Cybersecurity Market Entry Playbook: Essential Eight, SOCI & Selling to Government in ANZ

Australia and New Zealand sit at the intersection of two powerful forces: a rapidly maturing regulatory environment that compels organisations to spend on cybersecurity tools and services, and a government that has publicly committed to becoming a world leader in cyber security by 2030. That combination creates durable, policy-driven demand that is relatively insulated from economic downturns — budgets tied to compliance obligations rarely disappear when CFOs look for savings.

For foreign vendors, the opportunity is structural rather than cyclical. The Essential Eight mandates, the Security of Critical Infrastructure (SOCI) Act obligations, mandatory ransomware payment reporting, and — across the Tasman — New Zealand's Minimum Cyber Security Standards have all created enforceable compliance floors that organisations cannot ignore. Every new obligation is a buying trigger. The question for an incoming vendor is not whether Australian and New Zealand organisations need cybersecurity products, but whether you understand the specific frameworks well enough to position your offering compellingly to a buyer whose procurement language is shaped by those frameworks.

Irish automation and orchestration vendor Tines provides one of the most instructive recent examples. Rather than treating ANZ as a remote territory served from Europe, Tines built a dedicated APAC go-to-market motion anchored in Sydney. That physical presence — with locally credentialed pre-sales and customer success capability — allowed Tines to win and expand enterprise accounts with Sydney-headquartered technology businesses including Atlassian and Canva, both of which have sophisticated security operations teams that demand deep technical engagement and time-zone-aligned support.

The Tines playbook illustrates several principles that apply broadly to cybersecurity market entry: establish legal entity and local technical presence before chasing government; win referenceable enterprise logos first; align product messaging to the specific frameworks (Essential Eight, SOCI) that Australian buyers already understand; and build relationships with the local MSSP and systems integrator ecosystem, because most mid-market buyers procure cybersecurity through a managed service layer rather than direct.

The Essential Eight is a set of eight prioritised cybersecurity mitigation strategies published and maintained by the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre (ACSC). The eight strategies are:

1. Patch applications
2. Patch operating systems
3. Multi-factor authentication (MFA)
4. Restrict administrative privileges
5. Application control
6. Restrict Microsoft Office macros
7. User application hardening
8. Regular backups

Each strategy is assessed across four maturity levels — Level 0 (not implemented), Level 1 (partly aligned), Level 2 (largely aligned), and Level 3 (fully aligned with the intent). The model was designed so that achieving Maturity Level 2 across all eight strategies provides a strong baseline defence against the most common cyber adversary tradecraft seen against Australian organisations.

For foreign vendors, the Essential Eight is the single most important framework to understand before engaging an Australian buyer. It shapes procurement questions, request-for-proposal criteria, and the language your pre-sales team needs to speak fluently. If your product demonstrably helps customers move from ML1 to ML2 on one or more of the eight strategies — and you can express that in your positioning — you have an immediate hook.

Under PSPF Policy 14, all non-corporate Commonwealth entities (NCEs) — the bulk of the federal public service — must implement the Essential Eight to at least Maturity Level 2. This obligation has been mandatory since 1 July 2022. State and territory governments are not directly bound, but most reference the Essential Eight in their own procurement standards and cyber policies.

Compliance has been slow but improving. According to the Commonwealth Cyber Security Posture in 2025 report published by the ASD/ACSC, 22% of federal entities achieved Maturity Level 2 or higher across all eight strategies in 2025, up from 15% in 2024. That headline figure means roughly 78% of federal entities are still below the mandatory baseline — which represents an enormous, active procurement market for tools and services that accelerate Essential Eight uplift.

There were no updates to the Essential Eight Maturity Model in 2024–25. Vendors should note that the ASD periodically revises the model, so aligning product documentation to the current published version is critical for competitive tenders.

The Security of Critical Infrastructure Act 2018 (SOCI Act), as amended in 2021, 2022, and most recently by the Enhanced Regulatory Powers (ERP) Act effective 5 April 2025, is the primary legislative framework governing the security of Australia's critical infrastructure. It is administered by the Cyber and Infrastructure Security Centre (CISC) within the Department of Home Affairs.

