Australian Higher Education Information Security Risk Management Outlook, 2025 Brief

Introduction

Some of the most diverse and exposed IT environments in Australia belong to universities. Research networks, teaching platforms, student services, and operational technology – all must be open enough to support collaboration, yet sufficiently protected to prevent increasingly sophisticated threats. Add to that a large international student and research partner base, and the attack surface quickly grows beyond what most enterprises can effectively control.

Credit: Getty Images

Australian institutions today span every state and territory, from the Australian National University in the ACT, to the Group of Eight research powerhouses: the University of Melbourne (Victoria), University of Sydney and UNSW (New South Wales), the University of Queensland (Queensland), the University of Western Australia, the University of Adelaide, and Monash University. Colleges like Charles Sturt (NSW) and the University of Tasmania also serve regional populations, each with its own unique organisational structure and governance model.

Australian universities also face growing expectations from government and regulators. Now formally designated as critical infrastructure, higher education and research are the target of new statutory obligations for risk management and incident reporting.

Consider, for instance, quality assurance standards from the Tertiary Education Quality and Standards Agency (TEQSA), which include information security requirements that link cyber resilience directly to institutional risk and assurance. For infosec teams already operating with limited staff and budgets, requirements like this one often mean more work with fewer resources.

The following brief is for Australian CISOs and IT leaders in higher education. It explains today’s regulatory landscape, offering practical tips and tool recommendations to simplify compliance, reduce risk, and improve resilience over time.

Australian Higher Education Information Security Regulatory Landscape

Australian universities operate in a highly complicated regulatory environment. Higher education quality standards, critical infrastructure requirements, and national cybersecurity laws each add layers of complexity that tend to overlap. The challenge for most infosec teams is understanding where and how those rules will continue to raise the bar.

Security of Critical Infrastructure Act 2018 (SOCI)

The Security of Critical Infrastructure Act (SOCI) is Australia’s critical infrastructure law. It introduces three positive security obligations for any organisation that owns, operates, or has a vested interest in critical infrastructure.

SOCI requires covered organisations to:

• Submit operational and ownership info to the Register of Critical Infrastructure Assets.
• Report cyber incidents within 12 or 72 hours, depending on severity.
• Adopt, maintain, and comply with a written risk management program.

Because the higher education and research sectors are covered, Australian universities that operate critical infrastructure assets must comply with SOCI. For most, SOCI compliance will transform cyber risk management into a board-level responsibility. Meeting its demands will therefore require precise coordination and execution across IT, research, facilities, and executive leadership teams.

Cyber Security Act 2024

The Cyber Security Act 2024 is Australia’s new national cybersecurity law. It introduces mandatory ransomware and extortion payment reporting, baseline security standards for smart and connected devices, and a Cyber Incident Review Board to capture and share lessons from major events.

The Act requires organisations to:

• Report ransomware and extortion payments to government authorities.
• Maintain minimum security standards for smart devices used in enterprise and research settings.
• Participate in post-incident reviews coordinated by the Cyber Incident Review Board.

Because universities operate diverse fleets of devices across campuses, classrooms, and laboratories, the Cyber Security Act 2024 creates new obligations for forensic readiness and device hygiene. Higher education institutions must be able to produce detailed incident timelines, maintain centralised evidence, and demonstrate consistent controls across distributed environments.

Tertiary Education Quality and Standards Agency (TEQSA) – Higher Education Standards Framework (HESF) 2021

The Higher Education Standards Framework (HESF) 2021, enforced by the Tertiary Education Quality and Standards Agency (TEQSA), sets quality and assurance requirements for all registered higher education providers in Australia. Domain 7 requires institutions to operate secure, well-governed information systems and to prevent unauthorised or fraudulent access to sensitive information.

The TEQSA HESF requires universities to:

• Maintain governance structures that embed information security into institutional assurance.
• Implement and monitor controls that protect sensitive academic, research, and student data.
• Provide evidence of cybersecurity resilience as part of quality reviews and accreditation.

Unlike SOCI, TEQSA applies universally across the higher education sector. For universities, compliance means cybersecurity outcomes must be linked directly to institutional risk management, audit, and quality assurance processes. Failure to demonstrate these linkages can threaten accreditation as well as operational resilience.

APRA Prudential Standard CPS 234 (Information Security)

APRA Prudential Standard CPS 234 is Australia’s primary regulation for information security in APRA-regulated financial entities. It sets requirements for governance, testing, and incident reporting to ensure the resilience of critical financial systems. While universities are not directly regulated, CPS 234 obligations extend contractually when institutions provide services to APRA-regulated partners such as UniSuper and insurance providers.

CPS 234 requires regulated entities—and their service providers—to:

• Implement and maintain strong governance and control frameworks for information security.
• Conduct regular testing of security controls and remediation of weaknesses.
• Notify APRA promptly of material information security incidents.

For universities, CPS 234 compliance flows down through contractual clauses. Finance, HR, and other units interacting with superannuation or insurance must be prepared for partner audits, rapid breach notifications, and minimum control expectations. Infosec teams need mature third-party risk management practices and evidence-ready documentation to meet CPS 234 standards.

Current Challenges in Australian Higher Education Cybersecurity

Credit: Getty Images

Regulatory obligations have become clearer, but Australian universities still face major barriers to compliance and resilience. Information security teams must protect sprawling, open environments with limited resources, and evidence shows the gap between requirements and actual capability is widening. The most significant challenges include:

Control and assurance gaps

NSW’s Auditor-General reported systemic weaknesses across agencies and universities, including limited oversight of third-party providers, insufficient independent assurance, and under-implementation of “Protect” domain controls. In FY2024, 69 percent of Protect requirements remained unmet, while 59 percent of agencies lacked independent assurance.

