CREELMAN, Mr Ross, Associate Director, Digital, Cyber and Energy Policy, Australian Chamber of Commerce and Industry [by video link] Committee met at 10:04 CHAIR ( Ms Sitou ): Good morning and welcome to this public hearing of the Select Committee on Cyber Security for Small to Medium Sized Businesses and Organisations. I'd like to acknowledge the traditional owners of the land which we are all meeting from today and pay my respects to elders past, present and emerging. This hearing will be broadcast on the parliament's website, and the proof and official transcripts of the proceedings will be published on the committee's webpage. I remind members of the media who may be present or listening online of the need to fairly and accurately report the proceedings of the committee. I'd also like to take this opportunity to note that the committee has put out a survey to hear from small businesses and organisations about their experiences with cybersecurity. This is an easy way for smaller business owners to make their voices heard by the committee. The survey is still open, and I would encourage everyone to put this survey in. Finally, I'd like to remind all members, witnesses and observers that this hearing should be conducted in a respectful and orderly manner, and, if the proceedings are disrupted in any way, I will suspend the hearing until order is restored. This hearing is a legal proceeding of the parliament. The giving of false or misleading evidence is a serious matter and may be regarded as a contempt of parliament. The evidence given today will be recorded by Hansard and attracts parliamentary privilege. Welcome. I now invite you to make a brief opening statement before we proceed to questions. Mr Creelman : Thank you for the opportunity to appear here today. The Australian Chamber of Commerce and Industry warmly welcomes this committee's inquiry and the survey which has been undertaken. These are extremely timely activities and in the world of cybersecurity and business. I'm pleased to join you this morning from the lands of the Ngunnawal people in Canberra. ACCI is Australia's largest and most representative business network, representing businesses of all sizes, industries and regions, and small businesses are particularly important to that chamber network. We're pleased that you will be hearing later in the morning from some chamber members of the network. ACCI sits on the federal government's Executive Cyber Council, where I co-lead the small and medium business working group. On the international side of things, I serve as the vice-chair of the digital policy committee at the Business at OECD grouping. Our central message to the committee today is straightforward. For small business, the problem is not simply a lack of cybersecurity information or awareness; it is a capability and capacity problem. Small businesses know that cybersecurity is important, but many are operating with limited time, limited specialist expertise, and under significant cost and regulatory pressures. Our submission notes that, while around 70 per cent of small businesses identify cybersecurity as a priority, only 24 per cent report a high level of capability. There is already a considerable amount of good government guidance available. The challenge is making that guidance trusted, relevant, practical and easy for small businesses to implement. Many businesses lack the time, the resources, the expertise and, indeed, the confidence to act on that advice. The same principles should guide government regulation in this area. Cybersecurity requirements should be risk based and proportionate, reflecting the sensitivity of the information involved and the services a business provides. When it comes to government procurement, we should avoid onerous conditions that might exclude otherwise very capable small and medium enterprises from participation without delivering a commensurate security benefit. Ultimately our objective should be to help small businesses become more cyber resilient, rather than simply giving them more cyber reporting obligations. Thank you, and I look forward to the committee's questions. CHAIR: Thanks, Mr Creelman. I'm going to kick off with a couple of questions and then invite my colleagues to also ask some questions. I was very interested in your submission, particularly around the points you raised around making sure the guidance is provided to businesses with the size, sector and risk profile of the business in mind and that that needs to be delivered through trusted channels. I'm keen to hear from you about what you think that might look like in practice—because at the moment government guidance is more general and less industry-specific—and the way in which that guidance is provided is also more generalised. Trusted channels was I thought a really good point that you raised, so I'm keen to find out what you think those trusted channels would be. Mr Creelman : I think the important thing to bear in mind is that small businesses are busy and they are focused every day on the practicalities and the realities of doing business and the cost of doing business. When it comes to needing support or advice or guidance, there are some organisations that they would naturally turn to. Government advice, especially in the cybersecurity area, is extremely good. It's extremely up to date. But, as you mentioned, it is generalised and perhaps not necessarily targeted to a specific sector. I think the trusted channels that we would look at would be industry associations, many of which are sector specific and have an in-depth knowledge of the challenges facing a given sector, and of course also the broader small business and broader business chamber network. These are the mechanisms and the organisations that are best placed with contacts in the small business area to provide access to advice and training. One other thing I would mention is that, while there are organisations that are well equipped to disseminate advice and training, for