The Act covers 11 critical infrastructure sectors across 22 or more defined asset classes:

• Energy
• Communications
• Data Storage or Processing (directly relevant to cloud and data vendors)
• Financial Services & Markets
• Water & Sewerage
• Healthcare & Medical
• Higher Education & Research
• Food & Grocery
• Transport
• Space Technology
• Defence Industry

For foreign tech companies, the most immediately relevant asset class is Critical Data Storage or Processing. This covers foreign cloud providers and data processors that host or process business-critical data on behalf of critical infrastructure operators. Even if your business is not itself a critical infrastructure operator, if you provide data services to one, you are drawn into the SOCI ecosystem via the operator's supply chain obligations.

Responsible entities for applicable critical infrastructure assets face strict mandatory reporting timeframes to the ACSC. These are not aspirational targets — they are legal obligations with potential government intervention powers attached:

• Significant impact incidents: notify the ACSC within 12 hours of becoming aware of the incident.
• Relevant impact incidents: notify the ACSC within 72 hours of becoming aware.

Reporting is via the ACSC website or by calling 1300 CYBER1. Responsible entities must also have and comply with a written Critical Infrastructure Risk Management Program (CIRMP) covering cyber, personnel, supply chain, and physical hazards. CIRMP Annual Reports must be submitted to the CISC within 90 days of the end of the financial year. If any registered information changes — such as ownership, operational details, or asset configuration — the entity must update the CISC Register within 30 days.

For foreign vendors whose products or managed services are embedded in a customer's critical infrastructure environment, these timeframes have direct implications for your own incident response SLAs, contractual obligations to notify customers, and the forensic readiness of your platform.

Yes, in a meaningful way. The Critical Data Storage or Processing asset class was specifically designed to capture cloud service providers and data centre operators that hold or process data critical to the operation of entities across the 11 SOCI sectors. A foreign cloud provider that processes, for example, the operational data of an Australian energy company or a major financial institution is likely captured.

The Security of Critical Infrastructure Amendment (Measures No. 1) Rules 2025 took effect on 5 April 2025, reinforcing this position. Under these rules, responsible entities must notify any external data service providers of their obligations (subsection 12F), creating a contractual and regulatory chain that flows up to offshore providers. If your product stores or processes data on behalf of a SOCI-regulated operator, expect that operator to impose SOCI-derived contractual requirements on you — including incident notification windows that are tighter than standard commercial SLAs.

The practical implication: before signing enterprise contracts in Australia, foreign vendors should audit whether any prospective customer is a responsible entity under SOCI, assess whether their services qualify as critical data storage or processing, and ensure their terms of service and incident response procedures can meet the SOCI-aligned obligations the customer will inevitably pass down.

Above the standard SOCI regime sits a higher tier: Systems of National Significance (SoNS). The Minister for Home Affairs may declare specific critical infrastructure assets as SoNS where their compromise would have catastrophic consequences for Australia's national security, economy, or community wellbeing. SoNS declarations are targeted — not every critical infrastructure asset qualifies.

Once declared, a SoNS asset is subject to up to four Enhanced Cyber Security Obligations (ECSOs):

1. Cyber incident response plans — documented, tested plans for responding to significant cyber incidents.
2. Cyber security exercises — mandatory exercises to test incident response capability.
3. Vulnerability assessments — regular independent assessments of system vulnerabilities.
4. Provision of system information to government — sharing of technical network and system information with the CISC/ACSC to support national situational awareness.

For foreign cybersecurity vendors, SoNS obligations are a significant commercial opportunity. Organisations subject to ECSOs need specialised tools and services to execute cyber exercises, conduct vulnerability assessments, and develop robust incident response plans. If your offering addresses any of these four obligations, leading with SoNS applicability is a powerful differentiator in enterprise sales conversations with Australia's largest infrastructure operators.

Australia's 2023–2030 Australian Cyber Security Strategy sets the government's ambition to make Australia a world leader in cyber security by 2030. The strategy is structured across three horizons and six cyber shields:

• Horizon 1 (2023–25): Strengthening foundations — baseline protections, incident reporting reform, and critical infrastructure uplift.
• Horizon 2 (2026–28): Economy-wide maturity — extending cyber uplift beyond government to the broader economy. A Horizon 2 policy discussion paper consultation ran from 29 July to 29 August 2025, attracting over 170 submissions.
• Horizon 3 (2029–30): Global frontier — positioning Australia as an exporter of cyber expertise and standards.

