< Case Studies SES Encrypts and Audits Global Client Data Decad es of experience helping Asia-Pacific customers have established Generic Systems Australia as our region’s local experts in secure managed file transfer. In this case study, we share how global experts in operational resilience – SES – take advantage of GoAnywhere MFT , the world’s leading MFT solution , to manage the transfer of more than 2,000 files daily. Software escrow agreements are becoming increasingly common for organisations worldwide. Medium and large enterprises, especially those in retail, energy, and financing, rely on these agreements to provide coverage for the unique source code, files, and other software assets critical to a company’s intellectual property. To prevent loss of this information during sudden downtime, a data breach, or natural disaster, organisations create a software escrow agreement with a third-party vendor to protect and back up their data. The third party then takes the data, creates an inventory of everything that’s to be escrowed, and puts the source code and other assets into a vault for maximum protection. SES is a third-party vendor that provides software escrow agreements, intellectual property protection, and cybersecurity risk management globally. Based in Manchester, UK, SES has more than twenty years of experience providing security to more than 2,500 professionals in 40+ countries. "Dealing with software escrow agreements is our bread and butter," said Tom Sweet, Information Security and Systems Manager at SES. It’s an area of constant growth and adjusting to keep clients happy and source code regularly updated. We are continually developing and innovating.” Often, SES does this with tools such as GoAnywhere MFT. For SES, GoAnywhere Managed File Transfer (MFT) has been a well-used and finely-tuned addition to its cybersecurity solutions. With the software in place, it performs on average nearly 2,000 uploads for clients per day — a mix of small and large files — as well as help monthly and quarterly businesses with their source code deposits. Switched from Manual File Transfers to Managed File Transfer Before GoAnywhere came into the picture, SES used a web gateway, an AWS-backed instance, to receive source code for its clients. It also occasionally used old-fashioned file transfer methods: physical disks and SD cards that were tracked, signed for, and had a direct chain of custody which could be followed. While this mixed process — AWS-backed instance and physical mail — worked at the time, it still lacked the ability to track user and file transfer activity. Having an audit trail was important to the business. When auditing also became a client requirement, SES looked for a way to streamline, structure, encrypt, and audit the exchange of data. SES handled a high volume of file transfers and needed robust security practices for the data it processed and stored every week. So the it was time to find a centralised solution which could do all of this and meet its trading partners’ needs. The tracked-and-signed file transfer processes SES used led to an evaluation of GoAnywhere MFT, a robust and fast-growing product which used similar techniques (tracking, signing, and a clear chain of custody) for sensitive file transfers. GoAnywhere was a hit. It took Tom Sweet mere days to learn the product. He attended two webinars, then jumped in and followed his intuition. The turnaround had to be quick, but the learning curve was straightforward. SES implemented GoAnywhere across its Linux systems and has depended on it ever since for day-to-day file transfers, streamlined encryption, and consistent auditing. Benefit#1: File Encryption and Security With GoAnywhere fully implemented, SES has been able to ensure all file transfers sent by its clients are encrypted in transit and sent to the right place. SES has also ensured that encryption keys are held separately. These are just two of the strict requirements SES needs to follow for its clients in order to stand out in a sea of escrow and backup service platforms. "It’s risk versus security," Tom said. "With HR and payroll data, the risk is high, so the security needs to be high as well."nearly 2,000 uploads for clients per day — a mix of small and large files — as well as help monthly and quarterly businesses with their source code deposits. Benefit#2: Fast File Transfer & Trading Partner Setup New trading partners and file transfer users can be set up in minutes. "Less than that if I’m rushed," Tom said. "The quickest ones we’ve had people test: I’ve sent the email saying here’s your username, sent the password out over SMS, and people test the log-in within 10 minutes." Sweet uses private and public keys to ensure the encryption and validity of the new transfers he creates. When the file transfers are executed, most run, start to finish, in less than 30 minutes. Benefit #3: Ease of Use & Automation "The main thing we use GoAnywhere for is managing users, auditing the logs, and giving users a secure gateway into our systems that would normally be firewalled," Tom, said. All of this is simple with GoAnywhere, and he believes the product’s biggest strength is its ease of