example, one thing we are noticing—and this applies when it comes to cybersecurity and also, increasingly, with artificial intelligence—businesses and business organisations are constantly being overwhelmed by many new offerings on the market for training for advice. In some degree this is better than if there was a dearth of information and no advice was available. But it does complicate matters somewhat in the sense that a business or a business organisation finds itself overwhelmed with a lot of information and a lot of offerings when it comes to advice. CHAIR: That was certainly something that came through in some of the submissions—the different sources of advice that they had to go through, through different government agencies. I'd be keen to hear from you about this. What is the best way for government to provide this advice? I know there are different websites and different departments to look after specific parts that are general enough to be applied to small businesses but also specific enough that they are applicable where you would take a risk based approach to each of those industries. Mr Creelman : An important point here is that, while the government advice, as you recognise, is very good, it is general. When it comes to what role government could play in ensuring businesses and small businesses have access to the most appropriate advice and guidance, that would be an opportunity for government funded programs to support trusted intermediaries to provide that advice and training. CHAIR: One of the points that really came through from your submission was the need for guidance to complement growth and innovation. Oftentimes, the cybersecurity part of things is seen as more of a preventative cost centre as opposed to a way to drive growth and innovation. I'm interested to hear what your ideas are around how government guidance could be used to lean more into driving that growth agenda. Mr Creelman : I would look at this question from the point of view of seeing the opportunities in the cyber space, of course, rather than just firefighting and as a small business being ready to report a cyber incident or being ready to deal with a ransomware incident when that happens. Is it perhaps an important point to look at the training offered and the skills that we have in the workforce today in the sense that there is an increasing requirement for individuals joining the workforce to have technical skills, digital skills, however defined, and that within cyber there are many opportunities for growth and for contributing to business and economic growth in that sense. Our concern when it comes to the development of cybersecurity skills is that the path to becoming a cybersecurity expert is by no means clear. There are many different pathways that one can take many different levels of certification. It's really not as evident as other professions that one studies for. One takes a law degree and then gets a practising certificate and is well on the way to practising law. With something like cybersecurity, the concern is that, while the opportunities are there to develop a very robust Australian cybersecurity industry and thereby contribute to the growth and innovation about which we speak, like I said before, there is an overwhelming amount of information and options available to individuals for training, and that does complicate the landscape somewhat. CHAIR: I have one more question, and then I'll invite my colleague Ms Clutterham to ask some questions. The point you made about standards and training is something that has been raised by other organisations, as well as the difficulty in trying to have sunset standards and guidance. This is something that's will potentially be part of the CyberSmart rollout that the government is looking into to help support small businesses. How prescriptive do you think that needs to be? I know that there are standards out there currently. Is that the level of prescription that needs to be there in order for small businesses to really get an understanding of where they need to lift their capabilities? Also, what are your insights into the professionalisation of cybersecurity experts in being able to give small businesses confidence that they know that they've engaged someone who genuinely has expertise in this area? Mr Creelman : May I just ask for a clarification on the first point? In our submission, we referred to standards for technically applying cybersecurity principles and raising the cyber standard of business. Are those the standards to which you refer? CHAIR: Yes. Specifically, I think some people have said ISO 27001. Mr Creelman : Indeed. On this one, I don't think having access to that ISO 27001 standard, for example, is the silver bullet. If you purchase that standard and apply that to your business, it obviously does not mean that you are impenetrable to cyberattacks. It's an extremely robust start. It is costly. It does involve payment to have access to that ISO standard, and, while it's a very good one, it's by no means the only way to raise the cybersecurity standards and protections of a business. There are other industry developed standards on the market. One thing we did say, just as a side note, is that, since that standard is not referenced in Australian law, by way of compliance, it doesn't qualify for the budgetary measure that was introduced earlier this year to give access to standards. I think that's one thing that could be considered. That is a very useful standard. It's a very practical way to raise the cybersecurity of a business, and, simply because it isn't referenced in legislation, it doesn't qualify for that government funding. So that's one thing to bear in mind. I think, with appropriate training delivered by trusted partners and with appropriate guidance, whether that comes from a cybersecurity company providing advisory services, or whether that comes from, for example, a cyber insurance company providing cybersecurity services in addition to