Blog

CyberHQ® by Avertro supports the AICD CSCRC

ian-yip — Fri, 03 Jul 2026 01:10:37 GMT

The Australian Institute of Company Directors (AICD) and Australian Cyber Security Cooperative Research Centre (CSCRC) released their Cyber Security Governance Principles on Friday. While there are a few minor errors, it is by and large a good document for directors to be across.

When a new set of principles or guidelines gets released, it doesn't take long before governance and risk professionals start asking how it can be reflected in reports or as a framework.

We believe we are the first cyber SaaS platform globally to support it.

The challenge typically in these matters is when it's not intended to be an actual framework to measure maturity or compliance, it doesn't get structured that way. Meaning it's not a straightforward transfer of what we see in the released document to something that can be used operationally.

Fortunately, loading new frameworks, guidelines, or standards into Avertro CyberHQ® is easy. Our team spent time analysing the AICD CSGP (is that what we're calling it for short?) and have turned it into a framework that assessments can be performed against, and that reports can be generated from. And we did it in a matter of hours.

We expect boards and executives in Australia will start asking their cybersecurity leaders how they fare against the AICD CSGP. And security teams will have to produce performance metrics and reports accordingly.

If you'd like the Excel file to use, follow us on LinkedIn and we will announce the link shortly.

If you are an Avertro customer, it will be available in your environment for use very shortly.

Want to find our more about CyberHQ®? Book a demo today.

Navigating the SEC Cybersecurity Rules: A Guide for Public Companies

community@avertro.com (Avertro) — Fri, 03 Jul 2026 00:47:06 GMT

The U.S. Securities and Exchange Commission (SEC) Cybersecurity Rules mark a significant step forward in reinforcing the need for good cyber governance for public companies. These rules underscore the importance of cybersecurity in the regulatory landscape, aiming to safeguard investor interests, enhance market integrity, and foster a culture of transparency and accountability in the face of evolving cyber threats.

Disclosure of Material Cybersecurity Incidents

At the heart of the SEC Cybersecurity Rules is the provision for the "Disclosure of Material Cybersecurity Incidents." This rule mandates that public companies promptly report significant cybersecurity incidents within four business days of their discovery. A cybersecurity incident is deemed significant if it is reasonably expected to have a substantial impact on the company's operations, financial condition, or investor interests. The disclosure must detail the nature, scope, timing, and potential or actual material impacts of the incident on the company's operations. This requirement not only ensures that investors are well-informed about potential risks but also emphasizes the need for companies to maintain robust incident detection and management capabilities.

Annual Reporting on Cybersecurity Risk Management and Strategy

Another cornerstone of the SEC Cybersecurity Rules is the "Annual Reporting on Cybersecurity Risk Management and Strategy." Public companies are now required to submit detailed reports on their cybersecurity risk management practices and strategies annually. These reports should cover the policies and procedures in place to identify, assess, and manage cybersecurity threats, alongside the role of management and the board of directors in overseeing these risks. This initiative aims to provide a comprehensive overview of a company's commitment to cybersecurity, highlighting its preparedness to tackle cyber threats and incidents effectively.

Board Oversight and Management's Role

The SEC rules also emphasize the "Board Oversight and Management's Role" in cybersecurity, highlighting the imperative role of corporate governance in managing cyber risks. Companies must disclose how their boards of directors oversee cybersecurity risks and detail the specific roles and expertise of management in identifying, assessing, and managing these risks. This approach places cybersecurity as a core aspect of business risk management, requiring strategic decision-making at the highest levels of the organization.

Impact Beyond Public Companies

Interestingly, the reach of the SEC Cybersecurity Rules extends beyond public companies, affecting private entities that are vendors or service providers to public firms. Although these private companies are not directly regulated by the SEC rules, they face indirect pressure to elevate their cybersecurity standards to meet the compliance and partnership requirements of their public counterparts. This ripple effect underscores the broader impact of the regulations, driving up cybersecurity standards across the business ecosystem.

How Avertro Can Help Companies Comply With The New Rules

The SEC Cybersecurity Rules represent a pivotal shift in the regulatory landscape, setting a new benchmark for cybersecurity governance, transparency, and accountability. By mandating timely disclosure of material cybersecurity incidents, enforcing annual reporting on cybersecurity risk management, and emphasizing the critical role of board oversight and management, these rules aim to protect investors, enhance market stability, and promote a proactive cybersecurity posture among public companies and their private partners. As businesses navigate the complexities of these regulations, the overarching goal remains clear: to foster a secure, resilient, and trustworthy digital marketplace for all stakeholders.