use. Whether he needs to streamline, update, or re-deploy the product across systems and users, the process has been painless. Automation is another huge benefit of GoAnywhere. SES use GoAnywhere to do the heavy lifting for SaaS-based clients. These clients transfer large amounts of source code end data that are pushed into a SaaS escrow and captured in real time. "We help these clients configure a script that connects over SFTP to a GoAnywhere service," Tom said. "GoAnywhere then audits those transfers." The product securely transfers and audits at the same time, all automatically for nearly 60 clients who need their source code updated on a daily or monthly frequency. This enables SES to automate on Windows and Linux to meet the security requirements of each client. GoAnywhere’s granular security controls enabled Sweet to make GoAnywhere as safe and security-driven as possible against internal risks and user errors. "I stripped it back to who can do what," he said. Previously shared passwords were locked down. Web users were restricted to only the areas of the product they needed, and file storage was controlled — files could only be stored in the right areas of the network. "If someone in a company wanted access to the transfers, or to the systems, they could break the loop to that cycle. So that’s why we vault [client data] and back it up in an encrypted format. We make sure the file transfers are encrypted; that’s key too." Benefit#4: Regulation Compliance Many SES clients have compliance requirements which SES must meet. To achieve these needs, SES has applied ISO 27001 compliance across all clients to ensure all information sent between SES and other companies is secure. "ISO 27001 mandates that we create policies, processes, and procedures which we can prove using evidence-based systems," Tom said. "This says, ‘Okay, by default, you [the client] get all of this [security]. All files will be encrypted, and all second factor messages will be sent out-of-band so they aren’t sent over the same method of communication, and so on." Meanwhile, while encryption is the same and applied for everyone, clients can choose if they want to use multi-factor authentication (MFA) with passwords or SSH keys for an extra layer of security. GoAnywhere offers multi-factor authentication methods, including keys and certificates, for increased file protection. SES also uses GoAnywhere to encrypt every backup of escrow data that is then kept in offline vaults. "This ensures there’s 99.9% availability," Tom said. "No one thinks escrow is important until it’s too late," he added, so SES provides these offline backups with GoAnywhere’s help to give organisations peace of mind. Benefit#5: Auditing and Administration One of the biggest justifications for purchasing GoAnywhere was its auditing functionality. Tom and his team uses these audit logs to see who is connecting to their SFTP servers, what they’re doing on those servers, and how much they’ve done. This level of detail is critical, especially when dealing with sensitive escrow documents, software assets, and source code. "The log-in and auditing process in GoAnywhere is important for our information security standards. We audit the transfers not just to be able to take them securely, but also to prove who has been on and transferred what and when. The audit trail is important." If Sweet needs to change something, GoAnywhere makes it easy. Admins can make modifications or adjustments to their processes to keep constant with security requirements. "We can do this with GoAnywhere very easily," he said. "Then we just send out a new host key to our clients." What’s Next: Remote Agents and Advanced Workflows Right now, SES retrieves files from clients. But in the near future, it hopes to roll out GoAnywhere Remote Agents and GoAnywhere Advanced Workflows for customers who want zero involvement in the file transfer process. With these features enabled, Sweet and his team will be able to pull data from each client when needed without requiring manual work or engagement on their end. "Remote agents and advanced workflows will enable us to go out, talk to, and pull the requests for daily, weekly, or monthly file transfers," Tom explained. One Admin, One Product Tom Sweet has used GoAnywhere for four years. As the main product administrator, he’s always looking for new ways to implement the software, integrate it with other web and cloud services, roll it out as part of security-client processes, and improve the success of GoAnywhere at SES. "I want to get as much out of the product as I can," Tom said, reflecting on being the singular admin for GoAnywhere. "The more I push it out, the more we get a better return from our customer experience." And for any organisation — SES included — customer satisfaction is top priority. GoAnywhere’s encryption, automation, and ease of use help make that happen. Previous Next

