bcom ICT helps Australian financial services businesses lift and evidence their cyber resilience. That means a gap assessment against the ASD Essential Eight, mapped to the expectations ASIC set out in its May 2026 open letter to AFS licensees; remediation in priority order; and documented controls you can produce to your licensee, an auditor or ASIC. bcom ICT does not provide legal or compliance advice. Delivered Gold Coast and Australia-wide. Call 07 3041 8993.
Licensees carry an obligation most businesses don't
For an AFS licensee, cyber resilience is part of the general obligations in s912A of the Corporations Act. In a May 2026 open letter to AFS licensees, ASIC described it as a core licensing obligation rather than an IT issue.
It's a licence obligation, not best practice
AFS licensees must maintain adequate risk management systems and resources under their general obligations. ASIC has taken licensees to court over cyber failures: RI Advice in 2022, and FIIG Securities in 2026, ordered to pay $2.5 million.
Evidence matters as much as controls
Having multi-factor authentication switched on is necessary. Being able to demonstrate, in writing, when it was implemented, who it covers and how it is reviewed is what an assessment actually turns on.
Your suppliers count too
Outsourced arrangements — including your IT provider — form part of the picture. Which is exactly why our own position is published in full on our trust centre rather than asserted.
Incidents have reporting paths
A breach can trigger obligations to ASIC, to the OAIC under the Notifiable Data Breaches scheme, to your PI insurer, and potentially ransomware payment reporting. They are separate duties and satisfying one does not satisfy the others.
Assess, remediate, document
1. Gap assessment
Where you are now against the ASD Essential Eight, mapped to what ASIC's letter asks of licensees, including your outsourced arrangements. Written up plainly, ranked by exposure.
2. Remediation
Closing the gaps in priority order — MFA coverage, patching, backups that are separated and tested, access control, logging that would let you establish what happened.
3. Evidence pack
Policies, control descriptions, implementation dates, review schedule and incident response plan. The thing you actually produce when asked.
Who this is for
- AFS licensees and their authorised representatives, including small licensees: what counts as adequate scales with the business, but the obligation does not go away
- Financial planners and advice practices holding client financial and identity information
- Insurance brokers handling claims and personal information
- Mortgage and finance brokers, credit licensees or their representatives, with comparable obligations and typically more identity documents than they realise
- Accountants and bookkeepers, whose duties come from the Privacy Act's TFN Rule and the Tax Practitioners Board rather than an ASIC licence
- Any practice whose PI insurer has started asking harder questions at renewal
What licensees actually get asked
These six questions come up in nearly every compliance conversation in this sector.
“We’ve had a questionnaire from our licensee”
Usually an authorised representative being asked to evidence controls they have never documented, often at short notice.
What we do Assess against the expectations, produce the evidence pack, and close the gaps in priority order. Being able to answer honestly matters more than answering well.
“Our PI renewal is asking about cyber”
Usually professional indemnity and cyber questionnaires have got materially harder, and the answers are no longer obvious.
What we do Establish the true position first — MFA coverage, patching, backup testing, endpoint protection — then close what is missing so the answers are accurate rather than optimistic.
“We outsource IT, so isn’t it their problem?”
Usually a common and dangerous assumption. Outsourced arrangements form part of your compliance picture; the obligation stays with the licensee.
What we do Document what your provider does, what they are responsible for, and what remains yours. That oversight is itself part of what is expected.
“We don’t hold much client data”
Usually an underestimate, almost always. Advice practices hold identity documents, financial statements and TFNs — a dense concentration by any measure.
What we do Inventory what is actually held and where. The volume is usually a surprise, and it is the basis for everything else.
“Our adviser works from home two days a week”
Usually client information on a device outside the office, often unmanaged, sometimes personal.
What we do Bring those devices under management with encryption and remote wipe, and put access behind MFA. Hybrid working is fine; unmanaged hybrid working is the exposure.
“What happens if we have a breach?”
Usually no incident response plan, so the first fifteen minutes get improvised at the worst possible time.