The six shields framework covers: strong businesses and citizens; safe technology; world-class threat sharing; world-class protection of critical infrastructure; sovereign capabilities; and resilient regional and global leadership. For foreign vendors, the strategy signals sustained government investment and regulatory activity across the entire horizon to 2030 — this is not a short-cycle compliance wave but a decade-long programme of reform that will continuously generate new procurement requirements.

The Cyber Security Act 2024 introduced Australia's first mandatory ransomware and cyber extortion payment reporting regime. From 30 May 2025, any reporting business entity must report to the ASD within 72 hours of making a ransomware or cyber extortion payment — or within 72 hours of becoming aware that such a payment was made on their behalf.

A business qualifies as a reporting business entity if it meets either of the following conditions:

• It carries on business in Australia (including foreign companies with Australian operations) AND had an annual turnover of A$3 million or more in the last financial year; OR
• It is a responsible entity for critical infrastructure assets under the SOCI Act (no turnover threshold applies).

The report must include: details of the incident; the type, amount, and method of payment; details of the extorting entity where known; and copies of relevant communications. Failure to report carries a civil penalty of up to 60 penalty units — currently A$19,800.

According to analysis by Gadens and Hogan Lovells, the legislation is deliberately broad: a business does not need to be Australian-owned or headquartered in Australia to be caught. If a foreign entity operates in Australia and clears the A$3 million turnover threshold, the reporting obligation applies. For foreign cybersecurity vendors that are themselves victims of ransomware — or whose managed service clients are — this creates both a direct compliance obligation and an opportunity to help Australian customers build the processes to meet the 72-hour reporting window.

A ransomware payment reporting factsheet is available from the Department of Home Affairs.

IRAP — the Information Security Registered Assessors Program — is administered by the ACSC (Australian Signals Directorate). It accredits independent assessors who evaluate whether an ICT system or service meets the security controls prescribed in the Information Security Manual (ISM), Australia's government cyber security framework. An IRAP assessment produces a risk report that agencies use as evidence when making security risk-acceptance decisions.

According to the IRAP common assessment framework, foreign tech companies providing ICT products or services to Australian government must typically engage an accredited IRAP assessor before they can realistically compete for federal contracts at PROTECTED classification and above. An IRAP risk report is also used as evidence in Hosting Certification Framework (HCF) applications for cloud providers seeking to host Australian government data.

The practical implication: IRAP is not a product certification — it assesses a specific system deployment at a point in time. A foreign vendor should:

1. Identify which of their cloud environments or product deployments will be used to service Australian government.
2. Engage an accredited IRAP assessor early — assessments can take several months.
3. Ensure their platform architecture aligns to the ISM controls relevant to the target classification (OFFICIAL, PROTECTED, etc.).
4. Retain the IRAP risk report and make it available to prospective government customers during procurement.

Note: The HCF registration for new cloud/data centre providers was paused from 3 November 2025 pending reforms. Existing certified providers are unaffected, but new entrants seeking HCF certification should monitor the Hosting Certification Framework website for resumption of new registrations.

Beyond IRAP, the Essential Eight creates a parallel — and arguably broader — commercial lever. Because only 22% of federal entities have achieved Maturity Level 2 across all eight strategies despite it being mandatory since 1 July 2022, there is substantial active demand for tools and services that accelerate uplift from ML1 to ML2 and from ML2 to ML3.

A foreign vendor does not need to address all eight strategies to win government business. Many successful entrants focus on one or two strategies where their product is genuinely differentiated — for example, a specialist MFA platform addressing strategy three, or a patch management tool addressing strategies one and two. The key is to map your product's capabilities directly to the ASD's published maturity model descriptors, so that a government ICT security officer can immediately see which maturity level your product helps achieve and why.

Government buyers also expect suppliers to have their own Essential Eight posture auditable. If you are selling an ML2-uplift product but your own internal systems are at ML0, expect to be asked about it in tender responses and due diligence. Tines, for example, built its APAC GTM with the expectation that enterprise and government buyers in Sydney would scrutinise not just the product but the vendor's own security practices.

New Zealand's lead operational cyber security agency is the National Cyber Security Centre (NCSC), which sits within the Government Communications Security Bureau (GCSB). The NCSC absorbed the functions of CERT NZ in 2024, consolidating national cyber incident response and threat intelligence under a single agency. It supports nationally significant organisations and publishes the annual Cyber Threat Report.