< News Info Stealer Supply Chain Exposed 23 Oct 2025 The Australian Signals Directorate has demonstrated how Information Stealer malware is simplifying data theft for even “entry level” cybercriminals. This malicious software is designed to infect a device, collect as much valuable data as possible, and deliver it directly to cybercriminals. It’s commonly distributed through SMS or email phishing, online advertisements containing malicious links and downloads containing hidden malicious code. The malware extracts data such as usernames and passwords, credit card details, cryptocurrency wallets, local files and browser data including cookies, user history and autofill details. Malware-as-a-Service providers offer info stealers to entry-level cybercriminals, enabling them to easily collect stolen data which can be used down the cybercrime supply chain to extort organisations and individuals. At Generic Systems Australia, we have many years of experience helping organisations thwart cyber criminals through cutting-edge Managed File Transfer solutions and secure email gateways. Get in touch if you’d like an obligation-free discussion about how we could potentially help your organisation. Previous Next

< News Users Declare GoAnywhere “Best MFT” 23 Feb 2026 Software buyers on G2 - the world’s largest and most trusted software marketplace – have declared GoAnywhere MFT to be the best Managed File Transfer software in the IT Infrastructure category. Reviewers lauded GoAnywhere’s “seamless and secure file transfers”, saying its automation capabilities made it “perfect for enterprises” and “effortless”. See the full list of infrastructure category winners here and get in touch if you’d like to tap into the deep experience and expertise we provide on GoAnywhere to Australian and New Zealand businesses. Previous Next

< News Think Cyber Insurance is “Protection Enough”? Think again! 8 Oct 2025 Paying a cyber security insurance premium is no substitute for taking measures to thwart cyber thieves. Almost half of cyber insurance claims are being denied. As cyber breaches have become more common, insurers have become more stringent in their underwriting and assessment practices. Insurers facing payouts are carefully scrutinising claimants’ cyber security practices. If they conclude a company failed to take reasonable precautions to mitigate their cyber risks, they’re denying the claim. No Guarantee Cyber insurance is a critical safety net for a modern organisation. But it’s not a guarantee. A staggering 44% of cyber insurance claims are denied, often due to overlooked policy requirements or inadequate cybersecurity practices. To ensure your claim is honoured in the event of a breach, organisations must proactively ensure their security posture meets their insurer’s expectations. Why Claims Fail Astra Security reports that 27% of data breach claims and 24% of first-party claims are denied due to exclusions in the insurance package. These exclusions often stem from outdated security models, misconfigurations, or failure to meet minimum protection standards. Moreover, 60% of claims involve Business Email Compromise (BEC) or Funds Transfer Fraud (FTF) — two attack vectors that insurers scrutinise particularly heavily. Ransomware, though less frequent, remains on average the costliest type of attack. If your organisation lacks robust defences against these threats, your insurer may argue that you failed to uphold your end of the coverage agreement. How to Ensure a Claim Isn’t Denied 1. Treat Data Transfers Like Cash Transfers Data — like cash — is a high value asset vulnerable to theft, loss, and misuse. Treating data transfers with the same rigor as cash helps ensure accountability, security, and compliance. In today’s digital economy, customer records, intellectual property, financial details, and operational insights are all assets that drive business decisions and revenue. Just as companies protect cash transfers with encryption, audit trails, and multi-party verification, data transfers should be governed by similarly strict protocols. The Australian Cyber Security Centre (ACSC) emphasises that users must be held accountable for all data transfers they perform, especially when moving sensitive or classified information between systems. This mirrors financial accountability, where every dollar moved is tracked, verified, and reconciled 2. Implement and Maintain Strong Cybersecurity Controls Insurers expect you to uphold basic security hygiene. This usually includes: · firewalls and endpoint protection, · Multi Factor Authentication MFA, · up-to-date patching, · incident response plans, · periodic vulnerability assessments, and · employee training on phishing and social engineering. One particular technology — Managed File Transfer (MFT) — can help you embed technical and process protections across your organisation in one fell swoop. MFT provides end-to-end encryption, role-based access controls, built-in audit trails, detailed reporting, automated alerts and notifications, centralised visibility and seamless scaling across both cloud and on-premises systems. 3. Understand Your Policy Details Read the fine print of your insurance policy. Know what’s covered, what’s excluded, and exactly what security standards and regimes you’re expected to maintain. 