Cyber security has moved well beyond being a technical concern. In Australia’s current threat environment, it’s about protecting your ability to operate, serve customers, and maintain trust when, not if, something goes wrong.

The Australian Cyber Security Centre’s (ACSC) priorities for 2025–26 reflect this shift. They state that boards of directors (boards) play a critical role in overseeing how their organisations maintain and build cyber security capabilities, and in responding to existing and emerging cyber threats.

Therefore, in 2025-26, they encourage a focus by boards on the following areas:

1. Is the technology you rely on secure by design and secure by default?
2. Are you protecting the most critical parts of your business with an “assume compromise” mindset?

Why cyber risk feels different now

The threat environment in Australia continues to intensify. Attacks are faster, more automated and increasingly targeted at everyday organisations, not just well‑known brands.

What’s changed is not just the likelihood of incidents, but the impact when they occur. Downtime affects cash flow. Data exposure erodes customer trust overnight. Recovery decisions are made under pressure, often with incomplete information.

This is why the ACSC guidance emphasises resilience over perfection. You don’t need to stop every threat but you do need to make sure a single incident doesn’t derail the business.

Priority #1: Secure by design and secure by default

Security‑by‑design means protection is built into systems and platforms from the start, not added once a problem appears. Secure‑by‑default means those systems are deployed with strong protections already switched on.

In practical terms, this affects almost every technology decision you make:

• New cloud platforms
• Business software
• Customer portals
• Integrations with third‑party providers

If security isn’t part of the original design and configuration, vulnerabilities creep in quickly and often without anyone noticing until it’s too late.

“For businesses these days, cyber security is as important and essential as the shop having a lock on the door.  We need all Australian businesses to be able to protect themselves and – just as importantly – protect their customers.” – Hon. Anthony Albanese MP, Prime Minister of Australia

For your business, this raises a simple but critical question:

Are the systems we depend on protected automatically, or do they rely on people remembering to “turn security on”?

What secure‑by‑default should look like

You don’t need technical expertise to understand whether this principle is being applied. Focus on outcomes:

• Strong authentication, like multi‑factor authentication, is enforced rather than optional
• Admin access is limited to those who genuinely need it
• Systems are patched and updated consistently
• Activities are logged so unusual behaviour can be detected

If these controls aren’t in place by default, security becomes fragile and dependent on manual effort where it runs on best intentions rather than structure.

Priority #2: Assume compromise

Perfect prevention isn’t realistic anymore. The ACSC guidance is clear: it’s safer to assume a breach will eventually occur and plan accordingly.

This doesn’t mean operating in fear. It means being deliberate about what matters most and focusing your efforts there.

Every organisation has “crown jewels,” these are the systems, data and processes that would cause serious harm if they were disrupted or exposed. These might include:

• Financial systems
• Customer or patient data
• Core production or service platforms
• Sensitive intellectual property

The mistake many businesses make is trying to protect everything equally. That spreads effort too thin and leaves critical assets exposed.

Focus Where It Matters Most

• Define the ‘crown jewels’
  You should be able to clearly point to a small list of systems or datasets that must be prioritised. This doesn’t need to be a complex exercise but it does need to be explicit.
• Containment over perfection
  Advanced threats could affect you despite all measures. What matters next is whether they can move freely. Segmentation, strong identity controls and good visibility around critical systems dramatically reduce the damage caused by any single incident.
• Plan for recovery, not just backups
  Backups are only valuable if restores are fast, clean and prioritised. Knowing which systems need to come back first through a tested process is what would keep your business running.

This approach aligns with broader ACSC emphasis on event logging, managing older systems, supply‑chain risk and future‑proofing encryption, because all of these directly affect how quickly you can detect, contain and recover from an incident.

Where a Cyber Incident Response Plan Fits In

This is the point where many businesses get stuck.

You’ve invested in technology, but you haven’t planned for decision‑making during an incident. That’s the role of a Cyber Incident Response Plan (CIRP). A CIRP isn’t a technical document. It’s an operational blueprint that helps your business respond quickly, decisively, and with less disruption when something goes wrong.

At its core, it answers four questions for you before you’re under pressure:

1. How do we recognise a serious cyber incident?
2. Who needs to be involved immediately?
3. What actions do we take first to limit damage?
4. How do we communicate clearly and responsibly?

Without a plan, these decisions are made on the fly. That’s when delays, inconsistent messaging and unnecessary disruption occur. With a plan, your response becomes calmer, faster and far more effective even with a small team.

A common misconception: “We have backups, so we’re covered”

Backups are essential but on their own, they don’t equal resilience.

What really matters is:

• How quickly systems can be restored
• Whether restored systems are clean
• Which systems are restored first

“If a key platform is unavailable for days, the impact shows up in invoices not sent, services delayed, and customer confidence shaken,” says Robert Buck, Founder and Managing Director, Diamond IT. “That’s exactly why recovery planning must focus on your crown‑jewel systems — not a ‘restore everything eventually’ approach.”

Resilience Starts Before an Incident

The cyber security priorities for 2025–26 aren’t about doing more, they’re about doing the right things first.

When systems are secure by default, critical assets are clearly protected, and incident response is thought through in advance, cyber risk becomes manageable rather than overwhelming, allowing your team to act decisively and contain issues sooner with far less disruption to the business. Not because threats disappear but because your ability to respond improves.

“The organisations that have a robust, mature approach to cyber risk treat it as a business risk – not an IT risk,” says Marcus Thompson, inaugural head of information warfare for the Australian Defence Force, “And the time to be thinking about all of this is before the crisis – not during the crisis.”

How Diamond IT Can Help

If you’d like support strengthening your cyber security posture, prioritising critical assets, or putting a practical Cyber Incident Response Plan in place, our team is here to help. Contact us on 1300 307 907, email enquiries@diamondit.com.au, or fill out the form below.