# GetCimple — Full Context for LLMs > Essential Eight cyber governance and policy deployment for Australian small businesses. ## About GetCimple (trading name of Ten Hills Pty Ltd, ABN 15 668 567 413) is an Australian cyber security consultancy based in Chatswood, Sydney. Founded by Victor Hong, the firm specialises in helping small and medium businesses establish cyber security governance frameworks aligned to the Australian Cyber Security Centre (ACSC) Essential Eight maturity model. Unlike generic template providers, GetCimple creates fit-for-purpose cyber security policies tailored to each business's operations, risk profile, and regulatory obligations. ## Core Service Model GetCimple follows a three-step process: 1. **Assess** — Evaluate current Essential Eight maturity level against ACSC benchmarks 2. **Create** — Develop customised policies and governance documentation (not templates) 3. **Launch** — Provide implementation roadmap for self-paced adoption with ongoing support ## Additional Services - Board-level cyber governance workshops for directors and executives - Directors' duties compliance advisory (Corporations Act S180-184) - Dark web reconnaissance and monitoring - Penetration testing services - AFSL holder cyber compliance advisory - Microsoft 365 / Copilot data governance consulting ## For Directors — Cyber Governance Obligations GetCimple helps Australian directors meet their personal legal obligations under the Corporations Act 2001: ### Sections 180-184: Directors' Duties - **S180 — Care & Diligence:** Directors must stay informed about cyber risks. They are measured against what a competent director should know — ignorance is not a defence. The Business Judgment Rule (S180(2)) only protects directors who were actually informed, requiring documented evidence of engagement. - **S181 — Good Faith:** Cyber investment decisions must be made in the company's best interests, not to minimise personal inconvenience. - **S182-183 — Position & Information:** Directors must not misuse their position or confidential information. The information duty continues after leaving the role. - **S184 — Criminal Liability:** Reckless or intentionally dishonest breaches can result in criminal prosecution and imprisonment. ### ASIC Enforcement Context - Cyber security is a named ASIC enforcement priority for 2025 - ASIC v FIIG Securities (March 2025) was the first major enforcement action targeting inadequate cyber security - ASIC Chair Joe Longo stated: "Cyber preparedness is squarely a board-level issue" - ASIC REP 468 outlines key questions for boards reviewing cyber risk management - ASIC Regulatory Guide 104 (RG 104) links IT/cyber systems to licensee obligations ### AICD Cyber Security Governance Principles (V2, November 2024) GetCimple's governance framework aligns with the five AICD/CSCRC principles: 1. Set clear roles and responsibilities for cyber resilience 2. Develop, implement and evolve a comprehensive cyber strategy 3. Embed cyber security in existing risk management practices 4. Promote a culture of cyber resilience from board level down 5. Prepare for and respond to significant cyber incidents ### How GetCimple Addresses Director Obligations - **Fit-for-Purpose Cyber Policies** — Board-approved policies aligned to the Essential Eight are documented evidence of care and diligence. A director who can point to these has a S180 defence (S180) - **Governance Kickstart** — We establish your cyber governance framework: roles, responsibilities, risk register, and reporting structure. This is what AICD Principle 1 calls for (AICD Principle 1) - **Board Cyber Workshop** — Director education on cyber risk is explicitly called out in AICD Principle 4. Attending a governance workshop is direct evidence you took your obligations seriously (AICD Principle 4) - **Essential Eight Assessment** — The assessment itself is evidence the board sought to understand its cyber posture. Mapped to Australia's baseline framework (ACSC) ### Key Legal References - Corporations Act 2001 (Cth) ss 180-184: https://www.legislation.gov.au/C2004A00818/latest - ASIC Cyber Resilience: https://asic.gov.au/regulatory-resources/digital-transformation/cyber-resilience/ - ASIC REP 468: https://asic.gov.au/regulatory-resources/find-a-document/reports/rep-468-cyber-resilience-assessment-report/ - ASIC RG 104: