Who regulates cyber security in Australia?

Who regulates cyber security in Australia is multiple agencies with different responsibilities, not a single regulator. The main coordinator is the Australian Signals Directorate ASD and its Australian Cyber Security Centre ACSC, which is the technical authority for cyber threats, provides alerts, threat intelligence and incident response, and runs cyber.gov.au. The Department of Home Affairs is the policy lead for the Cyber Security Strategy 2023-2030 and administers the Security of Critical Infrastructure Act 2018, which requires 11 critical sectors including energy, water, health, banking and telecoms to report cyber incidents and have risk management programs, regulated by the Cyber and Infrastructure Security Centre CISC within Home Affairs. The Office of the Australian Information Commissioner OAIC regulates privacy and data breaches under the Privacy Act 1988 and Notifiable Data Breaches scheme, requiring businesses to notify data breaches within 72 hours. The Australian Prudential Regulation Authority APRA regulates cyber security for banks, insurers and super funds under CPS 234 Information Security standard, requiring financial institutions to have strong cyber controls. The Australian Securities and Investments Commission ASIC regulates cyber risk disclosure for listed companies. The Australian Federal Police AFP and state police investigate cybercrime. The Australian Communications and Media Authority ACMA regulates telco security under Telecommunications Act. For small businesses, there is no single regulator but ACSC provides guidance.