4. Document Everything Keep detailed records of your cybersecurity efforts. This includes security audits and penetration tests, software update logs, employee training sessions and incident response drills. Documentation is your best legal defence if a claim is challenged. It proves you took reasonable steps to mitigate risk. 5. Stay Ahead of Threats Cyber threats evolve rapidly. Insurers are increasingly using AI to assess risk, and attackers are doing the same. Regularly update your risk models and consider continuous penetration testing to identify and patch vulnerabilities before they’re exploited. 6. Get Local Expert Help Cyber insurance is not a substitute for cyber security — it’s a complement. And, as the old maxim states: “an ounce of prevention is worth a pound of cure”. At Generic Systems Australia we have decades of experience helping Australian and New Zealand organisations bolster their cyber defences through deployment of the world’s leading MFT solution, GoAnywhere . Our Migration Service makes the transition even easier for organisations who want to supplement their IT team with local expertise. We can even write custom Cloud Connectors to extend GoAnywhere’s ability to interface seamlessly with less common cloud platforms. If you’d like a no-cost, no-obligation discussion about how we could help you simply and affordably adopt an advanced MFT solution, please feel welcome to get in touch with me. At Generic Systems Australia, we’re your local experts in Secure Managed File Transfer. Previous Next

< News GoAnywhere Version 7.8.0 Released 5 May 2025 Great news for those using the world's most advanced Managed File Transfer solution. GoAnywhere MFT 7.8.0, GoAnywhere Agents 2.4.0 and GoAnywhere Gateway 3.3.0 have just been released. These new versions feature many useful updates including handling of Azure Storage, security updates, component updates, and much more. Head over to your client portal to see the Release Notes. For GoAnywhere MFT check out the release notes for 7.7.0, 7.7.1 and 7.8.0. Previous Next

< News Switch to a PROACTIVE MFT 15 Oct 2026 Blocking cyber criminals before they gain access to your IT systems requires your cyber security solution to have access to, and pre-emptively act upon, the very latest intel on threats. It needs an early warning system. If your Managed File Transfer (MFT) solution is only reacting to breaches - instead of preventing them - then it’s high time to consider switching to a proactive MFT solution, such as GoAnywhere MFT . Six Reasons to Switch Traditional threat intelligence is reactive against cyberthreats rather than proactive. While Brute Force and Denial of Service (DoS) attacks can be detected automatically, that’s only after your systems have come under attack. A vulnerability discovered by a cybercriminal in one business system can be quickly replicated across other businesses’ systems in a wave of copycat attacks. Some attacks may only be detectable through (all-too-infrequent) manual inspection of activity logs. New and previously unknown vulnerabilities can lead to Zero Day incidents, if cyber security solutions don’t continually check for bad IP addresses. Cybercriminals systematically probe MFT service endpoints to evade automatic IP blocking. An Example A manufacturing plant with multiple MFT deployments was concerned about rising cyberthreats and the potential for their systems to be compromised.  While they were confident in their MFT solution’s ability to protect sensitive data while in transit and in motion, their system didn’t pre-emptively detect bad actors or threats before they entered their MFT environment. While they could add trusted IPs to their “allowed” list, that created a future level of risk. What if that IP address was subsequently compromised…? Thinking Ahead GoAnywhere MFT, the world’s most fully-featured MFT, offers a unique proactive threat intelligence advantage over other lesser solutions, mitigating the risk of persistent IP address trust. By simply turning on the feature in the latest version of GoAnywhere, organisations can leverage the dynamic intelligence database of Fortra’s Threat Brain. This “brain” is comprised of data and indicators from Fortra’s deep portfolio of cybersecurity solutions. It provides a forward-leaning approach to cybersecurity threats, blocking IPs with bad reputations or malicious intent before they enter the MFT environment. When activated within GoAnywhere, Threat Brain pre-emptively blocks bad actors across all attack vectors, continually checking trustworthiness with each new session. Proactive Security Benefits for MFT As a built-in module, Fortra’s dynamic cybersecurity intelligence database benefits GoAnywhere customers by: Consistent re-verification : An IP's reputation is re-checked with every session to ensure it remains safe”. Other MFT products don’t offer this ongoing monitoring of IP addresses once they are white-listed. Comprehensive threat intelligence data sources : Threats detected in one of Fortra’s many security solutions is shared with the Threat Brain, increasing the overall intelligence data available to GoAnywhere MFT. Layered protection : Combined with Threat Protection and Zero Trust File Transfer, GoAnywhere provides unmatched options to safeguard data throughout the entire data lifecycle. Stay A Step Ahead of Cyber Crims Blocking the door to your MFT environment can be as easy as enabling the Threat Brain module in GoAnywhere and determining which level of security you require to meet your organisation’s security mandates or compliance requirements. If you’d like help tapping GoAnywhere’s proactive capabilities for your organisation, please feel welcome to contact me . I’m always happy to have an obligation-free discussion, demonstrate GoAnywhere’s capabilities, and even offer you a zero-cost Proof of Concept. At Generic Systems Australia , we’re your local experts in secure Managed File Transfer. Previous Next