insurance products, there are many ways to get to a good standard of cybersecurity within a business. And the ISO standard or similar standards are just one useful example. Then, perhaps, on your second question on the professionalisation of cyber experts, one of Australia's biggest assets is its very skilled workforce. There are highly skilled cyber experts in the country, in companies and in government. Nuance that I would add is that, from a business point of view and from a small-business point of view, we can't let cyber, cyber training and cyber expertise become something of yesterday, something that is no longer as interesting or as attractive for students or young graduates to pursue in light of new and perhaps more exciting technological offerings. I think that is an extremely important aspect to underline. While we are looking at hiring individuals, digital skills and AI skills are now headline, but we can't let those very practical and fundamental cyber skills go by the wayside. The same applies to the most fundamental cyber skills, as well as to the highest levels of technical cyber expertise. CHAIR: Great. Thank you. I'll invite Ms Clutterham to ask some questions. Ms CLUTTERHAM: Thank you, Mr Creelman, for being with us this morning. I just had a couple of questions. Firstly, the summary of your submission provided to us and also the submission itself refer to procurement white tape. I think that is the way it's described. Then it talks about red tape imposed through procurement obligations, as is already the case with other compliance obligations, like ESG reporting and modern slavery requirements. I just wondered if you could unpack that a little bit. Obviously, compliance costs for small business are an issue, and we are hopeful that this inquiry will produce some recommendations that strike that balance between the need for compliance and the understanding that can be a cost and time burden on small business. What exactly is the procurement white tape that you're talking about here, and how does that affect small business? Mr Creelman : I will speak to the procurement white tape specifically in the cybersecurity context. I wouldn't be qualified to comment on the ESG and modern slavery reporting. For the procurement white tape, we're hearing from small businesses within our network about whatever service they may be offering to a public procurement process to government or the like, be that of a technical nature or be that something where cybersecurity is absolutely fundamental, if we're talking about IT services, telecommunications, et cetera, or even something perhaps as non-cyber as providing catering services and very practical things, like a coffee shop within government premises and this kind of question. I think our principal point would be, yes, we call for small businesses to be aware of and capable of raising their cybersecurity standard. That is fundamental. But our point would be about artificially setting a level of cybersecurity that is perhaps not necessary for the provision of those services and not necessary for the protection of the data involved, if we're providing services that have no bearing at all on the treatment of personal or sensitive information. From this point of view, what we would prefer to see is a more risk based and tailored model, where cyber standards are an essential, by all means, but where that has just become an additional line in a procurement contract. I think consideration should be perhaps given to that. Ms CLUTTERHAM: Just a follow on, that makes perfect sense to me, but is your evidence that the small to medium businesses that you deal with are telling you that, when they are contracting with government, there are wholly disproportionate requirements with respect to cybersecurity in contracts? I can't imagine that, if I'm providing the catering or the office plants, as small businesses do that, to a government department, there would be really—it's plants, right? Is the current position that there are already unrealistic and disproportionate requirements that a small business has to meet in order to provide services to government, even if the services are something which are quite divorced from a service which would involve personal or sensitive data? Mr Creelman : In a nutshell, that is our understanding, but, if you would like, I can perhaps take that on notice to provide some additional detail. Ms CLUTTERHAM: Thank you. My second question is just about the cyber insurance value and the evidence or the suggestion in the submission that small businesses don't see the point or see value in obtaining that. Do you have any understanding as to why? It did seem to me, from your submission and also the evidence, that small businesses understand that there are cyber risks facing them. They have got a capability gap. It just struck me that obtaining cyber insurance would be of really high value from a protection perspective, given that capability gap. Are you able to unpack that a little bit further? Mr Creelman : It certainly is the case that, when a small business is faced with the many costs of doing business and indeed the choices it has to make when it comes to insurance products, it is our understanding from the members that cyber is quite simply not the highest priority in insurance products. What I would say is that, just slightly tangentially, in the context of the Executive Cyber Council, which was established by the government a number of years ago, which is the working group which I co-lead together with COSBOA, we did a small project exploring cyber insurance market, and that was already two years ago. We will be repeating that exercise because we understand that the cyber insurance market itself has evolved considerably. One notable offering of the cyber insurance space is not just to, as an insurance company does, come in when things go wrong and support there but also to, before the fact, support businesses in raising the standard of cybersecurity. As