practitioner au-compliance privacy supply-chain
Before personal information goes to an overseas recipient, APP 8.1 requires reasonable steps, and s 16C can make you answer for the recipient's mistakes. How the OAIC separates disclosure from use and from a breach, when an offshore cloud or support contract is in or out, the exceptions, and what to write into vendor contracts and runbooks.
practitioner au-compliance resilience supply-chain
CPS 230 is APRA's operational risk standard for banks, insurers, private health insurers and super trustees. It asks each entity to name its critical operations, set how long and how badly each may be disrupted, prove it can stay inside those limits through a severe disruption, and manage the suppliers it depends on. Here is what it requires, the three notices it creates, and how it sits beside CPS 234.
practitioner hardening supply-chain
Chrome and Edge auto-update means a bought extension can turn hostile overnight. Inventory, least privilege, and remove what you do not need.
practitioner au-compliance privacy ai supply-chain
The OAIC says the Privacy Act applies to every use of AI that involves personal information, covering both what goes into a tool and what comes out. What to check before you buy, when a prompt becomes an APP 6 disclosure, why AI output can be a collection under APP 3, and the security and accuracy steps the OAIC expects.
practitioner au-compliance IR supply-chain
Board-approved CIRMP annual attestation under SOCI Part 2A/2AA. FY 2025–26 90-day window closed 28 September 2026 — if you missed it, treat late lodging as a compliance failure and close the evidence pack now.
practitioner au-compliance supply-chain cloud
The Commonwealth rule set for where sensitive government data may live. Sensitive data, whole-of-government systems and PROTECTED systems must sit on HCF-certified services; Strategic certification gives the most ownership and control protection, Assured less, Uncertified almost none. New registrations have been paused since 3 November 2025 while the framework is reformed.
practitioner hardening supply-chain
Software bill of materials plus the CI controls that make it useful. Inventory what you ship, who can publish, and how fast you can patch a dependency.
practitioner hardening supply-chain web
A script tag that loads from someone else's server runs with your page's full authority. What can go wrong when that provider is breached, what Subresource Integrity and Content Security Policy do and do not stop, and a short checklist for login, payment and account pages.
practitioner network crypto hardening supply-chain IR
What to do when a certificate authority's keys are compromised or a root program stops trusting it. Browsers fix themselves within hours; the long tail is everything else that carries its own copy of the trust store, plus any of your own certificates that chain to the distrusted CA.
practitioner identity cloud supply-chain IR
Hosting platforms, CI/CD services and AI gateways keep your API keys, database passwords and registry tokens. When one of them reports a breach, assume every secret it held is exposed, and remember that a secret is only dead once the service that issued it has revoked it.
