Cyber Security for Critical Infrastructure

It has never been more critical for Boards to understand and mitigate their organisation’s cyber risks. The rise of ransomware is just one threat challenging an organisation’s ability to respond to cyber attacks with more sophisticated attacks on critical infrastructure; the stakes are raised to a much greater degree.

With the above amendments now in force, boards and individual directors of critical infrastructure must be aware of their obligations to oversee and manage security threats.

While boards and directors cannot be prosecuted under critical infrastructure legislation, they do require the board to sign off on an organisation’s Risk Management Program (RMP).

The RMP is a written program that applies to responsible entities for one or more critical infrastructure assets. Organisations must identify and, as far as is reasonably practicable, mitigate material risks presenting a security threat.

This means all due care and diligence must be exercised in the governance of critical infrastructure entities.