Product Overview

Summary: This Cyber Safety Safe Operating Procedure sets out clear, practical steps to protect your people, systems and information from cyber threats in the Australian workplace. It translates complex cybersecurity and privacy obligations into simple, repeatable processes that frontline staff, managers and IT teams can consistently apply.

Cyber incidents are no longer just an IT problem – they are a critical workplace safety and business continuity issue. Phishing emails, ransomware, data breaches and unauthorised access can expose workers to psychological harm, financial loss and identity theft, while also crippling core business operations. This Cyber Safety Safe Operating Procedure provides a structured, WHS-aligned approach to managing cyber risks across your organisation, from day‑to‑day user behaviour through to incident response and recovery.

Developed for Australian workplaces, this SOP bridges the gap between technical cybersecurity concepts and practical, on-the-ground controls that staff can actually follow. It outlines clear roles and responsibilities, minimum security behaviours for all workers, secure use of email, internet and mobile devices, rules for remote work and BYOD, and step‑by‑step instructions for responding to suspected cyber incidents. By implementing this procedure, your business can demonstrate due diligence under WHS and privacy laws, protect workers from harm associated with cybercrime, and maintain the integrity and availability of critical systems and information.

The document is written in plain English and designed to plug directly into your existing WHS management system, policies and induction programs. It supports consistent training, reduces reliance on ad‑hoc IT advice, and gives managers a defensible, auditable process to show regulators, insurers and clients that cyber safety risks are being proactively managed.

Key Benefits

• Reduce the likelihood and impact of cyber incidents such as phishing, ransomware and data breaches through clear, repeatable controls.
• Ensure alignment with Australian WHS duties, privacy obligations and industry best practice for managing cyber-related risks to workers.
• Standardise cyber safety expectations and behaviours across all staff, contractors and remote workers.
• Strengthen business resilience and continuity by defining clear incident reporting, escalation and recovery processes.
• Support effective onboarding, refresher training and toolbox talks with a structured, easy-to-follow procedure.

Who is this for?

• Business Owners and Directors
• WHS Managers and HSE Advisors
• IT Managers and System Administrators
• Information Security Officers
• Office Managers
• HR Managers
• Team Leaders and Supervisors
• Compliance and Risk Managers
• Education and Training Coordinators
• Remote and Hybrid Workers

Hazards Addressed

• Exposure of workers to cybercrime leading to financial loss or identity theft
• Psychological harm and stress arising from cyberbullying, online harassment or data breaches involving personal information
• Loss of critical business data and operational disruption due to malware or ransomware attacks
• Unauthorised access to confidential or sensitive information, including client and employee records
• Compromise of systems used for safety‑critical operations (e.g. plant controls, access control systems)
• Increased risk from unsafe remote work practices and unsecured personal devices (BYOD)
• Reputational damage and regulatory action following reportable cyber and privacy incidents

Included Sections

• 1.0 Purpose, Scope and Objectives
• 2.0 Definitions and Key Terms (Cyber Safety, Personal Information, Incident, etc.)
• 3.0 Roles and Responsibilities (PCBU, Officers, Workers, IT, Contractors)
• 4.0 Cyber Risk Identification and Assessment within WHS Frameworks
• 5.0 General Cyber Safety Rules for All Workers
• 6.0 Secure Use of Email, Internet and Messaging Platforms
• 7.0 Password Management, Multi-Factor Authentication and Access Control
• 8.0 Safe Use of Mobile Devices, Laptops and Removable Media
• 9.0 Remote Work, Home Office and BYOD Cyber Safety Requirements
• 10.0 Handling, Storage and Transmission of Sensitive and Personal Information
• 11.0 Managing Psychosocial Risks from Online Harassment, Cyberbullying and Scams
• 12.0 Third-Party Services, Cloud Applications and Vendor Access Controls
• 13.0 Cyber Incident Identification, Reporting and Escalation Pathways
• 14.0 Initial Response, Containment and Communication Procedures
• 15.0 Post-Incident Review, Corrective Actions and Continuous Improvement
• 16.0 Training, Induction, Awareness and Refresher Requirements
• 17.0 Monitoring, Audit and Compliance with this SOP
• 18.0 Document Control, Review and Version History

Legislation & References

• Work Health and Safety Act 2011 (Cth) and equivalent state and territory WHS legislation
• Work Health and Safety Regulations 2011 and state/territory equivalents
• Privacy Act 1988 (Cth) and Notifiable Data Breaches (NDB) scheme
• Australian Government Protective Security Policy Framework (PSPF) – Information security (as applicable)
• AS ISO/IEC 27001:2023 Information security, cybersecurity and privacy protection – Information security management systems
• AS ISO/IEC 27002:2023 Information security, cybersecurity and privacy protection – Information security controls
• Safe Work Australia – Model Code of Practice: Managing psychosocial hazards at work
• Australian Cyber Security Centre (ACSC) Essential Eight Maturity Model (guidance)