State actors are targeting Australian Government networks for "state goals".
39% of the 138 ransomware incidents the ACSC responded to in FY2024–25 began with ASD contacting the entity to warn it of a possible incident. HWL Ebsworth's April 2023 compromise cascaded across 62 Commonwealth entities.
Why Government is in the crosshairs
Five shifts shaping the government threat environment — what attackers are doing and what regulators now expect agencies to demonstrate.
Government is the third-highest sector for notified data breaches
OAIC data puts Australian Government agencies among the most-notifying sectors: second in H2 2024 (17%) and third across 2025 (10%). ASD's 83% year-on-year increase in malicious-activity notifications, to more than 1,700, reflects a sustained, intensifying operational tempo.
State-sponsored actors are the persistent adversary
ASD's 2024–25 report is explicit that state-sponsored cyber actors target Australian government networks, critical infrastructure and businesses for "state goals" — cyber espionage, malign influence, interference and coercion, and pre-positioning for disruption — and "routinely target Australian government networks for cyber espionage purposes". In 2019 then-Prime Minister Morrison told Parliament that Australia's experts believed a "sophisticated state actor" was responsible for the attack on Parliament House networks.
Third-party contractors are the common entry point
OPM was breached via contractor KeyPoint Government Solutions. UK armed forces payroll data — up to 272,000 personnel, the Defence Secretary told Parliament — was exposed through a contractor-operated system. HWL Ebsworth's compromise affected 62 Commonwealth government entities through a single law firm breach. Service NSW lost 104,000 customers' data from 47 phishing-compromised staff email accounts.
DDoS and disruption — not just theft — are rising
ASD's ACSC responded to more than 200 denial-of-service incidents in 2024–25, up more than 280% on the previous year, and DoS/DDoS made up 16% of the incidents government entities reported. Adversary objectives now include visible disruption, not only data theft.
Detection is lagging discovery
ASD's finding that 39% of ransomware incidents in 2024–25 began with ASD contacting the affected entity tells you what the sector-wide detection gap looks like. Controls that look strong on paper are missing attacks in operation. Continuous validation is how "assume compromise" becomes operational, not rhetorical.
What regulators and experts are saying
Businesses and organisations must operate with a mind-set of ‘assume compromise’ and consider which assets or ‘crown jewels’ need the most protection.
Individuals often don't have a choice but to provide their personal information to access government services. This makes it even more important that agencies keep personal information secure and have an action plan in place should a breach occur.
The longstanding failure of OPM's leadership to implement basic cyber hygiene, such as maintaining current authorities to operate and employing strong multi-factor authentication, despite years of warnings from the Inspector General, represents a failure of culture and leadership, not technology.
PSPF requires a zero trust culture
PSPF Release 2026 requires a cyber security strategy and uplift plan aligned to the Guiding Principles to Embed a Zero Trust Culture — while ASD's Commonwealth Cyber Security Posture 2025 report shows only 22% of entities at overall Essential Eight ML2
Non-corporate Commonwealth entities must achieve Essential Eight Maturity Level 2 as the baseline for ICT security under the PSPF. The PSPF also requires a cyber security strategy and uplift plan aligned to the Guiding Principles to Embed a Zero Trust Culture. Maturity is tracked publicly through ASD's annual Commonwealth Cyber Security Posture report — the 2025 report found only 22% of entities at overall ML2 — and ANAO performance audits repeatedly probe the same controls. The Essential Eight comprises eight mitigation strategies, each assessed to ML2 across a detailed set of controls. State and territory governments operate under separate frameworks; NSW and Queensland policies require agencies to implement the Essential Eight.
The full set of ML2 controls across eight strategies. The Commonwealth Cyber Security Posture 2025 report shows only 22% of entities at overall ML2.
ASD's comprehensive controls manual. Federal agencies must implement ISM controls proportionate to their information classification level.
Where NodeZero applies
Relevant for government agencies procuring cloud or managed services, where a SOC 2 report is one form of assurance a vendor can provide.
Where NodeZero applies
Australian Government agencies are generally bound by the Australian Privacy Principles when handling personal information.
Where NodeZero applies
Ransomware payment reporting applies to government entities that are responsible entities for critical infrastructure assets, and to suppliers over the $3M turnover threshold.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
PSPF — zero trust culture requirement
Jul 2025PSPF Requirement 98 (in force since 1 July 2025, retained in Release 2026): a cyber security strategy and uplift plan, maintained in line with the ISM and the Guiding Principles to Embed a Zero Trust Culture. A policy requirement, not guidance. NodeZero tests whether access controls, segmentation and privilege boundaries hold against a real attacker.
Cyber Security Act 2024
30 May 2025Mandatory 72-hour ransomware payment reporting for businesses over $3M turnover and responsible entities for critical infrastructure assets. Commonwealth and state bodies are excluded from the turnover test, but a government entity that is the responsible entity for a critical infrastructure asset is in scope, as are private providers of government services that meet the threshold.
Find your organisation
See how the changes affect you specifically
Federal agencies
Non-corporate Commonwealth entities must achieve Essential Eight ML2 — the 2025 posture report shows only 22% have. Maturity is reported and published annually.
View details →State departments
NSW, Victoria, Queensland and other states run their own frameworks. NSW and Queensland policies require agencies to implement the Essential Eight.
View details →Local councils
537 councils across Australia, each running community services attackers can disrupt. Cost-effective continuous validation without the consulting price tag.
View details →Why security teams trust NodeZero
Build your compliance evidence before your next audit
See how NodeZero maps to the ISM and all 8 Essential Eight strategies in your environment