Who Actually Owns Cyber Risk in Your Organisation?

Here is a question worth putting to your leadership team this week. If a data breach were confirmed on a Friday afternoon, who in this organisation is authorised to declare it?

Not who would find out. Not who would fix it. Who makes the call that says this is a breach, the clock has started, and we are now notifying.

In most organisations the answer is a pause, then a few names, then a discussion about whether it would really be that person or whether it would go to someone else first. That pause is the finding.

Three obligations, three owners, one gap

Look at what is landing on Australian organisations right now, and notice what they have in common.

👉 Draft privacy legislation released on 31 August would replace the current “as soon as practicable” breach notification standard with a fixed 72-hour deadline. The clock starts when the organisation becomes aware there are reasonable grounds to believe a breach has occurred. Someone has to form that belief, and someone has to own it.

👉 For providers delivering funded employment, skills or disability services, an updated External Systems Assurance Framework takes effect on 1 October, with clearer provisions for accreditation revocation where ongoing compliance cannot be demonstrated. Accreditation is tied to the funding contract. Someone has to be responsible for keeping it.

👉 And in August the Australian Signals Directorate, working with the Australian Institute of Company Directors, published guidance on frontier AI cyber threats written for boards, setting out threshold questions directors should be asking management, with an expectation of regular reporting and assurance. Someone has to answer those questions.

Three different obligations. In a lot of organisations, three different people. Sometimes the same overloaded person. Occasionally nobody in particular, which is the most common answer of all and the hardest one to admit.

Ownership is not the same as involvement

Plenty of organisations can point to people involved in cyber security. The IT manager, the external provider, the operations lead who handles compliance paperwork, the executive who signs off the budget.

Involvement is not ownership. Ownership means one role, named, that is accountable for the outcome and empowered to act. The difference shows up under pressure. Involvement produces a meeting. Ownership produces a decision.

The questions that reveal the gap

You do not need an audit to test this. Six questions will tell you most of what you need to know.

1. Who is authorised to declare a data breach, and does that authority exist in writing?
2. If that person is on leave or on a plane, who holds it instead?
3. Who owns your compliance obligations, whether that is RFFR accreditation, ISO certification or a contractual security schedule?
4. Who is responsible for producing evidence if a regulator asks, and could they do it this week?
5. Who briefs the board on cyber risk, and how often?
6. If your IT is outsourced, does your provider know which of these sit with them and which sit with you?

If any of those produce a discussion rather than a name, that is where to start.

Why regulators are asking this now

There has been a quiet shift in how cyber obligations are written.

Older requirements described controls. Newer ones describe accountability, evidence and timeframes. The ASD and AICD guidance asks boards to press management and expect assurance. The privacy Bill attaches a hard deadline to a judgement call. The updated ESAF names a consequence for compliance drift.

The common thread is that regulators have stopped asking only what you have in place. They are asking who is answerable for it, and whether you can prove it.

That is a governance question, not a technical one, and it is not solved by buying anything.

Where to start

• Name the roles, not the people. People change jobs. A named role survives the resignation.
• Write it down. Ownership that exists only as a shared understanding evaporates under pressure.
• Check it covers after hours. Incidents do not respect business hours, and neither does a 72-hour clock.
• Test it. Walk a scenario through with the people named and see where it stalls. That is far cheaper than discovering it live.
• Close the outsourcing gap. Where IT is external, be explicit about which obligations transfer and which stay with you. Assumptions on both sides are common and expensive.

How Diamond IT can help

If you are not sure where to start, a business resilience discovery workshop will help you understand your requirements and right size a solution. From there, we can support you with:

• Governance and accountability review: We can help you map who currently owns each obligation across your organisation, identify where ownership is unclear, duplicated or missing, and set out what good looks like for a business your size.
• Readiness assessments: We can assess your current security, governance and documentation practices to identify gaps and prioritise the actions needed to improve your compliance readiness, whether that is against privacy obligations, a funding contract or a recognised framework.
• Roadmap development: Creating practical improvement plans that set out what needs to be done, who is responsible, and how it will be managed.
• Policies, processes and procedures: We can support you in developing or enhancing your business documentation, including the incident response and breach notification decision paths that determine who declares what and when. We can provide recommendations and support right through from performing the works, to mentoring a team member, to light touch advice. Flexibility is key to making it manageable alongside your ongoing work.
• Governance and compliance advisory calls: Need to talk to an expert? Our Business Technology Practice has consultants available to provide one off or ongoing advice to help you maintain your compliance, adapt to new changes and stay informed.

If you would like to talk it through, get in touch with our team on 1300 307 907, send an email to enquiries@diamondit.com.au or fill out the form below.