CORPORATIONS — deficiencies in financial adviser’s policies for and implementation of defences against cyber-related attacks — where steps have been taken to address previous deficiencies — where Defendant admitted contraventions of ss 912A(1)(a), 912A(1)(d), 912A(1)(h) of the Corporations Act 2001 (Cth) — where parties prepared a statement of agreed facts and jointly proposed declarations of contravention and a pecuniary penalty — whether declaratory relief should be granted — whether proposed pecuniary penalty is an appropriate penalty
Quick Take
1An AFSL holder's obligation under s 912A(1)(a) to ensure financial services are provided efficiently, honestly and fairly extends to implementing adequate cybersecurity policies and adequate oversight and monitoring frameworks for authorised representatives' cyber resilience, even where the cybersecurity measures are not directly part of the provision of financial services themselves.
2The obligation under s 912A(1)(d) to have adequate human resources includes a qualitative dimension requiring personnel (whether internal or externally engaged) with specialised cybersecurity expertise where the licensee's business involves authorised representatives collecting and storing sensitive client personal information, making the licensee and its network potential targets for cyber-related attacks.
3A licensee's risk management system under s 912A(1)(h) is inadequate where it fails to adequately identify and evaluate cybersecurity risks, establish and maintain controls to manage those risks, document roles and responsibilities for cyber risk management, and enable identification, reporting and escalation of cybersecurity issues from authorised representatives to the licensee.
