UA is the peak body for Australia’s 39 comprehensive universities, each with a strong interest in the enhancement of cyber security protection in Australia. Many of our members have expertise in cyber security, having contributed to the 2023-2030 Australian Cyber Security Strategy consultation.

Australian universities are highly engaged with the issue of cyber security, providing inputs into, and sharing best practices on cyber security with, forums  including the University Foreign Interference Taskforce (UFIT), the Council of Australasian University Directors of Information Technology (CAUDIT), the  Australasian Higher Education Cybersecurity Service (AHECS), the Trusted Information Sharing Network (TISN) and the Enhancing Cyber Security Across Australia’s University Sector Project delivered by RMIT. This has led to a significant increase in awareness and responsiveness to cyber security issues across the sector, and a maturation of threat modelling, policies, procedures, and governance within our universities.

Many of our members are responsible for critical infrastructure assets under the Security of Critical Infrastructure Act 2018 (SOCI Act). Continued engagement within the sector and with government has ensured that obligations under the SOCI Act have been comprehensively met, although there are areas of this  legislation that lack definitional and operation clarity.

UA is broadly supportive of the legislative package but has some concerns around increased reporting obligations and duplicative requirements for  universities. The key points presented below are provided to the Committee to detail the impact the additions to the legislative framework surrounding cyber security will have on universities from a regulatory burden perspective, as well as suggesting additional enhancements that we believe will strengthen the framework.