Contract Law
Background
- In Australia, contract law is primarily governed by the common law, with specific legislation applying to certain types of contracts (such as consumer, goods, or insurance contracts).
- Cyber issues, including emerging technologies, security risks, and threats, can significantly affect how a contract is drafted, performed, breached, or terminated. They are now a central consideration for contracting parties when allocating risk.
- Cyber risks arise from the use and transmission of electronic data, including through the internet and telecommunications networks. These risks can involve fraud through misuse of data, liability linked to data storage, physical damage, and threats to the availability, confidentiality, and integrity of electronic information held by companies, governments, or individuals.
- When drafting a contract, parties can allocate liability through specific terms dealing with compliance with data protection law, control systems, data storage and segregation, data transfer, force majeure, insurance, and supply operations. Contracting practice is trending towards embedding express cyber security terms into agreements.. For example, the Commonwealth has published model clauses for information and communications technology (ICT) procurement that address cyber insurance, digital security, and data protection. These clauses can be bespoke drafted to reflect the risks of a particular project, but ordinarily require:
- appropriate levels of cyber insurance, with terms linked to the assessed level of cyber risk;
- compliance with government security frameworks such as the Protective Security Policy Framework (PSPF), the Essential Eight maturity model, and the Information Security Manual (ISM);
- independent assessments under the Infosec Registered Assessors Program (IRAP) and preparation of Commonwealth Data Protection Plans (CDPPs) where relevant;
- restrictions on high-risk practices such as data mining or reliance on unpatched open-source code; and
- obligations for audit, performance management, and remedial action if security requirements are breached.
Legal Framework
Common law
- A person who signs a contract is bound by it, in the absence of fraud, misrepresentation, or other vitiating factors, regardless of whether they have read or understood it: L’Estrange v Graucob [1934] 2 KB 394.
- External evidence cannot be admitted to add to, contradict, vary, or subtract from the terms of a contract: Codelfa Construction Pty Ltd v State Rail Authority (NSW) (1982) 149 CLR 337. This is the "parol evidence rule". The rule also limits the use of such evidence when construing the meaning of a contractual term: McCourt v Cranston [2012] WASCA 60.
Giving meaning to the terms of a contract
- The purpose of construing a written contract is to identify and give effect to the common intention of the parties as expressed in its terms: Australian Broadcasting Commission v Australasian Performing Right Association Ltd [1973] HCA 36; (1973) 129 CLR 99. That intention is to be ascertained by reference to what a reasonable person in the position of the parties would understand from the language of the contract, rather than by reference to the parties’ subjective aspirations, expectations, or intentions: Codelfa Construction Pty Ltd v State Rail Authority (NSW) (1982) 149 CLR 337. This reflects the objective approach to construction: Simic v New South Wales Land and Housing Corporation [2016] HCA 47; (2016) 260 CLR 85.
- The natural, ordinary, or plain meaning of the words used by the parties in expressing a term will prevail unless the context requires a different meaning. However, where adopting that approach would lead to an absurd, uncommercial, or unreasonable outcome, the courts may add to, vary, contradict, or subtract from the words in order to resolve the ambiguity.
- Subject to the Australian Consumer Law in Schedule 2 of the Competition and Consumer Act 2010 (Cth), exclusion clauses may operate to remove or reduce liability that would otherwise arise from breach of contract.
- The construction of an exclusion clause is governed by the ordinary rules of interpretation. Where the meaning of such a clause is uncertain, the clause will be read against the interests of the party who drafted it: Darlington Futures v Delco [1986] HCA 82; (1986) 161 CLR 500.
- Exclusion clauses are subject to a number of common law limitations:
- they cannot protect a party who acts outside the scope of the contract: Gihaud v Great Eastern Railway [1921] 2 KB 426;
- they will not operate in the case of an intentional breach of contract, unless express words indicate otherwise: David v Pearce Parking Station [1954] HCA 44; (1954) 91 CLR 642;
- they may not exclude liability for loss where there has been a departure from an agreed contractual path: Thomas National Transport v May & Baker [1966] HCA 46; (1966) 115 CLR 353; and
- they will only exclude liability for negligence where the wording is clear and unequivocal (for example, “at owner’s risk” or “not responsible for loss or damage of any description”): David v Pearce Parking Station [1954] HCA 44; (1954) 91 CLR 642.
