You're in Privacy Act scope. Ransomware payment reporting can apply to you. The ACNC has made cyber security a compliance focus.
As a large Australian charity, you are likely to sit inside the Privacy Act, the Cyber Security Act's mandatory ransomware payment reporting regime, and the full ACNC Governance Standards. The ACNC made cyber security a compliance focus for 2024–25, and Commissioner Sue Woodward has said the people who run a charity are ultimately responsible for managing cyber security risks. Pareto Phone exposed supporter data from several large charities. The ICRC's compromise of data on more than 515,000 people is the international benchmark for beneficiary-data risk. The evidence your Board relies on has to hold up.
Your specific challenges
Sensitive beneficiary data makes consequences severe
Health, detention, family separation, domestic violence, refugee, and minors-in-care data creates immediate safety risk on exposure — not just reputational harm. The ICRC had to shut down the systems underpinning its Restoring Family Links work after its breach.
GS5 makes cyber oversight a director duty
Governance Standard 5 requires responsible persons to act with reasonable care and diligence. The ACNC's guidance places ultimate responsibility for cyber risk with them, and suggests seeking outside help where the charity lacks the knowledge and experience in-house.
Mission investment and security investment compete for dollars
Every dollar on cyber is a dollar not on mission. That trade-off is real and legitimate — which is why the approach has to be evidence-based, cost-efficient, and prioritised.
Built for your situation
Evidence for Board oversight
NodeZero findings show responsible persons what an attacker could reach, a factual basis for the reasonable care and diligence Governance Standard 5 expects.
APP 11 reasonable steps, tested
Moves APP 11 from documented policy to tested controls. Internal, external and cloud pentesting show whether the controls protecting personal information hold against a real attack.
Beneficiary-data reach assessment
Segmentation and internal testing reveal what data is actually accessible from a compromised user account — directly addressing the ICRC-class scenario where beneficiary data concentration amplifies every control gap.
Give your Board evidence for its GS5 cyber oversight
See what an attacker could reach in your charity's environment