< News Ad-Hoc Filesharing Services Add Risk 27 May 2025 Make no mistake - unintentional errors by employees and supply chain partners are a leading cause of data breaches. The uncontrolled use of ad-hoc file sharing services (e.g. WeTransfer, Dropbox, Google Workspace, Cerberus FTP Server, and ShareFile) significantly increases the risk of employees making mistakes and for those mistakes to go unnoticed. Here then are seven reasons why organisations should reconsider their use of ad-hoc cloud file sharing services. 1. They may not enforce automatic file encryption. A key means of preventing your data falling into the wrong hands is to ensure it’s always encrypted, both in transit, as well as when it’s being stored. A secure Managed File Transfer (MFT) solution can automatically encrypt your data. 2. Dubious key and certificate management. Beyond encryption of the file being transferred, some cloud applications leave files open to malicious intent by failing to maintain strong keys and certificates. 3. They may create compliance gaps. Not all cloud platforms meet regulatory requirements around file transfers, leaving your organisation liable for financial, legal, and reputational damages. 4. Limited data control. Unsupervised file sharing and collaboration can lead to files being sent to or accessed by unauthorised individuals. With many cloud-based solutions, once files are transferred, there’s no ongoing control over their use. A secure MFT provides ongoing safeguards with tight controls on who can access, edit, and transfer files, and for how long. 5. No workflow automation. MFT solutions such as GoAnywhere MFT simplify and automate file transfer processes, with multi-step workflows to execute repetitive, manual tasks. "Projects" can be easily created by dragging and dropping modules which define business processes to seamlessly transfer files, eliminating the need for complicated scripting or programming. For example: a Project can be created to retrieve encrypted data from a server, decrypt it, read file contents and submit them to a downstream internal application. The file can also be altered, added to, re-encrypted, and then sent to another external SFTP server. 6. Lack of centralised user management. Cloud file sharing solutions may not provide a comprehensive and easy to use dashboard for administrators to control access, authentication, and encryption of sensitive files. The more tools and applications that must be coordinated, the greater the risk of human or systems error. A robust MFT solution manages all types of file-send situations, including ad-hoc emails, large files, and batch files. 7. Threat detection and management. Protecting your organisation from viruses, malware, ransomware, Advanced Persistent Threats, and banned media types requires constant vigilance. Our Advanced Threat Protection can automatically block these threats and remove the element of human error from your risk profile. Local Expertise Available If you’d like to discuss removing the risk of ad-hoc file sharing applications from your organisation, please feel welcome to contact me . I’m always happy to have an obligation-free discussion, demonstrate the capabilities of the world’s most advanced MFT, and even offer you a zero-cost Proof of Concept. At Generic Systems Australia , we’re your local experts in secure Managed File Transfer. Previous Next

< News One File After Another 19 Mar 2026 “One Battle After Another” may have won Best Picture at the 2026 Oscars, but winning being judged Best for seven years in a row is on a whole new level! GoAnywhere MFT has won G2’s Best Managed File Transfer software accolade for seven consecutive years. While The Academy loves a good drama, your IT team can do without. Present them with GoAnywhere MFT and your files will be transferred automatically, reliably, securely – and peacefully. Previous Next