- Legislation also restricts the use of exclusion clauses in some contexts, particularly in consumer and tenancy law. For example, the National Credit Code (National Consumer Credit Protection Act 2009 (Cth) Sch 2) prevents contracting out of protections for credit buyers, and residential tenancy legislation in each jurisdiction prohibits exclusion of statutory tenant protections (see, e.g., Residential Tenancies Act 2010 (NSW) s 219).
- Under s 64 of the Australian Consumer Law (ACL), any clause that seeks to exclude the consumer guarantees implied by the ACL in contracts for the supply of goods or services is void. The definition of “consumer” in s 3 extends to purchases under $40,000, even when made for business purposes. Section 64 is qualified by s 64A, which permits limitation clauses where goods or services are not ordinarily acquired for personal, domestic, or household use. Such clauses may limit liability to repair or replacement of goods, or resupply of services, provided the limitation is fair and reasonable. The statutory criteria for fairness include the parties’ relative bargaining strength, the availability of alternatives, the buyer’s awareness of the term, and whether goods were specifically manufactured for the buyer.
- Further, s 139A of the Competition and Consumer Act 2010 (Cth) allows corporate suppliers of recreational services to exclude or limit liability for failure to exercise due care and skill, or for materials not being fit for purpose.
- Courts may also rely on general statutory powers to address the impact of exclusion clauses, including provisions on unconscionable conduct (ACL ss 20–21) and misleading or deceptive conduct (ACL s 18). In some jurisdictions, there are additional legislative controls on clauses excluding liability for pre-contractual misrepresentation. For example, the Civil Law (Wrongs) Act 2002 (ACT) s 176 and the Misrepresentation Act 1972 (SA) s 8 subject such clauses to a test of fairness and reasonableness.
The doctrine of frustration
- A contract may be discharged by frustration when an unforeseen event occurs that makes performance impossible, or makes it so different from what was originally agreed that it would be unjust to hold the parties to it. The event must not be caused by either party’s fault.
- Two conditions must be satisfied:
- there must be a radical change in circumstances, so that the situation for performance is fundamentally different from what was agreed; and
- because of that change, the obligations of one or both parties have become incapable of being performed.
- The doctrine of frustration may apply where:
- performance has become illegal;
- there is a serious delay that undermines the purpose of the contract;
- a party dies or becomes permanently incapacitated;
- the subject matter of the contract is destroyed;
- the main purpose of the contract is destroyed; or
- a state of affairs essential to performance disappears.
- The doctrine does not apply where:
- the risk was already covered by the contract (often through a “force majeure” clause): Codelfa Construction Pty Ltd v State Rail Authority of NSW (1982) 149 CLR 337;
- the event was reasonably foreseeable when the contract was made, and the parties chose not to provide for it: Davis Contractors Ltd v Fareham UDC [1956] UKHL 3; [1956] AC 696; or
- the event was caused by one of the parties, sometimes called “self-induced frustration”: F C Shepherd & Co Ltd v Jerrom [1987] 1 QB 301.
Vitiation for mistake
- A mistake is a misapprehension about a fact, law, or circumstance that affects the substance of a contractual obligation or a party’s motive for entering into the contract.
- Mistakes made during negotiations can have a variety of legal consequences, depending on the parties’ intentions and conduct, the cause and effect of the mistake, and the way the mistake is classified. However, a mistake will not of itself prevent the formation of a valid contract. Contracting parties are generally expected to protect their own interests. For example, a purchaser who acquires goods or property that do not meet their expectations usually cannot avoid the contract unless there is a warranty or some misleading conduct to support a remedy.
- Mistakes can, however, affect the content or even the existence of a contract. In Australian law, these are generally addressed through established doctrines rather than a single overarching “law of mistake.” The main categories are:
1. Common mistakes (shared assumptions)
- Where both parties are in agreement but share the same mistaken belief, such as:
2. Mutual or unilateral mistakes (parties not in true agreement)
- Where the parties are not truly ad idem (not of the same mind), for example:
- The available remedies for mistake include:
- rescission, which sets aside the contract and restores the parties to their original positions; and
- rectification, which corrects the written record of the contract to reflect the parties’ true agreement.