The scale of the challenge is significant. In its first full year of operation as the lead agency (year ending 30 June 2024), the NCSC recorded 7,122 cyber security incidents resulting in NZ$21.6 million in reported financial losses. These figures reflect only incidents that came to the NCSC's attention — the actual economic impact of cybercrime in New Zealand is considerably higher.

For foreign cybersecurity vendors, New Zealand presents a smaller but meaningfully distinct market from Australia. The public sector procurement language is different, the regulatory frameworks are not directly harmonised with Australia's, and the buyer community is smaller and more tightly networked. Relationship-led selling is even more important in the New Zealand market than in Australia — word-of-mouth between government CISOs and security teams travels quickly in a country of five million people.

The NZ NCSC mandated ten Minimum Cyber Security Standards (MCSS) for public sector agencies under the Government Chief Information Security Officer (GCISO) mandate, effective 30 October 2025. Mandated agencies must implement the standards at a minimum maturity of CMM2 (Planned & Tracked) and must report on implementation as part of PSR assurance reporting in April 2026.

The ten standards cover the foundational cyber hygiene controls expected of New Zealand government agencies: identity and access management, asset management, vulnerability management, logging and monitoring, incident response, and related controls. While these standards apply directly to public sector agencies rather than vendors, they create an obvious product opportunity: any foreign cybersecurity vendor whose product demonstrably helps NZ government agencies achieve CMM2 on one or more of the ten standards has a compliance-led sales narrative directly analogous to the Essential Eight narrative in Australia.

The NZ public sector market is best approached through the Government Chief Digital Officer (GCDO) ecosystem and through local channel partners who have existing agency relationships. Direct foreign vendor sales to NZ Crown entities without local representation are possible but significantly slower — agencies prefer suppliers who have a local presence and understand the NZ procurement context.

The standard advice for technology market entry — treat ANZ as two separate markets that share a language — applies strongly in cybersecurity. The regulatory frameworks are not harmonised: Australia has the Essential Eight, SOCI, IRAP, and the Cyber Security Act 2024; New Zealand has the NCSC Minimum Cyber Security Standards and the GCISO mandate. The procurement channels are different, the key government buyers are different, and the partner ecosystems are distinct.

That said, a Sydney-based entity can serve both markets more efficiently than one headquartered in Europe or the Americas, and many Australian MSSPs and systems integrators have New Zealand operations that can provide an indirect channel path. The Tines playbook of anchoring in Sydney first, then extending into New Zealand through Australian partner relationships and APAC-wide enterprise logos, is a proven model for cybersecurity vendors whose product is applicable across both public and private sectors.

The practical recommendation: prioritise Australia for your first 12–18 months. The market is larger, the compliance mandates are more specific and enforceable, and the government procurement volumes are greater. Once you have Australian reference customers and a functioning local entity, New Zealand becomes a natural extension — especially if any of your Australian customers have New Zealand operations.

Use this checklist as a working framework before you begin active sales activity in Australia and New Zealand. It is designed for a foreign cybersecurity vendor with an established product and initial ANZ interest but no in-market presence yet.

Regulatory & Compliance Groundwork

• ☐ Register as a foreign company with ASIC under Part 5B.2 of the Corporations Act — this is a prerequisite for most government and enterprise contracting.
• ☐ Map your product capabilities to the Essential Eight Maturity Model — identify which strategies and maturity levels you address and create a written capability statement.
• ☐ Assess whether your product or managed service qualifies as a critical data storage or processing asset under the SOCI Act — if so, understand the CIRMP and incident reporting obligations your customers will pass down to you contractually.
• ☐ Review your own internal Essential Eight posture — government and enterprise buyers will ask about it; document your current maturity level honestly.
• ☐ Determine whether your Australian entity will clear the A$3 million turnover threshold for ransomware payment reporting under the Cyber Security Act 2024 — if so, ensure your incident response plan includes the 72-hour reporting workflow.
• ☐ If targeting government contracts, engage an accredited IRAP assessor to assess your cloud environment against the ISM — budget 3–6 months and plan this in parallel with your go-to-market build.
• ☐ Monitor the Hosting Certification Framework website for the resumption of new provider registrations (paused from 3 November 2025) if you are a cloud/data-hosting provider.

