14 August, 2016
In July 2015 we reported that the Australian Companies and Securities Commission ("ASIC") had released “Report 429: Cyber Resilience: Health Check” which recommended that businesses manage their cyber security by ensuring they are able to adapt to change, reduce exposure to risks and learn from incidents when they occur.
ASIC has now followed that Report with the release in March 2016 of its first formal assessment of the cyber resilience of Australia’s major domestic financial market infrastructure providers – ASX Group and Chi-X Australia Pty Ltd (Chi-X). The financial services sector was selected for initial review given the central role that financial markets play in our economy.
The report concluded that ASX and Chi-X had, up to this point in time, met their statutory obligations to have sufficient resources for the management of cyber resilience. However, the report emphasised the need for ongoing review of plans, given the dynamic and changing nature of cyber threats.
The report also highlighted emerging good practices being implemented by a wider sample of organisations within the financial sector. As in the earlier report, the need for board level engagement and response was again highlighted, as was the need for agile governance processes as part of a wider organisational strategy to manage cyber risks. The report includes some suggested questions that board members and senior management of financial organisations should ask when considering their cyber resilience.
The report also emphasised the need for information sharing, both within organisations and at an industry level and with security agencies and law enforcement, as well as cyber awareness and training.
In November 2015, CPMI–IOSCO published draft cyber resilience guidance for consultation in “Consultative paper: Guidance on cyber resilience for financial market infrastructures”. The ASIC report includes discussion on this proposed Cyber Guidance, which will apply directly to market providers once finalised.
For further information, please contact:
Sue Gilchrist, Partner, Herbert Smith Freehills
sue.gilchrist@hsf.com
