Origin Energy executives argued against tougher new cybersecurity obligations earlier this year, labelling proposed changes to critical infrastructure rules “overly prescriptive” months before a major data breach that affected almost a million of its 4.8 million customers.
And while it’s not yet clear whether the breach was due to vulnerable systems, social engineering or a supply chain breach at a trusted third party, Origin recently pushed back against changes to critical infrastructure (CI) security requirements addressing these risks.
In June, authorities released updates to the Security of Critical Infrastructure (SOCI) Act’s Critical Infrastructure Risk Management Program (CIRMP), adding new requirements that Clayton Utz experts called “a material step-change in risk management.”
Yet with AI turbocharging cybersecurity attacks and tools like AI agents creating new headaches, Home Affairs last year floated CIRMP enhancements in a consultation paper that would force executives to improve cyber security, supply chain, personnel and other risks.
CIRMP mark 1, Home Affairs conceded, had “proven to be inadequate in repelling and preventing the compromise of critical infrastructure networks from state-sponsored and cyber-criminal threat actors.”
“Higher minimum standards are required for the most at-risk sectors to ensure that entities are resilient and adequately protected,” it said, with the new changes to be implemented from next year and CI operators expected to attain Maturity Level 2 by 30 June 2028.
Origin sought to water down risk management proposals
Even as Home Affairs pushed to tighten cybersecurity risk management, Origin’s submission on the changes warned proposed foreign ownership, supply chain and personnel measures are “disproportionate, overly prescriptive and would be difficult to implement in practice.”
Some measures “could delay projects and increase costs without delivering a commensurate reduction in risk to CI assets,” Origin group manager for regulatory policy Sarah-Jane Derby said, adding that “certain uplifts do not reflect risk-based approaches and could create unnecessary duplication.”
“Overly prescriptive requirements” such as network segregation requirements “could undermine essential operational functionality,” she said, calling for “exemptions for operating models that are standard across industry” and urging “flexibility in how the enhanced obligations are met.”
The Origin Energy breach affected almost a million current and former customers. Photo: Shutterstock
The CIRMP enhancements tighten cybersecurity rules in areas like supply chain risk – where the breach of a trusted third party lets criminals move laterally onto a company network – but Derby warned that poor information sharing across supply chains made such controls “impractical”.
“Origin recognises the value of forward-looking risk management, including planning for emerging technology hazards,” she wrote, but “overly stringent requirements could significantly constrain project delivery and competition.”
And while the company did support prioritisation of cybersecurity enhancements over other CIRMP changes, Derby proposed that companies be able to demonstrate compliance with the new rules “through existing frameworks and processes” rather than changing anything.
Regulators are tiring of watching CEOs apologise
The breach post-mortem is still in early days, but Origin’s efforts to dilute CI enhancements could be problematic as CEO Frank Calabria – who appeared unsettled while apologising last week and was rumoured to have paid the cybercriminal – oversees the investigation.
“Customers trust Origin with their information, and I apologise for the impact this may cause,” Calabria said, noting that Origin is contacting affected customers, offering support and set up a contact number and resources “to help manage our response to this incident.”
Calabria joins a conga line of CEOs – following Telstra CEO Vicki Brady and executives at firms like Partnered Health, AAS, Lifeline, 23andMe and Optus – stepping forward with public mea culpas as security and resilience shortcomings are laid bare and dissected in public.
Yet regulators are growing impatient with CEOs that continue to see cybersecurity as optional.
“Boards often struggle to connect cybersecurity investments to real business outcomes,” Gartner distinguished VP analyst Kristin Moyer recently said as a global survey found just 10 per cent of board members confident in the value of cybersecurity investments.
The Australian Institute of Company Directors updated cybersecurity guidance for boards in 2024, but such obligations have few teeth – as evidenced by OAIC’s recent decision to not fine Qantas despite its recent data breach affecting over 5 million Australians.
Looking for a more emphatic way to make its point, ASIC recently fined FIID Securities Limited $2.5 million for a breach of cybersecurity obligations that it now sees as a core risk that licensed Australian financial services (AFS) licence holders must manage.
Australia’s enhanced CIRMP rules are being mirrored elsewhere, with the Cyber Security Agency of Singapore (CSA) this month announcing updates to that country’s Cybersecurity Code of Practice (CCoP) for Critical Information Infrastructure (CII), last updated in 2022.
The new CCoP will force CII businesses to “strengthen board and senior management accountability and oversight for cybersecurity” by developing – and reviewing at least annually – a comprehensive cyber resilience framework.
Singapore’s Cybersecurity Act 2018 provides penalties of up to $110,000 (S$100,000) or two years’ imprisonment for breaches, while breaches of Australia’s SOCI Act can attract fines of up to $330,000 per day.
The new policy “marks a genuine shift in how critical infrastructure security will be governed in the region,” said Keeper Security APAC senior VP Takanori Nishiyama, and will “elevate cyber risk to the same level as financial and operational risk, where it has always belonged.”
“The reforms reflect the reality that modern attacks increasingly exploit organisational complexity rather than technical weaknesses,” he added.
“Those that treat compliance as an integrated operating model rather than an annual reporting exercise will be far better positioned to keep pace as regulatory expectations continue to evolve across the region."