Go-to-Market & Commercial Preparation

• ☐ Identify whether your first channel is direct enterprise, government, or MSSP/SI — most mid-market ANZ cybersecurity buying happens through managed service providers, not direct.
• ☐ Research the major Australian cybersecurity MSSPs and systems integrators (including the big four consulting firms' security practices) and identify two or three potential channel partners to approach in the first six months.
• ☐ Rewrite your sales collateral to lead with Australian regulatory frameworks (Essential Eight, SOCI, Cyber Security Act 2024) rather than European or US equivalents — buyers do not want to map your US FedRAMP narrative across to Australian requirements themselves.
• ☐ Hire or contract a locally credentialed pre-sales or technical resource in Sydney or Melbourne before your first enterprise conversations — remote pre-sales from offshore works for initial qualification, but not for proof-of-concept delivery.
• ☐ For New Zealand, review the NCSC Cyber Threat Report and the Minimum Cyber Security Standards to understand the NZ public sector procurement language — map your product to those standards as a secondary document set.
• ☐ Apply to relevant DTA procurement panels (BuyICT, Digital Marketplace) once you have an Australian entity and IRAP assessment — panel listing is a prerequisite for most federal government direct contracts.

Ongoing Compliance

• ☐ Set calendar reminders for SOCI CIRMP annual report deadline (90 days after financial year end) if your business is captured.
• ☐ Monitor Horizon 2 policy developments (2026–28) — new compliance obligations emerging from the strategy will generate fresh procurement triggers.
• ☐ Track ASD updates to the Essential Eight Maturity Model — product positioning tied to specific maturity level descriptors needs to be updated when the model changes.

Possibly. The SOCI Act's reach depends on whether your software is used by — or your service processes data on behalf of — a responsible entity for a critical infrastructure asset. The eleven sectors covered are broad, and the Critical Data Storage or Processing asset class was specifically designed to capture offshore and cloud-based service providers. If your software or SaaS product is used operationally by, for example, an Australian energy company, a financial institution, a telco, or a major hospital network, your customer may be a responsible entity and may contractually pass SOCI obligations (incident reporting windows, supply chain security requirements) down to you. Review the CISC obligations factsheet and seek Australian legal advice on your specific situation before signing enterprise contracts.

Not automatically under the turnover threshold, but there is an important caveat. The A$3 million annual turnover threshold applies to general businesses. However, if your business is (or becomes) a responsible entity for a critical infrastructure asset under the SOCI Act, the ransomware reporting obligation applies regardless of turnover. Additionally, your customers who are above the threshold will likely include ransomware reporting obligations in their supply chain contracts, so even if you are exempt from the direct statutory obligation, you may face contractual reporting obligations through your customer agreements. See the Home Affairs factsheet for the full criteria.

IRAP assessments are conducted by individual accredited assessors, and pricing and timelines vary based on the complexity of the system being assessed and the classification level (OFFICIAL vs. PROTECTED vs. higher). As a general guide, a cloud environment assessment for OFFICIAL:Sensitive workloads typically takes two to four months and can cost from A$30,000 to well over A$100,000 for a complex environment. Engaging an assessor early in your government sales process — rather than after winning a contract — is strongly recommended. The ACSC maintains a register of accredited IRAP assessors. Refer to the IRAP common assessment framework for the current scope and methodology.

Yes, meaningfully so. New Zealand's public sector is smaller and more centralised, procurement processes tend to involve more direct stakeholder engagement, and the frameworks you need to speak to are different — the NCSC's Minimum Cyber Security Standards rather than the Essential Eight, and the GCISO mandate rather than PSPF Policy 14. New Zealand also does not have an equivalent to IRAP — government agencies rely more heavily on vendor-provided security documentation and their own internal risk assessments. The NZ Government Marketplace (marketplace.govt.nz) is the procurement portal for government ICT contracts. Most foreign vendors find it more efficient to enter New Zealand through an Australian channel partner with existing NZ government relationships than to establish a separate New Zealand-specific go-to-market independently.

The 2023–2030 Australian Cyber Security Strategy signals that mandatory obligations will expand beyond the current federal government perimeter into the broader Australian economy during Horizon 2 (2026–28). The Horizon 2 consultation in mid-2025 attracted over 170 submissions, indicating substantial industry engagement with the direction of travel. For a foreign vendor building a long-term ANZ business, this means that features and certifications that are today only required for government sales — Essential Eight alignment, IRAP assessment, SOCI compliance tooling — are likely to become standard enterprise requirements within the strategy's timeframe. Building these capabilities early, rather than retrofitting them when mandated, is a meaningful competitive advantage.