enforcing security configurations on laptops, workstations, and mobile devices.
- 8.5 Multi-factor authentication (MFA): Secure authentication using MFA
- 8.7 Protection against malware: Deploying anti-malware tools to detect and neutralise malicious software.
- 8.8 Management of technical vulnerabilities: Identifying and patching system security gaps before they can be exploited (highly enhanced by a CREST-approved penetration test).
- 8.10 Information deletion: Ensuring sensitive data is permanently removed when no longer required.
- 8.12 Data leakage prevention: Utilising tools to detect and block the unauthorised transmission of confidential files.
- 8.15 Logging: Capturing system event logs to assist with monitoring and post-incident reviews.
- 8.20 Networks security: Safeguarding internal corporate networks from unauthorised access.
- 8.23 Web filtering: Blocking access to known malicious or untrustworthy websites.
Incident and Continuity Planning
- 5.24 Information security incident management planning and preparation: Creating a structured playbook to guide the team during a crisis.
- 5.26 Response to information security incidents: Executing rapid containment steps when an adverse event occurs.
- 5.29 Information security during disruption: Maintaining core data protections even during unexpected operational outages.
- 5.30 ICT readiness for business continuity: Ensuring systems and backups are configured to restore vital services promptly.
Designing a Streamlined Future
Enforcing a single, scalable framework across all levels of government would simplify procurement, reduce baseline costs, and ensure that every organisation works within the same internationally recognised language of risk management. Highly specialised environments, such as federal defence agencies, can layer the prescriptive requirements of the ISM on top of this model, but the core foundation should remain unified.
As compliance platforms become more efficient, the overall effort required to implement and manage an Information Security Management System continues to fall. By focusing on a risk-based standard supported by accredited testing rather than disjointed compliance checklists, Australian organisations can achieve a demonstrably superior security posture.
Navigating complex compliance requirements and protecting your business operations can be challenging. If you want to evaluate your current framework alignment, or explore how a streamlined approach paired with CREST-approved testing can help enhance your organisation’s resilience, consider contacting the expert team at Vertex Cyber Security for tailored assistance.