ASIC Cyber Resilience Good Practices

Australia

v2022

8 domains

29 controls

The Australian Securities and Investments Commission sets expectations for cyber resilience of regulated entities in the financial services sector. Based on ASIC Report 429 (2015) and Report 716 (2022), it outlines good practices for boards and management in managing cyber security risks. Applies to Australian financial services licensees, credit licensees, and market operators.

Verified

Get the official standard — this page is an AI-assisted companion tool, not a replacement for the authoritative text.

Visit asic.gov.au

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (8)

Asset Management

2 controls

Centralised asset and configuration management.

Controls in the Asset Management domain of ASIC Cyber Resilience Good Practices — 2 controls
Code	Title	Description
ASIC-CR-AM-1	Centralised asset management system	Maintain a centralised asset management system covering hardware, software and data inventories for visibility of critic...
ASIC-CR-AM-2	Configuration management	Apply configuration management to ensure visibility and control of critical assets across the organisation.

Collaboration and Information Sharing

2 controls

Information sharing with peers, agencies and threat-intel providers.

Controls in the Collaboration and Information Sharing domain of ASIC Cyber Resilience Good Practices — 2 controls
Code	Title	Description
ASIC-CR-CO-1	Confidential information sharing	Maintain confidential information-sharing arrangements with other financial institutions, security agencies and law enfo...
ASIC-CR-CO-2	Specialist threat-intelligence providers	Use specialist third-party providers for threat intelligence gathering.

Cyber Awareness and Training

3 controls

Staff awareness, training and testing.

Controls in the Cyber Awareness and Training domain of ASIC Cyber Resilience Good Practices — 3 controls
Code	Title	Description
ASIC-CR-AT-1	Staff awareness and training	Run organisation-wide programs for staff awareness, education and active vigilance against cyber threats.
ASIC-CR-AT-2	Continuous development	Use continuous development strategies to maintain active staff vigilance over time.
ASIC-CR-AT-3	Random staff testing	Conduct random testing (e.g. phishing simulations) to measure the effectiveness of the awareness programme.

Cyber Risk Management and Threat Assessment

3 controls

Intelligence-led cyber risk management and third-party risk.

Controls in the Cyber Risk Management and Threat Assessment domain of ASIC Cyber Resilience Good Practices — 3 controls
Code	Title	Description
ASIC-CR-RM-1	Intelligence-led cyber risk management	Use intelligence-led approaches with near real-time processes through automation to manage cyber risk.
ASIC-CR-RM-2	Fusion centres for real-time monitoring	Establish specialist 'fusion' centres for real-time monitoring and correlation of threats and risks.
ASIC-CR-RM-3	Third-party and supply chain risk management	Apply risk-based assessment of third-party suppliers and partners, obtaining visibility through contract transparency an...

Cyber Security Strategy and Governance

6 controls

Board ownership, responsive governance and alignment of cyber strategy.

Controls in the Cyber Security Strategy and Governance domain of ASIC Cyber Resilience Good Practices — 6 controls
Code	Title	Description
ASIC-CR-GOV-1	Board engagement and periodic review of cyber strategy	The board takes ownership of cyber strategy and reviews it periodically to assess progress against success measures such...
ASIC-CR-GOV-2	Treat cyber resilience as a management and investment tool	Treat cyber resilience as a critical management tool for understanding risk and informing investment decisions.
ASIC-CR-GOV-3	Board cyber fluency	Enhance board fluency in cyber threat language and the capability to ask relevant questions of management.
ASIC-CR-GOV-4	End-to-end assurance processes	Assurance processes focus on testing end-to-end business processes rather than isolated controls.
ASIC-CR-GOV-5	Responsive, event-driven governance	Adopt responsive governance models that adjust to events and incidents rather than keeping to a fixed review period.
ASIC-CR-GOV-6	Align cyber governance with enterprise governance	Ensure clear alignment between cyber security governance and the organisation's overall governance framework.

Detection Systems and Processes

3 controls

Continuous monitoring, analytics and red teaming.

Controls in the Detection Systems and Processes domain of ASIC Cyber Resilience Good Practices — 3 controls
Code	Title	Description
ASIC-CR-DE-1	Continuous monitoring with SIEM	Implement organisation-wide continuous monitoring using SIEM technologies to detect and alert on anomalous behaviour aga...
ASIC-CR-DE-2	Data analytics for threat integration	Use data analytics to integrate threat sources into a single real-time view of the threat landscape to move towards pred...
ASIC-CR-DE-3	Red teaming	Employ technical specialists to attempt to break into the organisation's networks (red teaming) to test defences.

