Proving Compliance
How to Prove Cyber Compliance in Australia: The Records That Show It Was Done
There is no single certificate that proves cyber compliance in Australia. You prove it with dated records: which obligations apply to you, who was responsible for each one, what was actually done, when it was last reviewed, and what was fixed when a problem turned up. For a business covered by the Privacy Act, that record is how you show you took reasonable steps. A policy shows what you meant to do. The record shows whether it happened.
Prove compliance with what?
“Cyber compliance” is not one law. Before you can prove anything you need to know which obligations you are being measured against, because the evidence follows from that.
The Privacy Act
For a business covered by the Act, APP 11 requires reasonable steps, including technical and organisational measures, to protect personal information, and the NDB scheme governs breaches. Many small businesses are exempt. Check whether it applies.
Sector rules
Some licences and sectors carry their own duties, such as the general obligations of AFS licensees or APRA’s prudential standards. These sit on top of the Privacy Act.
Contracts and insurance
Client contracts, government panels and cyber insurance proposals often set specific controls. For many small businesses these are the obligations that bite first.
Voluntary standards
The Essential Eight, SMB1001 and ISO 27001 are frameworks you choose or are asked to adopt. The Essential Eight is mandatory for non-corporate Commonwealth entities, not for private businesses. Compare them.
A policy shows what you intended. Evidence shows what happened.
Recent Privacy Act outcomes show what a regulator actually weighs. In October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million, the first civil penalty under the Act, including $4.2 million for failing to take reasonable steps under APP 11.1 and $1.6 million for how it assessed and reported its breach. In a 2025 determination against Vinomofo, the Privacy Commissioner pointed to failures in its policies and procedures, training and culture, and found it had known about weaknesses in its security governance at least two years before the breach. The question in both was what the business actually did, not what its documents said it would do.
Sources: OAIC, Australian Clinical Labs penalty (October 2025) · OAIC, Vinomofo determination (October 2025)
Shows what you intended
- A security or privacy policy
- A completed checklist or questionnaire answer
- An IT provider’s assurance that “it’s all set up”
- A one-off training session
- A compliance score with nothing underneath it
Shows what actually happened
- A dated system report showing the control was on
- Training completions by named person, matched to their role
- Review records with a date, a reviewer and an outcome
- Issues raised, assigned, fixed and closed, with dates
- Approvals and exceptions decided by someone with authority
Could you prove compliance if asked today?
Answer 10 questions to assess whether your business has the documentation and evidence to demonstrate reasonable steps.
How Prepared Is Your Business?
Businesses covered by the Privacy Act must take reasonable steps to protect personal information. This assessment helps you identify where your obligations may not be met and where your evidence may be insufficient.
Answer 10 questions to identify where your business may not be taking reasonable steps.
What evidence should a business keep for each control?
For most controls the useful record has three layers: what you decided, proof it operated, and proof someone checked it. The examples below are common practice, not a statutory list. Size them to the information you hold and the risks you face.
| Control | What you decided | Proof it operated | Proof it was checked |
|---|---|---|---|
| Access and MFA | Access policy, who approves admin rights | Exported MFA and admin account reports, dated | Periodic access review, leavers removed |
| Staff awareness | Who must complete what, by role | Completion records by person and date | Overdue staff followed up, content refreshed |
| Patching and vulnerabilities | Target timeframes by severity | Patch and scan reports | Exceptions approved, overdue items closed |
| Backups | What is backed up, how often, where | Backup job logs | Restore tests and their results |
| Suppliers | Which suppliers handle personal information | Contract terms, security answers received | Reassessment when the service or risk changes |
| Breach response | A response plan and who decides | Incident and assessment records | Post-incident review, plan updated |
| Retention and destruction | What you keep and for how long | Deletion or de-identification records | Check that old data actually went |
How often should cyber controls be reviewed?
No law currently sets a review frequency for businesses covered by the Privacy Act. The OAIC’s guidance says security controls should be reviewed and monitored regularly. An exposure draft released in August 2026, the Privacy Amendment (Personal Data Protection) Bill 2026, would go further: APP entities would have to “regularly evaluate the effectiveness” of their APP 11 compliance and be able to identify the personal information they hold. That is consultation material, not law, and it may change before any bill is introduced. The practical answer does not depend on it.
Sources: OAIC, Guide to securing personal information · Attorney-General’s Department, privacy reform consultation
On a schedule
Set a review date for each control and each register, scaled to risk. Higher-risk controls such as privileged access deserve closer attention than a low-risk register.
When something changes
A new system, a new supplier, a restructure, a staff departure with broad access, or a change in what personal information you collect.
After an incident
Every incident and near miss is a test result. Record what it showed and what you changed.
Where proof usually falls apart
Assembled after the event
Records gathered once a regulator or insurer asks are weaker than records made at the time, and often cannot be made at all.
Nobody owns it
A control without a named owner is a control nobody reviews. “IT handles that” is not an owner.
Gaps noted, never closed
An audit finding or risk entry with no fix and no date is evidence that you knew about a problem.
Keeping too much
Evidence files full of customer data create their own APP 11 problem. Keep the proof, not copies of the personal information.
Where Cleverer fits
Cleverer runs the organisational side of the record. Each safeguard has a named owner and a review date, evidence is attached with the date it was recorded, problems become issues with an owner until they are closed, and an evidence pack reports the current position alongside the dated records behind it. It does not configure or scan your systems, so the technical reports still come from your IT provider, and it does not decide whether you have met a legal obligation. See the audit evidence it produces.
Common questions about proving cyber compliance
Is there a cyber compliance certificate in Australia?
Not one that covers everything. SMB1001 and ISO 27001 can be certified by accredited bodies, and the Essential Eight has maturity levels but no certificate. None of them is the same thing as meeting the Privacy Act, which has no certification at all.
Is the Essential Eight mandatory for Australian businesses?
No. It is mandatory for non-corporate Commonwealth entities under the Protective Security Policy Framework. For private businesses it is recommended practice, though a client or insurer may require it by contract. In October 2026 ASD evolved it into the ASD Essentials series, which assesses whether controls keep working rather than whether they were deployed. That does not replace any requirement, contract or policy that names the Essential Eight or its maturity levels; those still apply as written.
Does a written policy count as evidence?
It counts as evidence of what you decided. On its own it says little about whether the policy was followed, which is usually the question being asked.
How long should we keep compliance records?
The Privacy Act does not set a period for compliance records. Many businesses keep them for at least as long as a claim or investigation could plausibly arise, and some contracts and sector rules set a minimum. Keep records of what was done; avoid keeping extra copies of personal information in them.
Can our IT provider’s report prove we are compliant?
It can prove the technical controls it covers were in place on the date of the report. It cannot show who in the business was accountable, whether staff were trained, or whether the organisational measures APP 11.3 refers to were in place.
Be ready to prove it.
The record that answers a regulator, an insurer or a client is the one you build as the work happens: owners, reviews, evidence and fixes, each with a date.
General information only. This page is not legal advice.