In addressing the technology gap that exists in complying with the SEC Cybersecurity Rules, Avertro offers a comprehensive solution designed to streamline the process for companies navigating these new requirements. Avertro's cyber governance platform enhances the ability of companies to conduct thorough annual risk management and strategy reporting. By integrating cutting-edge technology, Avertro provides a centralized hub for cybersecurity risk assessment, risk management, and compliance documentation. This enables companies to not only meet the stringent SEC regulations effectively but also to elevate their overall cybersecurity posture through improved visibility, control, and strategic decision-making. Avertro stands as a pivotal tool for companies aiming to bridge the gap between their current cybersecurity capabilities and the robust standards mandated by the SEC, ensuring that compliance is not just achieved but optimized for ongoing resilience and investor confidence.

The Compliance Bottleneck: How Static Processes Undermine Strategic Security

community@avertro.com (Avertro) — Thu, 02 Jul 2026 23:17:23 GMT

As regulatory expectations increase and threat environments evolve, compliance continues to play a central role in how organisations manage risk. But while the frameworks and obligations have matured, many of the processes used to manage them haven’t kept pace.

Spreadsheets, Siloed systems, & Periodic reporting cycles

These long-standing practices often create an invisible bottleneck, slowing down decision-making, limiting visibility, and placing added strain on security and risk teams already under pressure to do more with less.

It’s not a failure of strategy. It’s a sign that the way compliance is managed must evolve.

Disconnected Compliance Date, Disconnected Insight

For many organisations, compliance remains a retrospective activity, checked off quarterly or annually in response to external requirements. But today’s landscape demands more. Threats move quickly. Expectations shift rapidly. Static processes weren’t designed for this pace.

Static compliance data, manually pulled, infrequently updated, and disconnected from live systems, doesn’t reflect current risk. It shows what was true weeks or even months ago. In practice, this means teams are left reacting to problems without a current view of their environment.

This lack of real-time visibility carries real consequences:

Delayed decisions due to fragmented or incomplete information

Increased audit fatigue and reporting overhead
Missed opportunities to prioritise the controls that matter most
Reduced confidence at the board and executive level

What was once a necessary administrative function is now creating blind spots and constraining agility across the organisation.

Without timely, centralised compliance data, leaders lack the clarity needed to quantify risk, track effectiveness, or demonstrate the business value of controls. This makes it harder to build investment cases, prioritise initiatives, or deliver credible, forward-looking reports to the board.

In short, what should be a source of insight becomes a source of uncertainty, slowing momentum at the very moment organisations need to move decisively.

From Compliance Overhead to Strategic Alignment

More organisations are recognising the need to shift from reactive compliance to a model that informs broader risk and business decisions. This shift is at the heart of what’s becoming known as Informed Cyber GRC, a more dynamic, intelligence-led approach that positions compliance as a source of continuous insight, not just retrospective reporting.

By embedding compliance into a real-time, integrated GRC approach, security and risk leaders gain:

Stronger visibility into the status of obligations, controls, and risk
Greater alignment with business priorities and board expectations
Improved efficiency in audit preparation and reporting cycles
Actionable insight that links compliance to performance and resilience

The result isn’t just better reporting, it’s smarter decision-making, supported by timely, trustworthy data the business can act on.

Key Considerations for GRC and Security Leaders

For organisations looking to move beyond reactive, checklist-driven compliance, the path forward starts with automation. Establishing automated compliance processes lays the foundation for better visibility, stronger alignment, and more informed decision-making.

Here are four key considerations to guide that journey:

1. Start by automating the fundamentals

Manual workflows, duplicated effort, and reporting delays are often the clearest signs of a process ready for change. Automating evidence collection, control tracking, and regulatory mapping is the first step in unlocking more efficient, scalable compliance.

2. Replace static reports with real-time visibility

Once automation is in place, live dashboards and automated updates provide a more accurate picture of current compliance posture, improving responsiveness and reducing reporting overhead.

3. Connect compliance with business context

As data becomes more dynamic, translate compliance obligations into operational and financial impact. This helps align GRC activity with business goals and supports more effective communication with executive stakeholders.

4. Build toward continuous improvement

Modern GRC is iterative. With automation and visibility in place, your organisation can evolve toward a more responsive, risk-informed model, one that adapts in real time and supports long-term resilience.

Moving from Reactive to Informed Cyber GRC

As businesses work to improve resilience, increase transparency, and operate at speed, static compliance practices can quietly hold them back. Modernising these systems isn’t just a technology upgrade, it’s a strategic shift.

One that turns compliance from an overhead into an enabler.

That’s where CyberHQ comes in.

Schedule a meeting to explore how CyberHQ can help you move beyond static compliance and unlock a more informed approach to risk