Cyber security and data protection are now part of everyday governance, with increasing expectations from regulators, insurers, and industry stakeholders. At the centre of this is the concept of “reasonable steps”, and a growing need for industry associations to provide clear, practical guidance on what this looks like in practice.

“Reasonable steps” is commonly referenced in privacy and data protection obligations. In practice, this is less about complex technical controls and more about demonstrating that appropriate measures are in place to protect sensitive information. The Australian Cyber Security Centre’s Essential Eight is widely used across government and industry and is increasingly recognised by courts as the standard for assessing whether reasonable steps have been taken. It provides a practical and widely understood framework for reducing cyber risk.

Across industries, many cyber risks come from everyday situations rather than sophisticated attacks. These include email-based fraud, shared or misused login credentials, and inconsistent handling of information. A practical, principles-based approach is often the most effective way to reduce risk.

Clear, consistent communication also plays an important role. Overly technical language can create confusion, while plain English guidance helps improve understanding and supports better outcomes. Aligning messaging to recognised standards, and focusing on context rather than complexity, helps build confidence with members.

Industry associations are not expected to be cyber security specialists. Their role is to provide structure, consistency, and trusted guidance aligned to current expectations.

Harvey Norman Technology for Business supports this approach by working alongside associations to deliver practical education and clear, easy-to-use resources aligned to recognised standards.

To explore how we can support your members and association, visit:
https://www.harveynormanbusiness.com.au/pages/industry-associations