Some cyber security policy moves.snippets from...

Some cyber security policy moves.
snippets from AFR

........................
Businesses will be required to comply with minimum standards of cyber security under a federal government plan to harden the nation's defences of vulnerable computer networks against foreign adversaries and cyber criminals.

Defence Minister Linda Reynolds and Prime Minister Scott Morrison revealed a sophisticated state-based actor has stepped up cyber attacks against Australian organisations.

Firms will also need to ramp up their spending on cyber security, including potentially contributing to the cost of the national agencies as part of an updated cyber security strategy.

Prime Minister Scott Morrison has confirmed the strategy will also see Canberra lift its spending following revelations a "sophisticated state-based actor" had attempted to hack into Australian networks on an industrial scale.

The updated cyber security strategy was due to be released in the run up to the postponed May federal budget but was delayed because of the pandemic.

Industry sources said the strategy was expected to require firms to comply with a minimum level of cyber security set by the federal government, with those in the critical infrastructure field such as banks, healthcare and utilities expected to be the top priority.

The government would be responsible for setting an industry-by-industry standard to apply to all firms in that sector. The standards would be applied either through a code of conduct, with potentially a regulator to ensure compliance.

A discussion paper on the strategy also flagged the government could seek to recover the cost of providing services to owners of critical systems through direct charges or other alternative funding models rather than relying on tax revenue.

The head of the Australian Strategic Policy Institute's International Cyber Policy Centre Fergus Hanson said hardware and software vendors and internet service providers would likely have to shoulder the direct cost of increased cyber security requirements, but these would flow through to businesses and eventually their customers.