Unfair dealing—duress
- Duress is the use of pressure to obtain a benefit, such as a party’s agreement to enter into a contract. It makes the contract voidable at the option of the innocent party, because consent was not freely given.
- To establish duress, four elements must usually be shown:
- Pressure was applied by, or on behalf of, one party in relation to the transaction;
- The pressure took the form of unlawful threats or conduct, or (in some cases) lawful conduct that is nevertheless considered illegitimate: Crescendo Management Pty Ltd v Westpac Banking Corporation (1988) 19 NSWLR 40;
- The pressure caused or contributed to the other party’s agreement to the transaction; and
- In the circumstances, the victim’s assent was reasonable, meaning there was no practical alternative but to submit.
- The boundary between legitimate and illegitimate pressure is not always easy to define, since some degree of pressure is common in commerce.
- Physical pressure, such as threats of violence, will almost always amount to duress.
- Legal pressure, such as threats of litigation, may or may not be legitimate depending on the circumstances.
- Economic pressure, such as threats to breach a contract or withhold supply, is more controversial. Allegations are often made but rarely succeed: Merrion Pty Ltd v Loustas [2017] VSC 95. The NSW Court of Appeal in Australia & New Zealand Banking Group Ltd v Karam [2005] NSWCA 344; (2005) 64 NSWLR 149 suggested that duress should be confined to actual or threatened unlawful conduct, with cases of “lawful but improper” pressure instead falling under undue influence or unconscionable conduct. The High Court has not yet resolved this issue: Thorne v Kennedy [2017] HCA 49; (2017) 263 CLR 85.
- Official pressure refers to unlawful demands made by public officials (sometimes called “official exactions”).
- The usual remedy for duress is rescission, which makes the contract voidable. Money paid under duress can be recovered as money had and received, and in some cases damages may also be awarded.
Unfair dealing—misrepresentation
- A misrepresentation is a false statement of past or existing fact made to another person and calculated to induce that person to act. Most often, the action is to enter into a contract with the maker of the representation. A misrepresentation is actionable if it induces the recipient to enter into the contract or otherwise take the action. There are three categories of misrepresentations:
- Innocent misrepresentation: an honest but false pre-contractual statement of past or existing fact which, at least in part, induces the recipient to contract. The statement must occur in the course of negotiations: Carr v Westward Ho Gold Development NL (1938) 12 ALJR 312.
- Fraudulent misrepresentation: a false statement made without any honest belief in its truth, with the intention that it induce the recipient to act on it. Fraud may arise even where the purpose was not to induce a contract, provided the intent was to cause detrimental reliance: Commercial Banking Co of Sydney Ltd v RH Brown & Co [1972] HCA 24; (1972) 126 CLR 337.
- Negligent misrepresentation: where a statement is made carelessly or without reasonable grounds for believing it to be true.
- To establish misrepresentation, two elements must be shown:
- a false statement of fact or law, relating to the past or present; and
- proof that the other party was misled by, or reasonably relied upon, the statement when entering into the contract: Public Trustee v Taylor [1978] VicRp 31; [1978] VR 289.
- Not every statement amounts to a misrepresentation. Excluded categories include:
- sales talk or puffery;
- opinions, unless the representor is in a better position to know the facts, or implies an opinion they do not genuinely hold: Fitzpatrick v Michel [1928] NSWStRp 19; (1928) 28 SR (NSW) 285;
- predictions or future intentions, unless there was never a genuine intention to carry them out; and
- advice or belief, which may be unwise but are not false statements of fact.
- That said, promises, predictions, and opinions may still give rise to liability if they carry implied misrepresentations of fact and are reasonably relied upon: R v Sunair Holidays Ltd [1973] 1 WLR 1105.
- Silence is not generally actionable, but a duty to disclose arises where:
- a statement, though literally true, gives a misleading impression: Davies v London Provincial Marine Insurance Co (1878) 8 Ch D 469;
- a statement was true when made but later becomes false; or
- the representor stands in a fiduciary relationship to the other party.
- The remedies available depend on the type of misrepresentation:
- Rescission is available for both innocent and fraudulent misrepresentation, setting aside the contract and restoring the parties to their original positions: Redgrave v Hurd (1881) 20 Ch D 1.
- Damages are available for fraudulent and negligent misrepresentation, but not for innocent misrepresentation.