Third-party exposure

Cyber Security NSW found that incidents linked to vendor-managed systems nearly tripled in 2024, with a sharp increase in university data breaches. Vendor contracting, continuous assurance, and monitoring are now daily responsibilities for CISOs.

Active breaches and slow detection

Western Sydney University confirmed that data from a compromised single sign-on system “was available via the file-sharing platforms for up to 16 days” before takedown. UWA separately forced a campus-wide password reset after a credential compromise. These breaches reveal slow detection windows and the operational strain of meeting new reporting requirements.

Foreign interference and research security

The Department of Home Affairs warns: “Espionage and foreign interference present a constant risk to Australia as government, academia, media, industries, and communities are targeted.” Universities with international partnerships and globally networked labs must demonstrate proportionate controls for access, collaboration, and sensitive data governance.

AI adoption outpaces controls and skills

TEQSA has launched a Generative AI toolkit to help providers manage risks to academic integrity and research security. The regulator stresses that providers must manage the risks these evolving technologies pose to academic integrity. Meanwhile, a joint University of Melbourne–KPMG study found that “AI adoption is on the rise, but trust remains a critical challenge”.

Budgets shift, workloads stretch

PwC notes that Australian and New Zealand CIOs are “boosting cybersecurity budgets by 33 percent” in 2025. Yet even as spending increases, teams continue to report challenges coordinating controls and evidence across distributed environments.

Sector collaboration is an operational dependency

The Australasian Higher Education Cybersecurity Service (AHECS) describes itself as “the sector’s peak cybersecurity body,” coordinating intelligence sharing and joint capability uplift. For many institutions, participation in AHECS and other cross-sector forums is now critical to staying ahead of threats.

Path Forward: Automating Infosec Risk Management

The scale and complexity of university environments make manual approaches unsustainable. Automation does not replace accountability, but it does remove friction. By centralising workflows, reducing duplication, and creating audit-ready outputs, security teams can close compliance gaps and focus on resilience.

Centralised assessments

Automated assessments help universities replace scattered spreadsheets with structured, repeatable workflows. Aligning assessments with frameworks like NIST CSF and ISO/IEC 27001 ensures results are mapped to recognised best practice, while also providing evidence for SOCI, TEQSA, and CPS 234 requirements. Real-time dashboards give CISOs, executives, and boards a single source of truth on current risk posture.

Unified inventories

Universities manage diverse assets, from enterprise applications to laboratory equipment and third-party SaaS. Automation enables a single IT asset inventory that stays up to date and maps directly against control frameworks such as the Essential Eight and the ASD Information Security Manual. This reduces blind spots and supports maturity tracking that leaders can trust when making investment decisions.

Collaborative risk register

Risks often emerge in silos—within faculties, research projects, or central IT. A collaborative risk register allows teams to document, assign, and track risks across the institution, with context pulled directly from assessments. Aligning this workflow with ISO 27001 and governance standards like ISO/IEC 38500 ensures accountability and provides leaders with visibility into how remediation aligns with strategic priorities.

Automated reporting

Preparing for TEQSA reviews, SOCI attestations, or CPS 234 evidence requests can consume weeks of staff time. Automated reporting generates audit-ready outputs that also double as executive-level dashboards. CISOs can present quantifiable measures of cyber resilience, maturity against the Essential Eight, or control effectiveness under NIST SP 800-53, giving boards the clarity they need to make governance decisions.

What Universities Are Achieving

Information security risk management is already reshaping how universities in North America operate. Large institutions there must comply with a patchwork of regulations that include HIPAA for health data, GLBA for financial aid information, CMMC for defense-related research, PCI-DSS for payment systems, and numerous state-level privacy laws. These requirements overlap with internal governance demands and create the same compliance fatigue now emerging in Australia.

Credit: Getty Images

To manage this complexity, universities are adopting information security risk management platforms that:

• Unify compliance efforts across frameworks by mapping controls once and applying them to multiple regulatory requirements.
• Identify and remediate gaps more quickly through structured assessments and risk registers that highlight areas of weakness.
• Strengthen third-party oversight with inventories and questionnaires that bring vendors and research partners into the same governance structure. A growing number of universities also standardise third-party due diligence through the Higher Education Community Vendor Assessment Toolkit (HECVAT), which simplifies vendor assessments and creates a common language for assurance across the sector.
• Build a culture of cyber resilience by giving faculty, staff, and executives clearer visibility into risks and their role in managing them.
• Elevate board and leadership reporting by quantifying resilience, maturity, and compliance posture in a format that councils and committees can act on.

These outcomes demonstrate how automation enables universities to move beyond reactive compliance and toward integrated risk management. For Australian universities facing SOCI, TEQSA, and CPS 234 obligations, the lesson is clear: the same approach can reduce overhead, close assurance gaps, and improve confidence in both regulatory and governance conversations.

Conclusion

Australian universities face an increasingly complex cybersecurity landscape. Regulatory expectations are clearer, attack surfaces are broader, and boards and councils are demanding measurable evidence of resilience. Manual approaches cannot keep pace with this reality.

The way forward is structured information security risk management. By automating assessments, centralising inventories, tracking risks collaboratively, and producing audit- and board-ready reporting, universities can reduce compliance fatigue and strengthen confidence in their security posture.

This brief is intended as a prompt for reflection. Every institution will take its own path, but the goal is the same: a sector that can demonstrate resilience, manage risk proactively, and continue to support teaching, research, and community with confidence.