IAA Newsletters

We’re proud to support the 2nd annual Data Centre Real Estate Summit – bringing together the big players in tech, real estate, and investment to shape the future of Australia’s data centre landscape.

Date: 19 June 2025
Venue:  Doltone House, Sydney
Member discount code: DCRE25IAA

Read More

With the federal election over and a returning Labor Government, we anticipate busy times ahead. Regulatory reform for the telco sector is already well underway with the:

  • Security of Critical Infrastructure (SOCI) obligations – commenced 4 April;
  • new ACMA rules relating to network outages involving communication requirements and changes to your complaints handling policy – commencing 30 June; and
  • changes to the TIO’s complaints handling processes – commencing 1 July.

We’re proud to say that our advocacy work has had some impact in reducing some of the burdens on industry. We’ve managed to ensure the positive security obligations under the SOCI framework will be limited to carriage service providers with over 20,000 services in operation (or those that supply to government). Our consistent engagement with the ACMA has also resulted in the regulator releasing more educative information alongside new regulation.

You can read more about the SOCI obligations in this newsletter article, the ACMA rules on its website and the TIO changes on the TIO Portal. We are also working on developing updated legal templates that are compliant with the new ACMA rules and will make them available on the IAA Member Portal in due course so please keep posted!

In March, a telecommunications consumer protections Bill was tabled at Parliament to introduce the CSP Register, give the ACMA directly enforceable powers and increase penalties for non-compliance. Though this lapsed due to the election, we anticipate this will be prioritised by the new or returning Communications Minister.

Other things to watch out for includes a new domestic, family and sexual violence industry standard for telcos which we think may land any day now, as well as the revised TCP Code which we understand will soon be submitted to the ACMA for registration.

The Public Policy Advisory Panel will be meeting later this month to discuss all the above and more so please let us know if you have any concerns, or if you’d like to join the discussion!

And as always, please get in touch to share any thoughts on any of the open consultations below and/or previous submissions as we really appreciate your feedback.

Open consultations

Completed submissions

Read More

The subordinate legislation under the Security of Critical Infrastructure Act (SOCI Act) and the new Cyber Security Act affecting the telecommunications sector commenced on 4 April 2025.

These instruments introduce new rules for the telco industry, as well as changes to existing obligations, consolidating security regulations that were previously contained under the Telecommunications Act framework into the SOCI legislative framework. Below is a summary of the regulations:

Telecommunications Security and Risk Management Program Rules (TSRMP Rules)

Telco entities that hold a carrier licence, supply over 20,000 carriage services, or supply services to Commonwealth Government entities are subject to more stringent obligations under the new TSRMP Rules.
This involves:

  • implementing and maintaining an all-hazards risk management program by 4 October 2025 addressing all material physical and natural hazard, cyber and information, personnel and supply chain risks that could have a relevant impact on the provider’s critical telecommunications asset(s). Providers will have to submit an annual report in relation to its risk management program by 28 September from FY26 (bolded terms defined below);
  • compliance with at least maturity level 1 of a cyber security framework by 4 October 2026 (further obligations for carriers to comply with maturity level 2 by 4 October 2027);
  • obligation to ‘protect your asset’ as far as it is reasonably practicable to do so. Carriers have further obligations to notify the Department of Home Affairs of any changes to your asset that is likely to have a material adverse effect on your ability to protect your asset.

Key Terms:
  • critical telecommunications asset: a telco network owned/operated by a carrier or CSP for the supply of a carriage service.
  • material risk: includes but not limited to a stoppage or major slowdown of the asset; impairment of its functions; substantive loss of access or manipulation of a critical component of the asset; interference to its operational or information communication technology; the storage, transmission of processing of information outside of Australia; remote access to operational control or monitoring of the asset; compromise, theft or manipulation of communications, unauthorised use; impact on the asset’s availability, integrity, reliability or confidentiality of data storage systems holding business critical data.
  • relevant impact: a direct or indirect impact on the availability, integrity, reliability of the asset, or the confidentiality of the information about or stored in the asset.

Asset Register and Mandatory Cyber Incident Reporting Rules

Rules requiring telco entities to register their critical assets, and notify the Department of a cyber incident have been folded into the SOCI framework.

However, these rules now only apply to entities with a carrier licence, or meet the ‘relevant carriage service provider asset’ threshold of over 20,000 services in operation, or supply to the Commonwealth Government.

SOCI rules affecting all telcos

Even if you are not a carrier or don’t meet the ‘relevant carriage service provider asset’ threshold (20,000 SIOs or supply to the Commonwealth Government), telecommunications assets are still captured under the SOCI Act as critical infrastructure. This means you may still have obligations to:

  • notify your data storage or processing provider that it is storing or processing your business critical data; and
  • following Ministerial directions in relation to serious incidents affecting your asset.

 

Subordinate cyber security rules

New security standards for smart devices were introduced in March 2025 with the rules commencing 4 March 2026. The rules apply to both manufacturers and suppliers of ‘relevant connectable products’ and is therefore likely to affect telco entities.

The standards introduce 3 rules for manufacturers in relation to their products, including ensuring each device has a unique password or allowing the consumer to create own password, ways for consumers to report security issues and clearly providing information on the support period for security updates.

The manufacturer must also prepare a Statement of Compliance in respect of the rules. Suppliers must then provide this Statement of Compliance with any relevant connectable products they supply to consumers in Australia and must retain the Statement for at least 5 years.

IAA recently held a webinar on IoT Security on 3 April, which included a discussion on the new rules.

Additionally, from 30 May 2025, all entities with an annual turnover of at least $3 million must report ransomware payments to the Department within 72 hours of the ransom being paid.

Please refer to the below summaries and guidance material provided by the Department in respect of these new rules:


IAA is also working on template risk management plan material that Members can utilise to assist with their compliance efforts on the IAA Member Portal.

You can also join the Trusted Information Sharing Network for access to further critical infrastructure information and resources.

Please contact us if you have any questions about these new rules.

Read More

Welcome to our newest Professional Members:

Margaret Boston
Charlie Evans
Donny Gunadi
Kiera Horomia
Hannah Leeder
Gerard O’Leary
Mike O’Connor
Jonathan Patsanas
David Rinaldo
Tarris Thiedecke
Bruce Tonkin
Ming Wong

Welcome to our Corporate Members:

Neptune Internet Pty Ltd

We are pleased to welcome Neptune, the latest ISP to join our peering network. Based in Melbourne, Neptune delivers high-performance internet services, supported by a team of highly skilled Australian experts who are always ready to assist. Their membership stems from both an interest in IX services and the community aspects of IAA.

Vetta Online Ltd

We’re excited to welcome Vetta Online to the peering network under their own port! Vetta has been delivering internet services since 2010, steadily growing from a national provider into one with its own international network backbone, offering some of the fastest and most reliable connectivity in New Zealand.

Read More

 In March, the IAA team gathered at the Mercure on the NSW Central Coast for our annual Staff Planning Workshop. This is always a valuable opportunity to bring our geographically dispersed team together in one room to align on how we can better serve our Members.

This year’s Workshop focused on aligning our efforts to meet current OKRs, setting measurable goals for the year ahead, improving how we collaborate, and strengthening our approach to security and incident response, all within the framework of our 2024–2027 Strategic Plan.

A highlight of the Workshop was our team-building activity: SolarBuddy’s Hour of Power. SolarBuddy is an impactful organisation working to end extreme energy poverty, which is a major, but often overlooked, global issue. IAA staff worked together to construct some 20 solar powered lights to send to people in need around the world.

Read More

Sign up to IAA's mailing list

Complete this form to receive all our latest news, events and updates.