Cyber risk is a governance obligation, not only a technical one. Boards carry specific responsibilities for cyber risk oversight, and regulators including APRA, the Australian Signals Directorate, Critical Infrastructure Security Centre, and the OAIC assess governance frameworks when determining enforcement responses to incidents. The adequacy of what was in place before the incident is the first question asked after it.

We advise boards and senior management on establishing and maintaining cyber governance frameworks that satisfy regulatory requirements across the Privacy Act, the Security of Critical Infrastructure Act, the Cyber Security Act 2024 (Cth), and APRA's prudential standards including CPS 234. Work covers cybersecurity policies, board-level reporting structures, escalation protocols, vendor and supply chain risk management, and the governance arrangements required for AI deployment and emerging technology where cybersecurity risk intersects with data protection and automated decision-making accountability. Clients include major corporations, regulated financial institutions, government agencies and critical infrastructure operators subject to multiple overlapping frameworks.

The legal workstream of a cyber incident begins at detection. Privilege must be established over forensic investigation materials before external advisors are engaged. Breach assessment, evidence preservation, notification timing and regulator engagement must be managed simultaneously. Decisions made in the first 24 to 72 hours determine the regulatory and litigation exposure for months that follow.

We lead the legal response to cyber incidents including data breaches, ransomware attacks, system compromises and supply chain intrusions. Work covers breach assessment under the critical cybersecurity incident or ransomware payment (cyber extortion) notification schemes, evidence preservation, privilege protection over forensic materials, coordination with technical advisors, insurers, communications teams and executive management, and preparation for regulatory engagement before formal notification is made. The approach integrates the legal workstream with the operational response, ensuring every decision is made with awareness of the regulatory and litigation risk it carries.

Cybersecurity obligations in Australia are layered across multiple frameworks and regulators. The Privacy Act, the Security of Critical Infrastructure Act, the Telecommunications Act, APRA's CPS 234, the Cyber Security Act 2024 and sector-specific obligations in financial services, health and government apply concurrently to many organisations. Compliance is not a single program. Enforcement responses require coordinating legal positions across regulators whose interests and disclosure requirements are not always aligned.

We advise on compliance program design across the full regulatory landscape, on regulatory engagement strategy and on responses to investigation and enforcement action. We represent organisations responding to investigation and enforcement by the OAIC, APRA and the Australian Signals Directorate. Post-incident regulatory engagement is among the most complex work in this space: the positions taken with one regulator affect the positions available with another, and the disclosure required by one may create exposure before another. This practice has particular depth in financial services and government, where cyber obligations carry the highest regulatory scrutiny and the consequences of enforcement are most severe.

Cyber insurance is a significant and often contested financial resource in the aftermath of an incident. Policy terms are drafted before the incident occurs; coverage disputes arise after it, when the cost is known and the insurer's position has hardened. The interaction between the insurance claim, the regulatory investigation and any third-party liability exposure requires careful management from the outset.

We advise on cyber insurance coverage including notifying insurers, formulating claims strategies and managing coverage disputes where policy terms are contested following a breach or ransomware event. Work also covers third-party liability exposures arising from cyber incidents: customer claims, contractual indemnities, class action exposure and regulatory penalties. We work closely with the Insurance and Risk practice on policy interpretation and claims management, and with the Arbitration, Litigation and Dispute Resolution and Class Actions practices where coverage or liability disputes require contested proceedings. Cyber insurance obligations are also addressed at transaction stage in technology procurement contracts, SaaS agreements and supply chain arrangements, where the allocation of cyber risk between parties determines coverage adequacy when an incident occurs.

Thomsons advises the world’s leading companies on cybersecurity and legal architecture for blockchain and digital asset systems, treating protocol design and cyber‑risk as a single compliance and operational problem. We design incident response and breach‑notification playbooks, key and wallet‑management policies, encryption and supply‑chain controls, and resilience measures that meet data‑protection, critical‑infrastructure and sectoral regulator expectations. We align token and product classification with sanctions / cross‑border data flows, and structure intellectual property (IP) rights, licence and liability allocations for smart contracts, node operators, custodians and protocol contributors. We stress‑test governance, disclosure and (when necessary) remediation pathways pre‑deployment to reduce regulatory and enforcement risk and to secure scalable market access.