Termination
- A contract may be terminated in several ways, depending on its terms, the conduct of the parties, and rights under statute.
- By agreement:
- A contract may specify that it operates for a fixed duration only. Where a contract is silent, a right to terminate may be implied in appropriate circumstances.
- The parties may agree to include a right to terminate, or may later release each other by a subsequent agreement.
- A court may infer mutual abandonment where the parties fail to perform for a substantial period, or otherwise act in a way that shows an intention not to continue.
- For breach:
- Breach of a condition gives the innocent party an immediate right to terminate: Tramways Advertising v Luna Park [1938] HCA 66; (1938) 61 CLR 286.
- Serious breach of an intermediate (or innominate) term may justify termination if the breach goes to the root of the contract: Koompahtoo Local Aboriginal Land Council v Sanpine Pty Ltd [2007] HCA 61; (2007) 233 CLR 115; Hongkong Fir Shipping Co Ltd v Kawasaki Kisen Kaisha Ltd [1961] EWCA Civ 7; [1962] 2 QB 26.
- If time is expressly or impliedly “of the essence”, delay justifies termination. Where time is not essential, an innocent party may serve notice making time essential if delay is unreasonable: Louinder v Leis [1982] HCA 28; (1982) 149 CLR 509; Legione v Hateley [1983] HCA 11; (1983) 152 CLR 406.
- Failure of a condition precedent or subsequent may end the contract, unless waived. If one party induces another to believe rights will not be exercised, remedies under the ACL (ss 18, 237) may apply: Edensor Nominees Pty Ltd v Anaconda Nickel Ltd [2001] VSC 502.
- Repudiation and anticipatory breach:
- A contract may be terminated where a party shows an unwillingness or inability to perform essential obligations before performance is due.
- The right arises only if the innocent party is ready and willing to perform its own obligations: Foran v Wright [1989] HCA 51; (1989) 168 CLR 385.
- Repudiation must relate to a condition or essential term. There can be no anticipatory breach of a warranty, and by definition none of an intermediate term, since seriousness depends on the consequences of actual breach.
- Courts favour construing terms as intermediate, to encourage performance rather than avoidance (Ankar Pty Ltd v National Westminster Finance (Aust) Ltd [1987] HCA 15; (1987) 162 CLR 549). Express language (“condition”, “essential”, “fundamental obligation”) is convincing but not conclusive evidence of classification: Gumland Property Holdings Pty Ltd v Duffy Bros Fruit Market [2008] HCA 10; (2008) 234 CLR 237; L Schuler AG v Wickman Machine Tools Sales Ltd [1973] UKHL 2; [1974] AC 235.
- Conditions: Breach permits termination and damages.
- Warranties: Breach gives damages only, not termination.
- Intermediate (or innominate) terms: Breach justifies termination only where the consequences are sufficiently serious to deprive the innocent party of substantially the whole benefit of the contract (Hongkong Fir; Koompahtoo).
- Statutory rights of termination
- The ACL provides additional statutory bases for termination:
- Consumer guarantees: Where goods or services fail to comply with a guarantee, a “major failure” entitles the consumer to reject them and terminate the contract. A failure is major if, among other things, the goods or services are substantially unfit for purpose, unsafe, or would not have been acquired if the consumer had known of the issue: ACL, ss 259–267.
- Unfair contract terms: An unfair term in a standard form consumer or small business contract is void. If the unfair term is a condition, and the remaining agreement cannot stand without it, then it may need to be rescinded: ACL, ss 23–28.
- Misleading or deceptive conduct: Contracts induced by misleading or deceptive conduct may be set aside or rescinded under ACL s 237.
- Unconscionable conduct: Where a contract is procured through statutory unconscionable conduct (ACL ss 20–22), the agreement may be rescinded.
- Other statutes may also confer termination rights in specific contexts (e.g., residential tenancies, credit contracts, and franchising).
- Election to terminate or affirm
- An innocent party may elect to terminate, ending future obligations, or affirm, continuing the contract and losing the right to terminate.
- Affirmation requires knowledge of the facts and unequivocal conduct consistent with continuation.
- Termination must be clearly communicated by words or conduct (e.g., refusing performance, preventing one’s own performance, or filing pleadings based on termination): Holland v Wiltshire [1954] HCA 42; (1954) 90 CLR 409; Perri v Coolangatta Investments Pty Ltd (1982) 149 CLR 537.