What we do Write the plan, name who does what, and know in advance which obligations engage — ASIC, the OAIC under the NDB scheme, your PI insurer. They are separate duties.
What a compliance engagement looks like
Representative engagements, drawn from real work with identifying detail removed — we don’t name clients without written permission.
An authorised representative asked to evidence controls
The situation
A Gold Coast advice practice operating under a licensee received a compliance questionnaire asking specifically about cyber controls, with a four-week deadline.
What we found
Most controls existed. Almost nothing was documented. MFA was on for four of seven staff, patching was inconsistent across machines, and there was no written record of who had access to what or when it had last been reviewed.
What we did
Ran a gap assessment against ASIC’s expectations and the Essential Eight, closed the MFA and patching gaps, built an access register and a short incident response plan, and produced a written evidence pack with implementation dates.
The outcome
The questionnaire was answered with documents rather than assurances. The practice now has an evidence pack that updates rather than being rebuilt each time it is asked for.
A broker whose IT provider was the gap
The situation
A Gold Coast mortgage broking practice was confident about its own controls but had never considered its outsourced arrangements.
What we found
The IT provider had shared administrative access across technicians with a common password, no MFA on their own management tooling, and no documented process for revoking access when their staff changed. The practice had no visibility of any of it and no contractual position on it.
What we did
Documented the supplier arrangement, set out what the practice should require, and — after the practice moved to us — implemented individually named technician access with MFA enforced, plus access reviews on staff change.
The outcome
The practice can now evidence oversight of its outsourced IT, which is an explicit part of what is expected and the part most licensees overlook entirely.
An incident plan written before it was needed
The situation
A Gold Coast financial services practice had controls in reasonable shape but no documented incident response plan, and asked whether it mattered.
What we found
It mattered more than they expected. Nobody could say who would make the notification decision, which obligations engaged, or who to call first. Their PI policy required notification before engaging any external party, which nobody had read.
What we did
Wrote a short plan naming responsibilities, the sequence for the first hour, and the separate obligations to ASIC, the OAIC under the NDB scheme, and the insurer. Ran it through with the team so it was not the first time anyone had seen it.
The outcome
Four months later a staff member clicked a credential harvesting link. The plan was followed, the insurer was notified in the right order, and the whole thing was contained inside a morning.
Questions Gold Coast businesses ask us
What does ASIC require for cybersecurity?
ASIC expects Australian financial services licensees to manage cyber risk as part of the adequate risk management systems and resources required under their general licence obligations, and restated that in a May 2026 open letter to AFS licensees and market participants. It is not a new rule, and the letter sets no standard to certify against. In practice that means implemented controls, documented evidence of them, oversight of outsourced arrangements including IT providers, and a workable incident response plan. bcom ICT delivers gap assessment, remediation and evidence for licensees Gold Coast and Australia-wide.
We're a small licensee. Does this really apply to us?
Yes. The obligation comes with the licence, whatever your size. What changes with size is what counts as adequate: ASIC expects controls proportionate to the size, nature and complexity of the business. Small licensees are often caught out by assuming otherwise, and their PI insurer asks the same questions regardless of headcount.
Does bcom ICT provide legal or compliance advice?
No. We handle the technical controls, the assessment against recognised frameworks, and the evidence pack. Interpretation of your specific licence obligations is a matter for your compliance adviser or lawyer, and we work alongside them rather than in place of them.
What if we're asked for evidence tomorrow?
Tell us the deadline when you call, and we will say honestly what can be done by then. It is far better to be able to show a documented plan with dates against it than to show nothing at all.
Does this cover the Notifiable Data Breaches scheme?
We cover it as part of incident response planning, because a breach at a financial services business almost always engages it. The notification obligation itself remains yours — see our NDB guide for how that division works.
Are you certified to any standard for this work?
No, and we will not imply otherwise. bcom ICT aligns its own practices with ISO/IEC 27001:2022 and operates to the ASD Essential Eight, but holds no organisational certification. Our trust centre sets out exactly what is held and what is aligned.
Renewal questionnaire getting harder?
That's usually the trigger. A gap assessment tells you what you can honestly answer and what needs closing first.