Finance and Professional Services IT and Cybersecurity

What we hear

What finance and professional services firms keep telling us.

Every CPS 234 conversation and insurance renewal lands on at least one of these.

Business email compromise is the number one financial loss

Spoofed invoices, redirected payments and fake CFO requests cost Australian finance and professional services firms more than any other cyber loss vector. Mailbox rules, MFA bypass and privileged inbox access are the usual root causes.

Built in by default

The controls that come as standard.

CPS 234

and Essential Eight aligned by default

BEC

controls hardened across email and identity

MFA

enforced everywhere, no exceptions

24/7

EDR and managed detection coverage

Live since 1 July 2025

APRA CPS 230 is now a board-level obligation.

CPS 230 Operational Risk Management consolidates five prior standards. Boards are now accountable for identifying critical operations, setting tolerance levels for disruption, testing business continuity annually, and maintaining a material service provider register with credible substitution plans.

The transition period for material service provider contractual requirements ended on 1 July 2026. APRA's targeted amendments to CPS 230, in effect from 1 July 2026, provide limited exemptions for certain material service provider contractual arrangements.

Critical operations identified and tolerance levels approved
Workshop the executive team. Approve maximum tolerance levels at full board for disruption duration, data loss, and service degradation under a severe but plausible scenario.
Material service provider register with substitution plans
Hyperscale cloud, core banking, payments, custody, identity providers, managed IT and managed security all typically qualify. The register records the criticality assessment and a credible substitution plan for each entry.
Annual continuity testing across cyber and operational scenarios
Loss of identity provider, ransomware affecting the core platform, material data integrity loss. Findings reported to the board. APRA expects testing to span material service provider failures, cyber events, and wider operational failures.
CPS 234 information security continues alongside
Most entities now run a single quarterly operational resilience board paper covering both standards. A material information security incident is reportable under CPS 234 within 72 hours and is a CPS 230 continuity event if it affects a critical operation.

Read the CPS 230 detailed look What the standard asks of boards, and how to evidence it.

OAIC, January to June 2026

Breaches are getting bigger, not fewer.

The OAIC's latest figures, released on 26 October 2026, show the number of notifications holding steady while the size of the worst breaches climbs.

667

data breaches notified to the OAIC in the first half of 2026

OAIC

51

of them from financial services

OAIC

11

breaches affecting more than 1 million people, up from 4

OAIC

Where to go deeper

The services finance firms ask us about most.

ASD Annual Cyber Threat Report 2025-26

Regulated data plus identity-first attacks raises the stakes.

ASD's 2025-26 report shows the average reported cost of a cybercrime for a medium business rose 45% in a year, and financial services firms carry regulatory consequences on top of the direct cost. Financial and Insurance services filed 30% of reports to the report's critical infrastructure partner channels, the largest share of any sector, and attackers increasingly log in with stolen credentials, so identity controls, privileged access management and monitored sign-ins are the controls that matter most.

The full threat figures ASD's 2025-26 numbers and what they mean, in one place.

Compliance you actually have

The frameworks that apply to finance and professional services.

APRA CPS 234, Privacy Act and audit-ready evidence. We translate the obligations into a practical control set, implement the technical controls and keep the evidence audit ready.

APRA CPS 234
Information security obligations for APRA-regulated entities and their suppliers.
Privacy Act 1988
Tax File Numbers and credit information have additional handling rules.
ASIC Cyber Resilience expectations
Public statements on cyber resilience for AFS licensees.
ACSC Essential Eight
Increasingly the baseline requested by insurers and auditors.

Business email compromise is the number one financial loss vector for SMB finance firms.
Client trust and regulator scrutiny do not survive a breach disclosure.
Cyber insurance renewals now demand MFA, EDR, immutable backup and patching evidence.
Third-party and supply chain risk is now a board-level question.

Services that fit

Services we deliver into finance and professional services.

Pulled from our service catalogue and ranked by what finance and professional services environments need first.

Reading for finance and professional services

Guides that match this work, and where we already do it.

Plain-English explainers our team wrote, hand-picked for this sector, and the cities and regions where we deliver this kind of work every day.

Who we work with

Who we work with at the firm.

From the partner room to the front desk, IT and security need to land for every role.

Managing Partner
- Board-ready cyber risk reporting in plain language
- Cyber insurance renewal questionnaires answered with evidence
- Client trust protected by demonstrable controls
- One accountable provider across IT and security
- Predictable monthly spend without surprise project bills
Practice Manager
- Onboarding and offboarding handled cleanly with audit trail
- Email rules and MFA enforced without user resistance
- One support number for any IT or security issue
- Vendor and software changes coordinated centrally
- End-of-month and tax season prioritised support windows
Compliance Officer
- CPS 234 and Essential Eight gap analysis on a single page
- Documented evidence ready for audit at any time
- Third-party and supply chain risk visibility
- Notifiable data breach response runbook tested
- Privileged access controls reviewed quarterly
Client-Facing Adviser
- Email and Teams that work reliably, especially at quarter-end
- Secure file sharing that clients will actually use
- Mobile and laptop access without compromising on security
- Phishing and BEC training your team takes seriously
- Fast resolution when something breaks during a client call

Australian regulatory context

What finance and professional services leaders ask us about Australian cyber and data protection law.

Every answer is grounded in the live Australian primary source, with a link to our detailed look and to the responsible regulator. Reviewed against OAIC, APRA, ASD, DISR and Home Affairs sources.

Australian regulatory hub Every rule that touches IT and security, in one place.

Where does APRA CPS 230 actually land for our board and exec?

