COMPANY DIRECTORS:
Cyber Security Is Now Your Personal Responsibility. If There's a Breach, The Liability's Yours.
Cyber security stopped being purely an IT problem the moment regulators and courts started treating it as a director's personal responsibility.
If you sit on an Australian board, or run the business as its director, that already applies to you, whether anyone has ever mentioned it or not.
You don’t need to be a cyber-security expert. But as a director, you do need to ask the right questions, and our instant assessment is the quickest way to start. Answer 12 quick questions and a FREE, personalised risk report lands in your inbox within minutes, showing in plain English where your likely gaps sit. It’s a starting point rather than a full audit, but it tells you where a closer look is warranted.
Cyber security stopped being purely an IT problem the moment regulators and courts started treating it as a director's personal responsibility.
If you sit on an Australian board, or run the business as its director, that already applies to you, whether anyone has ever mentioned it or not.
You don’t need to be a cyber-security expert. But as a director, you do need to ask the right questions, and our instant assessment is the quickest way to start. Answer 12 quick questions and a FREE, personalised risk report lands in your inbox within minutes, showing in plain English where your likely gaps sit. It’s a starting point rather than a full audit, but it tells you where a closer look is warranted.
Three Things That Decide Whether This Becomes Your Problem
1.
The penalty is personal, and the Corporations Act bars your company from paying it. Breach your duty of care and the maximum civil penalty can run past $1.8 million, out of your own pocket.
In the worst cases a court can disqualify you from managing any company in Australia, not just this one, and your name goes on a public register anyone can search.
2.
The duty already exists, and it doesn’t care how technical you are. Section 180 of the Corporations Act holds you to a reasonable director’s standard on foreseeable risks, and cyber risk is now exactly that.
The test is what a reasonable director would do, not what you understand about technology, and it covers two-director companies and ASX boards alike.
3.
Being told isn’t the same as being able to prove it. After a breach, regulators investigating your business ask what you did beforehand, not just what happened. “I.T.’s got it covered” isn’t evidence you can hand over. A documented review is.
Not sure how you’d answer any of these? Our instant assessment is the quickest way to find out where you stand. It’s the starting point, and the documented review you can point to comes next, with Winbasic examining your systems directly.
A Breach Can Cost You More Than the Attack Itself
1.
Your insurance might not pay out. When your business applied for cover, it declared what security controls were running: backups, multi-factor authentication, patching. If those weren't actually being maintained when you were hit, insurers can reduce, delay or deny the claim entirely, on a breach that now costs Australian businesses an average of $4.22 million.
2.
You probably wouldn't know if you'd already been breached. Australian businesses that take longer than 200 days to identify and contain a breach pay $5.17 million on average, against $3.26 million for those who catch it sooner. The Australian Signals Directorate now tells boards to assume compromise and focus protection on the systems that would stop the business dead if lost.
3.
Telling your customers isn't optional. Australian organisations sent 1,205 mandatory breach notifications in 2025, the highest number since reporting began, with close to 60% caused by deliberate attacks rather than accidents. Failing to notify properly is a separate breach of the Privacy Act, with its own investigation on top of the incident itself.
Two of these are among the 12 questions in our instant assessment: whether your insurance really covers what you think it does, and whether you’d meet your Privacy Act obligations if customer data was breached. Answer them now and your report is in your inbox within minutes.
What An Assessment Actually Tells You
The questions cover four areas: logins and identities, devices and cloud apps, data and backups, and exposure and insurance. Your risk score and report give you a clear first picture of where you stand against what regulators will want to see.
From there, you can talk the results through with us in a free 30-minute IT review, with no obligation. And when you’re ready to turn that picture into the documented evidence regulators actually ask for, a detailed Winbasic review is the next step. Our team examines your systems directly, measures them against a recognised standard like the ASD Essentials and gives you documented findings you can point to.
Ready to Secure Your Business?
It’s far better that you find the gaps before someone else does, and better still with a team that has provided cyber security and managed IT services to Australian businesses since 1996.
Winbasic has personnel who hold Australian Government security clearances, enabling us to support Defence and other security-sensitive environments where appropriately authorised.
We work as a strategic partner rather than a break-fix helpdesk, which means direct access to the people actually managing your systems instead of a ticket queue. Start with the instant assessment or simply give us a call.
Call 07 3385 0888
Questions Directors Ask
Is this only relevant to large or listed companies?
No. Directors' duties under the Corporations Act apply regardless of company size, including single and two-director companies with no formal board. You don't need board meetings for the duty to apply. A documented decision you've made and signed is enough to show you took it seriously.
Does this apply to me if I’m a non-executive director, CEO or CFO?
Yes. Non-executive directors owe the same core duties as executive directors, and the Section 180 duty of care also reaches senior executives such as a CEO, CFO, company secretary or general counsel who make or take part in decisions affecting the whole or a substantial part of the business.
Your title doesn’t decide it. Someone who acts as a director, or whose instructions the board usually follows, can be treated as one.
Can I rely on our IT provider to have this covered?
Only if you’ve checked. The Corporations Act lets directors rely on expert advice, but it only treats that reliance as reasonable if you act in good faith and make your own independent assessment of what you’ve been told. Accepting “IT’s got it covered” at face value, with nothing to back it up, doesn’t earn you that protection.