Australian Financial Services (AFS) licensees must adequately manage cyber security risks as part of their licence obligations according to a ruling by Australian federal court.
A recent ruling by the federal court said that adequate technological systems, policies and procedures should be in place to ensure sensitive consumer information is protected and to minimise the risk of consumer harm. Australian Securities & Investments Commission (ASIC) will take enforcement action when an AFS licensee does not meet these obligations.
In an Australian first, an AFS licensee has been found to have breached its licence obligations by failing to do all things necessary to ensure the financial services covered by the licence were provided efficiently and fairly, and by failing to adequately manage its cyber security risks.
In the judgement the court said that RI Advice Group had a number of inadequate risk management practices across its network. Inadequacies in its cyber security risk management led to a number of cyber incidents affecting clients in the six-year period to May 2020.
With financial services continuing to move online, the federal court’s ruling highlights the importance of good cyber security.
Justice Helen Mary Joan Rofe in her judgement made it clear that cyber security should be front of mind for all AFS licensees. She acknowledged that while “it is not possible to reduce cyber security risk to zero … it is possible to materially reduce cyber security risk through adequate cyber security documentation and controls”.
The Australian Cyber Security Centre recommends organisations implement eight essential mitigation strategies, at a minimum, to mitigate cyber security incidents. By implementing these steps, firms protect themselves against many vulnerabilities. M