State actors are targeting the Australian Defence industrial base.
Not just the primes — the subcontractors, engineers and professional services firms that hold the data. ASD warns that state-sponsored actors may use data held by Australian businesses to target government and critical infrastructure organisations, as well as their supply chains.
Why Defence is in the crosshairs
Five shifts shaping the Defence threat environment — what attackers are now doing, and what regulators now expect in response.
State actors are targeting the industrial base, not just the prime
ASD's 2024–25 report says state-sponsored actors target Australian governments, critical infrastructure and businesses for "state goals", and that "government and defence-related information is an attractive target". Government networks are not the only source: ASD warns that state-sponsored actors may use data held by Australian businesses to support further targeting of government and critical infrastructure organisations, "as well as their supply chains".
The way in is often an exposed service
In 2016 a small Australian defence contractor was compromised through an internet-facing server for which the attacker had gained administrative credentials. The attacker installed webshells across the network and stole a significant amount of data; the ACSC became aware of the intrusion that November. In Verizon's 2026 DBIR, vulnerability exploitation became the top way into breaches for the first time, at 31%, ahead of stolen credentials. Exposed, exploitable services are what continuous validation is built to surface.
AUKUS raises the stakes
AUKUS Pillar II expands technology collaboration across US, UK, and Australian industry. Each new collaborative programme adds a tier of subcontractors — and each tier is a potential attack surface. The UK MoD payroll breach (up to 272,000 personnel, the UK Defence Secretary told Parliament in May 2024, exposed through a contractor-operated system) and the US OPM breach (22 million records via contractor credentials) both came in through contractors: the MoD data sat on a contractor-operated system, and the OPM attackers logged in with a contractor's credentials.
Compliance-only security is no longer enough
DISP cyber assessments used to cover the Essential Eight's top four strategies. Since 15 November 2025, every member must achieve and maintain all eight at ML2. But the Essential Eight is a control framework — it specifies what should be in place, not whether controls actually stop today's attacker tradecraft. ASD tells businesses to operate with a mind-set of "assume compromise"; testing whether controls hold against a real attack is how that becomes practice.
The regulatory trajectory is towards continuous evidence
Mandatory 72-hour ransomware payment reporting (in force since 30 May 2025 for businesses over $3M turnover and critical infrastructure responsible entities) and the Enhanced CIRMP Rules in force since June 2026 signal the direction of travel: more reporting, higher baselines, and more scrutiny of whether controls work in practice rather than on paper.
What experts are saying
State-sponsored cyber actors continue to pose a serious and growing threat to our nation. They target networks operated by Australian governments, critical infrastructure (CI) and businesses for state goals.
Businesses and organisations must operate with a mind-set of ‘assume compromise’ and consider which assets or ‘crown jewels’ need the most protection.
ML2 is now mandatory for all DISP members
DISP cyber assessments against the Essential Eight's top four strategies concluded on 15 November 2025. All DISP members must now achieve and maintain the full Essential Eight at Maturity Level 2. Defence responds to non-compliance with a scalable approach that can extend to downgrading, suspending or terminating membership.
All DISP members must achieve and maintain Essential Eight Maturity Level 2. DISP cyber assessments against the top four strategies concluded on 15 November 2025; the full Essential Eight at ML2 now applies, assessed across the corporate network used to correspond with Defence. The Essential Eight comprises eight mitigation strategies, each assessed to ML2 across a detailed set of technical and process controls — covering application control, patching, MFA, privilege management, hardening, macros, and backups. DISP assurance runs from the Entry Level Assessment and Cyber Security Questionnaire at application, through the Annual Security Report (a self-attestation), to risk-selected Ongoing Suitability Assessments and deep dive audits. Companies handling information on US Department of Defense contracts may also face CMMC, which assesses NIST SP 800-171.
Source: Defence.gov.au — DISP Cyber and Assurance
The full set of ML2 controls across eight strategies. Required for all DISP members since 15 November 2025.
ASD's comprehensive security controls manual. DISP members handling classified information must align with ISM controls relevant to their security level.
Where NodeZero applies
International information security standard. Some primes and customers ask suppliers for it as supply chain assurance alongside DISP membership.
Where NodeZero applies
Service organisation controls for security and availability. Relevant for Defence contractors providing managed services or cloud-hosted solutions to Defence.
Where NodeZero applies
Applies to Defence contractors handling personal information of Defence personnel, veterans, or subcontractors.
Where NodeZero applies
72-hour ransomware payment reporting for businesses over $3M turnover and critical infrastructure responsible entities, which takes in many Defence suppliers.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
Cyber Security Act 2024
30 May 2025Mandatory 72-hour ransomware payment reporting for businesses over $3M turnover and responsible entities for critical infrastructure assets. Defence contractors are high-value targets — they hold IP, engineering specifications and security-sensitive data. NodeZero identifies the attack paths ransomware operators use: exposed RDP, weak admin credentials, unpatched edge devices.
Source: Cyber Security Act 2024Privacy Act statutory tort
10 Jun 2025A statutory cause of action for serious invasions of privacy, covering intentional or reckless invasions. Defence contractors hold security-sensitive personal data — clearance status, family information, medical records, vetting documentation — and a breach of it exposes clearance holders as well as the business.
Source: Privacy and Other Legislation Amendment Act 2024AUKUS ITAR exemption
Dec 2025Since 1 September 2024 the ITAR's AUKUS exemption has allowed many US defence articles and services to move between authorised users in Australia, the UK and the US without an export licence. The US State Department finalised the rule on 30 December 2025. More controlled technology in Australian hands means more for attackers to target.
Source: Federal Register — ITAR final ruleCMMC applies to Australian subcontractors
10 Nov 2025The US Department of Defense's Cybersecurity Maturity Model Certification (CMMC) applies to prime contractors and subcontractors, wherever they are based, whose systems process, store or transmit Federal Contract Information or Controlled Unclassified Information on a DoD contract. Requirements began appearing in contracts on 10 November 2025 and phase in to November 2028. CMMC Level 2 assesses the 110 security requirements of NIST SP 800-171 Rev 2.
Source: Federal Register — CMMC Program rule (32 CFR part 170)NodeZero tests your controls. Our coverage kit shows where that evidence applies.
Essential Eight ML2 spans eight strategies with a detailed set of technical and process controls. NodeZero directly validates roughly a third — the technical controls that can be tested under attack. The remaining controls cover governance, process documentation and configuration management, and need separate evidence. Drochaid's control-by-control coverage kit shows where NodeZero's evidence applies.
Find your organisation
See how the changes affect you specifically
DISP members
Active or applying. Must achieve and maintain ML2 across the corporate network used to correspond with Defence.
View details →Prime contractors
DISP members in your supply chain must meet ML2. A self-attestation doesn't show whether their controls hold.
View details →Supply chain SMEs
Same ML2 requirements, a fraction of the budget.
View details →AUKUS readiness
Essential Eight is your Australian baseline. US defence work brings CMMC too — it applies to any company handling US Department of Defense contract information, wherever it is based.
View details →Why security teams trust NodeZero
References
Everything cited on this page — regulator reports, incident coverage, and official framework documentation.
See your ML2 gaps before your assessor does
See where NodeZero produces evidence across all eight Essential Eight strategies in your environment