< News How GoAnywhere integrates with your Hybrid Cloud 2 Oct 2025 Recent research by IMARC Group and Forrester shows Australian organisations increasingly using Hybrid Cloud as a strategic bridge between legacy systems and modern cloud-native applications. Hybrid Cloud enables them to modernise without abandoning critical infrastructure. By integrating on-premises environments with public cloud platforms, businesses can maintain control over sensitive or complex legacy workloads while gradually introducing scalable, agile cloud-native services. This duality enables seamless data flow, API-driven interoperability, and phased migration strategies—essential for industries bound by compliance or technical debt. GoAnywhere MFT — the world’s leading Managed File Transfer solution — facilitates businesses on this path by offering “ Cloud Connectors ” that seamlessly integrate GoAnywhere with external cloud services. Also referred to as “cloud integrations”, Cloud Connectors offer out-of-the-box connectors for GoAnywhere to popular services including Salesforce, SharePoint Online, Microsoft Dynamics 365, Box, and Dropbox. For example: One a trading partner might ask you to share an important file it via a folder in Dropbox. Or perhaps there are contacts or billing information to be updated automatically in Salesforce. GoAnywhere’s Cloud Connectors enables these tasks to be done easily and securely. Broad Range Cloud Connectors are easily downloaded from GoAnywhere MFT’s integrated Marketplace, which features Connectors for the most commonly used cloud services. These include: • Alibaba Object Storage Service • Amazon Cloud Trail, CloudWatch, EC2, Lambda, SNS, and SQS • Atlassian JIRA • Automate Plus • Azure Data Lake Storage Gen1 (superseded by Gen2) and Storage Queue • Box • Citrix ShareFile • Dropbox • Egnyte • GateScanner CDR • GoAnywhere Command • Google Cloud Storage, Drive, and Translate • JAMS • Jenkins • Microsoft Dynamics 365 Business Central, 365 CRM, OneDrive, Sharepoint Online and Sharepoint On-Premise • OPSWAT MetaDefender • Salesforce • ServiceNow • SMA OpCon Scheduler • SOS Berlin JobScheduler (Online version not supported) • Trello • Veeva CRM • Votiro • Webdocs • Zendesk (Online version not supported) Configuring Cloud Connectors Once a Cloud Connector is installed, its connection properties can be configured as a GoAnywhere Resource. This only needs to be performed once, and can then be seamlessly reused in any workflows and cloud file transfers. A Cloud Connector definition contains the various actions required to communicate with cloud applications. For example: authentication logging file transfer file management and error handling. In GoAnywhere, these actions appear as elements located under the Cloud Connector in the GoAnywhere Project Designer. Elements can be incorporated into a business’s workflows alongside other project tasks, and processes can even be automated between multiple web and cloud services at once. New GoAnywhere connectors can be downloaded without needing to update the software. No Connector? No problem While GoAnywhere Marketplace contains a broad array of Cloud Connectors, you may also want to connect to a unique external service. Custom connectors are the answer. And at Generic Systems Australia, we can design and develop Custom Connectors for you, using GoAnywhere’s Cloud Connector Designer. If you’d like to discuss how your organisation’s file transfers to external cloud providers can be made more efficient and secure, please feel welcome to get in touch with me. I’m always happy to have an obligation-free discussion, explain how easy it is to transition to an improved file transfer approach, and offer you a zero-cost Proof of Concept. At Generic Systems Australia , we’re your local experts in Managed File Transfer. Previous Next

< News New Cyber Laws Passed – What Australian Businesses Need to Know and Do 27 Nov 2024 Earlier this week, the Australian Parliament passed a suite of legislative reforms designed to enhance Australia’s cyber security. The reforms include a raft of new requirements and obligations on Australian businesses. About the Legislation Based on recommendations by the Parliamentary Joint Committee on Intelligence and Security, the new legislation addresses a number of proposals initially set out in Australia’s 2023 – 2030 Cyber Security Strategy, and spans three separate Acts: 1. the Cyber Security Act 2024 (Cyber Security Act); 2. the Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024 ; and 3. the Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (SOCI Amendment Act). Mandatory reporting of ransom payments, and the introduction of a new voluntary information sharing regime, will have the most immediate impact on organisations. Mandatory Reporting of Ransomware Payments Ransomware attacks are rife across Australia. The Australian Signals Directorate (ASD) reported that this form of cyber extortion accounted for 11% of all cyber incidents to it in 2023-2024, up from 8% in the previous year. The Government had previously pursued a ban on ransom payments. However, its position has since moderated somewhat. The Cyber Security Act only requires organisations to report ransomware payments to the Department of Home Affairs and the ASD. This new reporting obligation will commence at latest six months after the Act receives royal assent (potentially earlier by proclamation) and applies broadly to: · organisations which are a responsible entity for a critical infrastructure asset; and · other private sector organisations which conduct business in Australia with an annual turnover exceeding a threshold (to be specified - likely to be A$3M). Ransomware reports are required to be made within 72 hours of making a payment (not the receipt of a demand or the discovery of a ransomware attack). Difficult Decisions The requirement to report payments will need to be taken into account by Boards