an insurance product standalone, it's perhaps not the first product that a small business considers. The market has evolved. We understand that those additional services can be of great value to small business. Ms CLUTTERHAM: The type of cybersecurity insurance that a small business would procure if cost weren't an issue—what are the risks that insurance would cover? Is it phishing, hacking or loss of data? Is it ransom payments? What risks are being insured typically with the type of insurance we're talking about? Mr Creelman : I think I wouldn't be able to provide much more detail. It really depends on the product. There are some—it depends not only on the product but also on the companies. There are some insurance companies with a cyber branch. There are some very specialised cyber insurance companies. It really depends on the product in question. Ms CLUTTERHAM: We've heard about the capability gap, which I think is a really important way to start the hearings today. In your view, given the incredible range of small businesses—and the types of industries that they operate in, the range of turnovers, the number of staff et cetera—is there any baseline level of capability that you see as the bare minimum starting point for cyber capability, noting that not everyone's going to be able to meet the gold standard, for various reasons? What's the bare minimum that you think is necessary, based on what you're hearing from your stakeholders? Mr Creelman : We hear from our members that—I don't know if I would necessarily qualify it as the must-have baseline, but the Essential Eight provided by the government and by the ASD are extremely valuable. It can be viewed as a fundamental checklist and a very good place to start. The Essential Eight is referred to in a wide variety of places and contexts. As I said, I don't know if I would characterise it as the baseline. I don't know that that's necessarily helpful. But it is extremely valuable, and it's an extremely useful starting point for small business. Ms CLUTTERHAM: Hence your recommendation to extend the instant asset write-off to intangible software assets—I imagine that that is very much underscored by the Essential Eight and that evidence. Mr Creelman : Correct. Ms CLUTTERHAM: Thank you very much, Mr Creelman. CHAIR: I have one follow-up question for you, Mr Creelman, about the insurance piece. In your recommendations, you talk about data sharing between insurance companies and the government. I want to get some insights from you about—I had assumed that there was some level of data sharing. That's not the case. What would be a way for us to incentivise insurance companies to share some of that information with us? Mr Creelman : There are indeed legally mandated data-sharing obligations in place. For context, they are legislated under the Cyber Security Act, for example. There are also a number of mechanisms in place to limit data sharing, to protect businesses in the case of cyber incidents et cetera. Here, what we would be pointing out is that insurers being in a position to see constantly evolving cyber threats and trends—they are very well placed to provide, I suppose, non-sensitive and non-business-critical information to government to support broader cybersecurity efforts. It would be from that angle that we are talking. They're one step removed, of course, from the business at the coalface that may be going through a cyber incident. The insurance company is indeed well placed to provide that type of analytical information to government. CHAIR: Okay. Mr Abdo. Mr ABDO: I have one very quick question. It's often spoken about as a cost and as the government trying to impose a certain set of regulations. This is not a yes-or-no question. What's your view on whether businesses have a responsibility? If you've got an industry and you've got a supply chain, do businesses have a responsibility to implement a minimum set of standards? Because if I'm 'here' on the supply chain but the vulnerability is down 'there' then you're actually affecting my operations. So the view that it's only government imposing a set of regulations—is that fair? Or is it actually fair to also look at businesses needing to support one another? Mr Creelman : It's a very interesting one. I think cyber is one of those places and one of those topics where we see the need and the urgency for businesses to take steps to protect themselves and their supply chain. We see that primarily coming from the realities of doing business in the world today—from cyberthreats from wherever they may come from. It's one of those important places where I suppose the biggest cost of noncompliance is in fact not coming primarily from government but from the potential cost of what happens when something goes wrong, which can be extremely serious and debilitating for a business. I don't know that I would characterise it as a responsibility of a small business in a supply chain to make sure that everyone's ducks are in a row, but it's certainly one of these topics where everyone has a role to play. In that understanding, we do see that small businesses understand the risks, they understand the concerns, and, indeed, they do wish to raise the standard—their standard—of cybersecurity. It's in their own interest. It's in everyone's interest. What we would be calling for, as we've talked about this morning and in our submission, is support and a tailored and accessible guidance for those businesses. Mr ABDO: Thank you. CHAIR: Thanks very much, Mr Creelman, for joining us today and for the very detailed submission that was put forward. If you have been asked to provide any additional information, including questions on notice, please send it to the secretariat by Tuesday 20 October. Please note that responses to questions on notice will be published on the website as submissions to the inquiry. You will be sent a copy of the transcript of your evidence, and you will have an opportunity to request corrections to transcription errors..