Most Australian boards now receive quarterly security reporting, and most annual reports carry a cyber risk statement. Compliance activity has increased; the board decisions that determine outcomes often have not. Frameworks specify controls and evidence. They do not decide which risks are accepted, which services are protected first, what is said in the first hours of an incident, or who holds the knowledge the security function depends on.

What the frameworks cover

Essential Eight, fully implemented, is a demanding control baseline: patching, application control, privilege restriction and the remaining strategies, at maturity levels that are externally assessable. ISO 27001, fully implemented, is a working management system: named risks, recorded decisions, retained evidence. Both are floors against a generalised adversary. Neither tells a specific organisation whether its own crown dependencies are protected, because neither knows which dependencies matter to that organisation.

The four decisions that belong to the board

  • Accepted risks. Which risks are accepted, and the named executive owner of each acceptance.
  • Critical services. Which services the organisation cannot afford to lose, and what has been spent to protect exactly those.
  • Incident disclosure. What the organisation says, to which audiences, in the first hours of an incident — decided and rehearsed before the incident.
  • Succession of key people. Who succeeds the holders of concentrated security knowledge, and what documentation reduces that concentration.

Five questions for the quarterly pack

  • If we were seriously compromised tonight, what would still work at 9am tomorrow, and what would customers experience before we told them anything?
  • Which critical services depend on systems no vendor will patch and no one has contained — and who by name has accepted that risk?
  • What have we chosen not to fix this year, and what was funded with the saving?
  • When did we last rehearse a disclosure decision — not a recovery — and who was in the room?
  • If our security lead resigned tomorrow, what would we lose that no framework measures?

Reporting that answers these five questions is governance. Reporting that recites maturity levels is not.

Directors’ duties

Australian law has moved toward treating cyber governance as part of the duty of care and diligence rather than a delegable technical matter. Boards that govern the four decisions directly — in plain language, on a cadence — hold a defensible position. Boards that supervise framework compliance alone do not.