when considering whether to pay a ransom. The Government’s general view on ransoms continues to be that organisations should not pay them. It reasons that payments don’t guarantee the recovery or confidentiality of stolen data, but do encourage cyber attacks to proliferate. Organisations in receipt of ransom demands are left to ponder several competing considerations… · Paying a ransom could potentially contravene sanctions (such as the one imposed on Aleksandr Ermakov, the individual responsible for the 2022 Medibank data breach) or anti-money laundering laws. · Company Directors fulfilling the duty of care to act in the best interests of their organisation will need to balance the risks of payment - commercial damage, incentive to re-target, uncertainty of data recovery – against the risks of not paying - loss of systems data, reputational damage, third party claims, lost customers and business disruption. If a ransom payment is made, then the new mandatory reporting obligation will be in addition to other applicable reporting requirements an organisation is subject to. These could include the Privacy Act 1988 , the SOCI Act , and continuous disclosure obligations under the ASX Listing Rules and CPS 234. In fact, it’s important that Cyber Incident Response plans developed by organisations specifically address these overlapping requirements, taking into account the various regulators and timeframes of each. Be aware that, for any entities regulated under the SOCI Act , it’s also conceivable that the Government could use its directions power to direct an entity to pay - or not pay - a ransom. An organisation which fails to comply with mandatory ransom reporting will incur a civil penalty of 60 penalty units (currently A$93,900). Voluntary reporting regime A new National Cyber Security Coordinator (NCSC) is being established under the Cyber Security Act to lead a whole-of-government response to significant cyber security incidents. The Act provides a framework for the voluntary disclosure of information by any organisation operating in Australia, or any responsible entity under the SOCI Act , to the NCSC relating to cyber security incidents. However, it imposes various limitations on how the NCSC may further use and disclose information voluntarily provided by entities, depending on the significance of the incident. Non-significant cyber security incidents: Information can be used for limited purposes such as directing the reporting entity to assistance services, coordinating a government response, and informing Ministers. Significant cyber security incidents: Information can be used for broader ‘Permitted Cyber Security Purposes’. These include preventing or mitigating risks to critical infrastructure or national security, and supporting intelligence or enforcement agencies. A cyber security incident is deemed “significant” if: there is a material risk that the incident has seriously prejudiced, is seriously prejudicing or could reasonably be expected to prejudice the social or economic stability of Australia or its people, the defence of Australia or national security; or the incident is, or could reasonably be expected to be, of serious concern to the Australian people. Information voluntarily provided by organisations to the NCSC is subject to limited use protections similar to those which apply to information disclosed as part of a ransomware payment report. The new voluntary reporting regime and corresponding limited use protection has come into immediate effect. Limited use protection The Cyber Security Act outlines how businesses should work with the NCSC and other government agencies to obtain assistance and guidance when responding to cyber incidents. It also provides businesses with certain limited use protections when collaborating with the government’s cyber security agencies - a legislative foundation for the CISA Traffic Light Protocol government agencies have recently offered when assisting organisations. Such protections were requested by business lobby groups. They provided feedback during the public consultation period that disclosing information about a data breach could risk exposing an organisation to further regulatory or enforcement action, adverse publicity and litigation. Further, if disclosing a cyber incident was determined to be against an organisation’s best interests, its directors could potentially be in breach of their duties in approving the disclosure. That could in turn expose directors to enforcement action from ASIC. Counterweighing these concerns, the Government believes that sharing information on current threats and incidents can help other organisations avoid similar incidents. In balancing these competing interests, the Cyber Security Act limits the purposes for which information contained in a ransomware payment report or voluntarily report provided to the NCSC can be used or disclosed. The NCSC (and any Government agency it coordinates with) cannot record, use or disclose the information provided for the purposes of investigating or enforcing or assisting in the investigation or enforcement of any contravention of a Commonwealth, State or Territory law. An important exemption