- Communication is generally not required if termination is otherwise unequivocal: Tropical Traders Ltd v Goonan [1964] HCA 20; (1964) 111 CLR 41.
Rescission
- Rescission is an equitable and discretionary remedy that sets aside a contract and restores the parties, as far as possible, to their pre-contractual positions (restitutio in integrum): Alati v Kruger [1955] HCA 64; (1955) 94 CLR 216.
- Rescission is available where a contract is vitiated by:
- mistake;
- misrepresentation;
- duress;
- undue influence;
- unconscionable dealing; or
- breach of fiduciary duty: Yerkey v Jones [1939] HCA 3; (1939) 63 CLR 649.
- The essence of rescission is the restoration of benefits. Precise restoration is not required, but substantial restoration must be possible. Equity may make ancillary orders (e.g. accounts, compensation, indemnities, allowances for use or improvements) to achieve justice: Alati v Kruger [1955] HCA 64; (1955) 94 CLR 216. Where restoration is impossible, rescission will ordinarily be refused, particularly if the party seeking relief has destroyed or substantially altered the subject matter: Brown v Smitt [1924] VLR 333.
- Rescission may be barred where:
- the contract has been affirmed after discovery of the vitiating factor;
- rights in the subject matter have passed to a bona fide third party: McKenzie v McDonald [1926] VicLawRp 74; [1927] VLR 134;
- substantial restoration is impossible (e.g. subject matter destroyed, or rescission would change the nature of the bargain and immunise a party from commercial risk): Akron Securities Ltd v Iliffe (1997) 41 NSWLR 353;
- there is no total failure of consideration in relevant sale of goods cases: Watt v Westhoven [1933] VLR 458;
- delay or laches makes rescission inequitable. Equity may deny relief where delay results in prejudice, change of circumstances, or unjust advantage: Henjo Investments Pty Ltd v Collins Marrickville Pty Ltd [1988] FCA 40; (1988) 39 FCR 546; Fysh v Page [1956] HCA 13; (1956) 96 CLR 233.
- The rule in Seddon’s case:
- At common law, once a contract has been fully executed, rescission is barred for innocent misrepresentation (Seddon v North Eastern Salt Co Ltd [1905] 1 Ch 326).
- This rule does not apply where there is fraud or a total failure of consideration: Svanosio v McNamara [1956] HCA 55; (1956) 96 CLR 186; Krakowski v Eurolynx Properties Ltd (1995) 183 CLR 563.
- The scope of the rule remains debated in Australia. Some courts have declined to apply it (Vimig Pty Ltd v Contract Tooling Pty Ltd (1986) 9 NSWLR 731; Baird v BCE Holdings Pty Ltd [1996] NSWSC 376; (1996) 40 NSWLR 374), though it has been cited with approval by the High Court in Krakowski.
- The rule has been statutorily modified or abolished in several jurisdictions, including:
- No equivalent reforms exist in Qld, WA, Tas or the NT. The UK has abolished the rule via the Misrepresentation Act 1967 (UK).
- Courts may refuse relief where it would operate disproportionately, unfairly prejudice the other party, or be inconsistent with equitable principles of fairness. Relief may be granted on such terms as are necessary to do justice between the parties.
Damages
- Damages are the primary common law remedy for breach of contract. They are available as of right once a breach is established, even if no actual loss is proved (in which case only nominal damages will be awarded): Hawkins v Clayton (1988) 164 CLR 539; Bowen v Blair [1933] VicLawRp 50; [1933] VLR 398. Equity may also award damages in some cases.
- The object of damages is compensatory: to place the innocent party in the position they would have been in had the contract been performed (expectation damages): Robinson v Harman [1848] EngR 135; (1848) 1 Ex 850; Commonwealth v Amann Aviation Pty Ltd [1991] HCA 54; (1991) 174 CLR 64.
- Expectation damages protect the value of the promise itself.
- In some cases, damages may be measured by the reliance interest (expenses incurred in reliance on the contract), especially where expectation damages are uncertain: Amann Aviation [1991] HCA 54; (1991) 174 CLR 64.
- Gains made by the defaulting party are usually irrelevant, unless they bear upon the value of the plaintiff’s loss.