CPS 230 Operational Risk Management commenced for most APRA-regulated entities on 1 July 2025 and consolidates five previous standards. The board is now accountable for identifying critical operations, approving tolerance levels for disruption (duration, data loss, service degradation), testing business continuity annually across cyber and operational scenarios, and maintaining a register of material service providers with credible substitution plans. Smaller entities have until 1 July 2026. APRA finalised targeted amendments on 30 April 2026.

CPS 230 detailed look APRA CPS 230

How is CPS 234 information security being read by APRA today?

CPS 234 continues to apply alongside CPS 230 and requires regulated entities to maintain information security capability commensurate with vulnerabilities and threats, clearly define roles and responsibilities, implement controls protecting information assets, and notify APRA of material information security incidents within 72 hours. Most entities now run a single quarterly operational resilience board paper covering both standards. A material CPS 234 incident affecting a critical operation is also a CPS 230 continuity event.

APRA information security

What are the mandatory ransomware payment reporting obligations?

Part 3 of the Cyber Security Act 2024 (Cth) commenced on 30 May 2025. Businesses with annual turnover over $3 million, and all critical infrastructure entities, must report any ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours of making the payment or becoming aware that a payment has been made on their behalf. Reports are lodged through the ASD ReportCyber portal and sit alongside, not in place of, OAIC notification under the Notifiable Data Breaches scheme.

Ransomware reporting explained Home Affairs guidance

What does the new statutory tort for serious invasions of privacy mean for us?

Since 10 June 2025, individuals in Australia can sue any person or organisation that seriously and intentionally or recklessly invades their privacy, whether through intrusion on seclusion or misuse of information. The cause of action is not limited to entities covered by the Australian Privacy Principles. Damages for non-economic loss and punitive damages are capped at the greater of around $478,550 or the maximum amount for defamation non-economic loss. Surveillance, employee records handling, vendor due diligence, and incident response should all be reviewed.

Statutory privacy tort explained OAIC tort guidance

What do Australian cyber insurers actually want to see at renewal?

Australian cyber underwriters now consistently require evidence of six operational controls on proposal forms: MFA on all users (especially privileged), EDR or MDR on all endpoints, tested backups including Microsoft 365, a documented and exercised incident response plan, a patch management cadence, and security awareness training. Renewals through 2025 and 2026 are also beginning to ask about the statutory privacy tort exposure and AI governance posture.

Cyber insurance readiness

How should we approach AI governance in Australia?

The Guidance for AI Adoption, published by the National AI Centre in late 2025, replaced the Voluntary AI Safety Standard of September 2024. It condenses the ten voluntary guardrails into six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. Existing obligations under the Privacy Act and Australian Consumer Law still apply to AI use. A shadow AI policy is now table stakes.

AI governance explained Guidance for AI Adoption

Is the Essential Eight still the benchmark, or are we waiting for the new ASD framework?

Both, for now. ASD published its successor, the Essentials series, on 15 October 2026. The Essential Eight stays current through the transition, ASD has not set a retirement date yet, and existing ML1 to ML3 work counts as evidence towards the Essentials, though ratings do not convert automatically. Keep going with the Essential Eight work you have planned and map it to the Essentials as you go.

The ASD Essentials series ASD Essentials reading guide

How it works

From first call to audit-ready, in three stages.

What we do and what you do at each step. No surprise project bills.

Step 1Week 1: We review your environment first
A full audit of identity, email, devices, backup and access against CPS 234 and Essential Eight. No changes until we understand what you have inherited. What you do: You give us admin access and introduce us to your compliance lead.
Step 2Weeks 2 to 8: We fix the high-risk gaps
MFA on every mailbox, EDR on every computer, DMARC enforced, immutable backup tested, payment redirection controls and legacy authentication locked out. Staged so the firm keeps running. What you do: You approve the remediation plan and we coordinate the changes with your team.
Step 3Ongoing: We keep you audit-ready
Monthly evidence packs, quarterly posture reviews, insurer and regulator questionnaires answered with documented controls. The unglamorous work continues long after onboarding. What you do: You bring us into renewal and audit conversations. We handle the evidence.

Industries

Every industry we serve. One team running it.

The same Brisbane engineers look after every sector, so what we learn on a mine site or in a medical practice makes the next client safer too.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask before they call.

Are you familiar with APRA CPS 234 and Essential Eight?

Yes. We map your current technical environment against CPS 234 information security obligations and ACSC Essential Eight maturity. We then deliver the controls and the documented evidence so you can answer auditor and insurer questions with confidence.

How do you protect us from business email compromise?

MFA on every mailbox, conditional access, mailbox rule monitoring, DMARC, DKIM and SPF properly configured, payment redirection awareness training and EDR coverage. We also lock down legacy authentication and review privileged access regularly.

What about cyber insurance renewal questionnaires?

We help you answer the renewal questionnaire honestly and well. Where there are gaps, we tell you up front and quote remediation. Insurers increasingly insist on MFA, EDR, immutable backup and tested incident response, and we deliver all four as standard.

Can you support practice management and CRM platforms?

We support the infrastructure, identity, device and network layer that finance and professional services platforms run on, including Xero, MYOB, Class, BGL, Iress, FYI Docs, NetDocs and most major CRMs. For platform-specific issues we coordinate directly with the vendor.

What happens if we suspect a fraudulent payment redirection?

We move fast. Account isolation, mailbox rule audit, login history review, password rotation and immediate engagement with the bank are all part of our incident response runbook. We document everything so you have a clean record for insurer and regulator notification.

Next step