from the limited use protections are that crimes and breaches of the limited use protections created by the Act. In this way, the protections stop short of being a full “safe harbour”. Information provided under these protections isn’t admissible in evidence against the disclosing entity, including criminal, civil penalty and civil proceedings (including a breach of the common law). And the provision of information to the NSCS does not affect any claim of legal professional privilege over the information contained in that information. These limited use protections will be of value to organisations disclosing information to the Government about cyber incidents. However, directors should bear in mind the notable gaps in the protection they provide. For example: Information provided can’t be used or disclosed for the purposes of investigating or enforcing any contravention by the reporting entity of another law (whether federal, state or territory), other than a law that imposes a penalty or sanction for a criminal offence. This means that if the ransomware report indicates that a payment was made in breach of relevant sanctions laws, then the limited use protection will not prevent the use of the report in a subsequent investigation or enforcement action. While information provided to the NCSC cannot be obtained from the NSCS by regulators or government agencies, the protection offered under this Act does not prevent regulators from obtaining the underlying information through other means, including via regulatory investigatory powers or where provided under other mandatory reporting regimes, such as those in the Privacy Act 1988 , the SOCI Act, the Telecommunications Act 1997 and the ASX Listing Rules continuous disclosure obligations. So, cyber incident notifications provided to the ACSC under the SOCI Act are not captured by the limited use protection, even if that information is also voluntarily provided to the NCSC or detailed in a mandatory ransomware report. A similar limited use protection has been introduced via the Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024 for cyber incident information voluntarily shared with the ASD. Other Inclusions in the Legislation This article has focused on developments within the new Cyber Security legislative reforms which will most impact companies and organisations. However, in the interests of completeness, here is a brief overview of other key developments covered in the legislation: Mandated Security Standards for Internet of Things (IOT) Devices. These standards will be detailed in legislative rules, with suppliers required to provide a statement of compliance for devices supplied to the Australian market. New Cyber Incident Review Board. This independent advisory body will be empowered to conduct no-fault, post-incident reviews of significant cyber security incidents and provide recommendations and information to both the private and public sector. It will have the power to compel entities to provide information about significant cyber security incidents. Critical Infrastructure definition expanded. Data storage systems which hold business critical data have been added to the definition of critical infrastructure assets. This closes a gap in the regulations which became apparent in the aftermath of the Optus and Medibank data breaches. Expanded Incident Response Powers. The Government will now have the power to direct an entity to take, or not take a specific action, in the event of a cyber incident affecting critical infrastructure. Security and incident notification obligations moved from the Telecommunications Act 1997 to the SOCI Act , consolidating the cyber obligations of telecommunication carriers and carriage service providers under a single piece of legislation. What Organisations Should Do Cyber security response plans should now be reassessed and upgraded to ensure they align to the new mandatory ransomware reporting requirements. Playbooks and procedures should take account of how an organisation plans to engage with cyber security authorities, bearing in mind the extent - and limitations - of the defined limited use protections. Focus on preventing cyber incidents - not just responding to them . A Managed File Transfer (MFT) solution such as GoAnywhere MFT can encrypt data at rest and in transit, complying with the highest data security standards. It manages inbound and outbound file transfers across an organisation, using industry-standard file transfer protocols and encryption to protect your data. Advanced Threat Protection and Adaptive Loss Prevention add a further layer of defence. SFT Threat Protection facilitates safe collaboration with external parties, helping to prevent malware from entering an organisation, and reducing the risk of employees losing or mishandling sensitive data. Finally, organisations should seek professional legal counsel in determining and responding to their obligations and responsibilities under the new Cyber Security legislative reforms. The information provided in this article has been general in nature, and the interpretations and advice outlined above should not be interpreted as professional legal advice. Previous Next