- Liquidated damages and penalties
- A clause fixing damages for breach is enforceable if it is a genuine pre-estimate of loss.
- It is unenforceable as a penalty if it is extravagant or out of proportion: Dunlop Pneumatic Tyre Co Ltd v New Garage & Motor Co Ltd [1914] UKHL 1; [1915] AC 79; applied in Ringrow Pty Ltd v BP Australia Pty Ltd [2005] HCA 71; (2005) 224 CLR 656.
- The modern High Court approach focuses on whether the clause protects a legitimate interest of the innocent party, and whether the stipulated sum is out of all proportion: Paciocco v ANZ Banking Group Ltd (2016) 258 CLR 525.
- Rule in Bain v Fothergill
- Where a vendor of land cannot convey good title through no fault of their own, expectation damages for loss of the bargain are not available: (1874) LR 7 HL 158.
- The rule has been confined and does not apply in all jurisdictions.
- A causal connection between breach and loss must be shown: Burns v MAN Automotive (Aust) Pty Ltd (1986) 161 CLR 653.
- The innocent party is not under a duty to mitigate, but cannot recover for losses that could reasonably have been avoided. The ensures damages are proportionate: British Westinghouse Electric v Underground Electric Railways [1912] AC 673.
- The Sale of Goods Act 1923 (NSW) codifies important aspects of contract law in relation to the sale of goods.
- Unless excluded by the contract, the Act implies a number of conditions into contracts for the sale of goods. These implied conditions parallel and are now supplemented by the statutory consumer guarantees in the Australian Consumer Law (ACL ss 51–57).
- The seller has the right to sell the goods (s 17).
- Goods must match their description (s 18).
- Goods must be reasonably fit for any disclosed purpose, where the buyer relies on the seller’s skill or judgment (s 19(1)).
- Goods must be of merchantable quality, subject to exceptions for defects brought to the buyer’s attention (s 19(2)).
- In sales by sample, the bulk must correspond with the sample and the buyer must have a reasonable opportunity to compare them (s 20).
- The Act contains special provisions for consumer sales (ss 62–64).
- Contracting out of these protections is prohibited.
- Manufacturers or importers may be joined to proceedings and held liable in a limited way (s 64(5)–(6)).
- Breach of a condition entitles the buyer to reject the goods or treat the breach as one of warranty.
- Breach of a warranty does not allow rejection, but the buyer may:
- set up the breach in reduction or extinction of the price; or
- bring an action for damages (s 54).
- The measure of damages is the loss directly and naturally resulting from the breach (s 54(2)). In the case of a breach of warranty of quality, the prima facie measure is the difference between the value of the goods at delivery and the value they would have had if they complied with the warranty (s 54(3)).
- Consequential losses may also be recovered, provided they meet the test of remoteness.
‘Pass-through’ contractual obligations
- ‘Pass-through’ (or ‘flow-down’) clauses are contractual terms that require a party to impose identical or equivalent obligations onto its own third-party service providers, such as cloud service providers or other IT outsourcers. In the context of cyber security, these clauses are a critical mechanism for managing supply chain risk. For example, many merchant contracts contain clauses that require compliance with the Payment Card Industry Data Security Standards (PCI DSS), a self-regulatory framework initiated by major credit card providers.
- However, the original entities subject to the obligations who have delegated responsibility to a third party will not necessarily escape liability under the legal instrument imposing the obligations; this depends on the drafting of the original instrument. Additionally, the third party will have contractual liability, but in most cases they will not have direct liability under the common law or the relevant code of conduct or legislation.
- A notable exception to the above principle that third party contractors are only liable in contract to their head contractor can arise from the operation of the current Security of Critical Infrastructure Act 2018 (Cth) (SOCI). For example, cloud service providers now attract direct obligations under that Act due to their inclusion as the ‘data storage or processing’ industry sector. These obligations will be in addition to any contractual obligations they have with other entities.
- Pass-through clauses can and often do require compliance with relevant standards, such as:
- ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements
- ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls
- The Australian Cyber Security Centre's Information Security Manual (ISM)
Regulatory & Policy Framework
- ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements
- ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls
- The Australian Cyber Security Centre's Information Security Manual (ISM)
Relevant Organisations
Industry Materials