As we steer through the complex matrix of cyber governance, one of Australia’s most touted frameworks—the Australian Signals Directorate’s (ASD) Essential Eight—commands attention. But how relevant is this set of strategies in today’s governance landscape? Let’s dissect this.
Cyber Governance in Context
The cyber governance landscape is evolving and never static, now becoming a cornerstone in the broader scope of business governance. Unlike piecemeal cybersecurity measures, cyber governance aims for a holistic, organisation-wide approach.
Global frameworks like the National Institute of Standards and Technology (NIST) have gained traction for their modular, risk-oriented strategies – however is often criticised for being too nebulous. The Essential Eight, however, leans heavily into technical compliance, raising concerns about its suitability for cyber governance, especially for Small and Medium Enterprises (SMEs).
Complexity vs. Compliance
Complex jargon like “User application hardening” serves as more than just a stumbling block—it becomes a cyber governance issue. How can governance officers make informed decisions when the language is dense and the implementation opaque?
Good cyber governance calls for clarity and transparency, attributes seemingly missing from the Essential Eight.
Resource Allocation
Implementation isn’t just a technology challenge; it’s a resource governance problem. Following the Essential Eight involves not only technical measures but also potential business process redesigns, skill upgradation, and significant capital investment. When cyber governance is about effective resource utilisation and risk management, this all-or-nothing approach is hard to justify.
A Regulatory Detour
Even regulatory bodies within Australia show a disconnect with the Essential Eight. The Australian Securities and Investments Commission (ASIC) favors the NIST framework, and state governments have chosen different cyber governance standards. When governance structures themselves diverge, it complicates the cyber governance landscape for SMEs.
Cyber Governance Is Not Just Technical
Robust cyber governance is not about deploying the right firewalls or implementing stringent password policies alone; it encompasses risk management and business continuity. By making cybersecurity a purely technical task, we overlook the governance aspects that can make or break an organization’s cyber resilience.
The Human Factor
While the Essential Eight is focused on hardening software and locking down data, it curiously overlooks one of the weakest links in the cyber governance chain: the human element.
Human error, from clicking on phishing links to improper data handling, is still the Achilles heel of cybersecurity. A governance model that doesn’t factor in human risk management falls remarkably short of being comprehensive.
Cyber governance isn’t just about technology; it’s also about managing human behaviour and its inherent risks.
The Way Forward
If Australia’s 2030 vision of being the most cyber-secure nation is to be realised, the Essential Eight must evolve to align with modern cyber governance requirements. Cyber governance is not a sideline activity; it’s a strategic imperative.
In conclusion, from a cyber governance viewpoint, the Essential Eight needs more than a facelift—it needs a complete overhaul. The future calls for a framework that is not only technically sound but also governance-ready.