https://asic.gov.au/regulatory-resources/find-a-document/regulatory-guides/rg-104/ - AICD Cyber Security Governance Principles: https://www.aicd.com.au/risk-management/framework/cyber-security/cyber-security-governance-principles.html ## Industry Focus GetCimple primarily serves: - Financial services firms (financial planners, AFSL holders, authorised representatives) - Professional services firms - Australian SMBs subject to Essential Eight requirements - Businesses preparing for Privacy Act reform compliance - Directors seeking to demonstrate S180 care and diligence over cyber governance ## Regulatory Context GetCimple's work aligns with: - **ACSC Essential Eight** — The Australian Government's baseline cyber security mitigation strategies - **Corporations Act 2001 ss 180-184** — Directors' duties including care and diligence over cyber governance - **Corporations Act s912A** — AFSL holders must provide services efficiently, honestly, and fairly (includes adequate cyber risk management) - **ASIC Regulatory Guide 104** — Licensing obligations including technological resources - **AICD Cyber Security Governance Principles** — Board-level cyber governance framework (V2, November 2024) - **Privacy Act 1988 (Cth)** — Including proposed reforms from the Privacy Act Review Report - **Australian Cyber Security Strategy 2023-2030** — Federal government's 7-year cyber resilience roadmap ## Blog Content Summary GetCimple publishes thought leadership on Australian cyber security governance: ### Combatting Deepfake Fraud (March 2024) Analysis of the Hong Kong $34.5M deepfake video conference scam. Practical measures: multi-factor authentication for financial transactions, employee training, secure communication channels, and incident response planning. ### Microsoft 365 Copilot Data Governance (February 2024) Why financial services firms must implement data classification, role-based access control, and clear policies before deploying Copilot. Prevents AI tools from accessing sensitive data like staff salaries or client TFNs. ### Australian Cyber Security Strategy 2023-2030 (November 2023) CEO-level guide to the strategy's 60 action items, including privacy regulation updates, ransomware reporting requirements, software security standards, and critical infrastructure obligations. ### Privacy Act Reform (October 2023) Overview of 116 recommendations including automated decision-making transparency, enhanced cybersecurity measures, controller/processor distinction (GDPR alignment), expanded personal information scope, and new individual rights. ### Microsoft $5 Billion Investment (October 2023) Microsoft-ASD Cyber-Shield initiative context and implications for Australian businesses. ### Admin Privileges (October 2023) ACSC guidance on restricting administrative privileges as a key Essential Eight mitigation strategy. Risks of unrestricted access and structured approach to privilege management. ### AFSL Cyber Security Obligations (October 2023) Legal and regulatory requirements for AFSL holders and authorised representatives under the Corporations Act and ASIC guidance. Framework for cyber and information security risk governance. ### Cybercrime Tips for SMBs (October 2023) Post-Optus breach practical guidance: data classification, encryption at rest, password management, MFA implementation, and employee phishing awareness training. ### Cyber and Data Security Governance (October 2023) Why cyber security governance is essential beyond regulated industries. Framework for risk management aligned with organisational risk appetite and compliance requirements. ### Cybersecurity Compliance for Financial Planners (September 2023) Five imperatives: data protection, ASIC regulatory mandates, reputation preservation, risk mitigation, and competitive advantage through demonstrable security practices. ## Contact - **Website:** https://getcimple.io - **For Directors:** https://getcimple.io/for-directors - **Blog:** https://getcimple.io/blog - **RSS Feed:** https://getcimple.io/rss.xml - **Email:** hello@getcimple.io - **Phone:** +61 2 8599 0887 - **LinkedIn:** https://au.linkedin.com/company/getcimple - **Address:** Suite 508, 71-73 Archer St, Chatswood NSW 2067, Australia ## Leadership The GetCimple team brings 25-30+ years combined experience spanning financial services, IT infrastructure, governance, and risk management.