Protective Measures and Controls

5 controls

Essential Eight and additional protective controls.

Controls in the Protective Measures and Controls domain of ASIC Cyber Resilience Good Practices — 5 controls
Code	Title	Description
ASIC-CR-PR-1	Implement the ASD Essential Eight	Implement the Australian Signals Directorate's Essential Eight strategies to mitigate targeted cyber incidents, and self...
ASIC-CR-PR-2	Security Development Lifecycle	Integrate security as an integral part of the systems development lifecycle (Security Development Lifecycle).
ASIC-CR-PR-3	Encryption of data at rest and in transit	Apply encryption for stored data and data in transit based on a risk assessment of the assets in question.
ASIC-CR-PR-4	Outbound email filtering and monitoring	Filter and monitor outbound email to ensure data is not transmitted outside the network in error or through intent.
ASIC-CR-PR-5	Restricted removable media / USB access	Highly restrict use of USB ports on computer equipment to minimise data leakage or introduction of unauthorised software...

Response and Recovery Planning

5 controls

Scenario-based response, recovery and stakeholder communication.

Controls in the Response and Recovery Planning domain of ASIC Cyber Resilience Good Practices — 5 controls
Code	Title	Description
ASIC-CR-RR-1	Scenario planning and response exercising	Conduct routine, detailed scenario planning to predict incidents based on the risk profile, and implement and exercise r...
ASIC-CR-RR-2	War gaming	Use war gaming techniques to better understand and plan defence against malicious cyber activities.
ASIC-CR-RR-3	Proactive board reporting during incidents	Provide proactive reporting to the board on changing threats and the countermeasures in place.
ASIC-CR-RR-4	Customer and breach notification	Actively determine when and how to notify customers in the event of a data breach.
ASIC-CR-RR-5	Stakeholder communication plan	Maintain a well-defined communication plan for managing stakeholders and public relations during and after an incident.

Your Compliance Coverage

If you comply with ASIC Cyber Resilience Good Practices, you already cover:

NIST Cybersecurity Framework 2.0

93%

27 controls mapped

Compare →

APRA CPS 234

38%

11 controls mapped

Compare →

NIST SP 800-53 Rev 5

28%

8 controls mapped

Compare →

+ 2 more: ASD Strategies to Mitigate Cyber Security Incidents (24%), ACSC Essential Eight (3%)

See all 5 mapped frameworks ↓

Maps to 5 other frameworks

29 total controls

NIST Cybersecurity Framework 2.0

27 source controls mapped|32 target controls covered

93%

APRA CPS 234

11 source controls mapped|13 target controls covered

38%

NIST SP 800-53 Rev 5

8 source controls mapped|9 target controls covered

28%

ASD Strategies to Mitigate Cyber Security Incidents

7 source controls mapped|14 target controls covered

24%

ACSC Essential Eight

1 source controls mapped|8 target controls covered

Compare ASIC Cyber Resilience Good Practices with NIST Cybersecurity Framework 2.0

Frequently Asked Questions

What is ASIC Cyber Resilience Good Practices?

ASIC Cyber Resilience Good Practices is a compliance framework from Australia with 8 domains and 29 controls. The Australian Securities and Investments Commission sets expectations for cyber resilience of regulated entities in the financial services sector. Based on ASIC Report 429 (2015) and Report 716 (2022), it outlines good practices for boards and management in managing cyber security risks. Applies to Australian financial services licensees, credit licensees, and market operators. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does ASIC Cyber Resilience Good Practices have?

ASIC Cyber Resilience Good Practices has 29 controls organised across 8 domains. The largest domains are Cyber Security Strategy and Governance (6 controls), Protective Measures and Controls (5 controls), Response and Recovery Planning (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does ASIC Cyber Resilience Good Practices map to?

ASIC Cyber Resilience Good Practices maps to 5 other compliance frameworks. The top mapping partners are NIST Cybersecurity Framework 2.0 (93% coverage), APRA CPS 234 (38% coverage), NIST SP 800-53 Rev 5 (28% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with ASIC Cyber Resilience Good Practices compliance?

Start your ASIC Cyber Resilience Good Practices compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ASIC Cyber Resilience Good Practices requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 29 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.

Get Started Free →

Free forever — no credit card required