The Australian Cyber Security Centre (ACSC) should evolve into a formal cybersecurity regulator, with a role comparable in principle to what the Therapeutic Goods Administration (TGA) does in Australia’s health sector. The ACSC would have authority to set minimum cybersecurity standards, certify high-risk products and services, investigate major cyber incidents, mandate remediation of systemic vulnerabilities and enforce compliance across critical sectors.
It would be responsible for regulation, compliance, certification and public accountability, while the Australian Signals Directorate (ASD) would continue to lead operational cyber defence, intelligence, and national cyber operations.
Australia’s cybersecurity framework has matured significantly over the past decade but is still largely built around guidance, voluntary compliance and partnership with industry. While this approach has delivered important gains, the growing frequency and severity of cyber incidents suggest it alone is no longer sufficient. Cyber insecurity is increasingly a public safety issue rather than simply an information-technology problem. As cyber vulnerabilities threaten critical infrastructure,…
