CERT alerts, breaches, trending CVEs, Australian news, and law & standards.
Live08:57 Thu, 12 Nov
CERT items
0
KEV last 7 days
0
AU breaches, 14 days
0
Policy watches
6
01
CERT alerts
02
Known exploited
03
Breach news
Australian incidents first · last 14 days locally, 14 days globally
04
Australia
05
Law & standards
PendingEssential EightASD / ACSC
Essential Eight → Essentials series
Consultation closed 12 Jul 2026 · guidance not yet published
ASD is evolving the Essential Eight into a broader Essentials series, starting with Essentials for enterprise IT. The November 2023 maturity model is still the live, assessable baseline. Deprecation is expected around mid-2027, with full retirement around mid-2028. PSPF, DISP, insurers and government contracts still point at Essential Eight until they are rewritten.
APP 1.7–1.9 will require APP entities to disclose in their privacy policy when a computer program uses personal information to make or substantially support decisions that significantly affect someone’s rights or interests. OAIC guidance was expected by September 2026. The Children’s Online Privacy Code must also be registered by 10 December 2026.
The 2024 Act delivered the first 23 Privacy Act Review proposals. A second, more substantial tranche is still being drafted — likely to cover a fair-and-reasonable test, expanded definitions, and the small-business exemption. Watch this if you run AU customer data at scale.
Australia’s first standalone cyber statute. SOCI entities and organisations above the turnover threshold must report ransomware and cyber-extortion payments to the Commonwealth within 72 hours. Also establishes the Cyber Incident Review Board.
Security of Critical Infrastructure obligations cover 22 asset classes across 11 sectors, including data storage, energy, health, transport, and higher education. 2024 reforms moved enhanced telecoms security duties into SOCI. Risk-management programs and incident reporting remain live duties.
The ISM is the parent controls library the Essential Eight (and the coming Essentials series) is drawn from. ASD publishes regular releases — treat it as a living standard, not an annual PDF. CISOs should diff each drop against current baselines.