WA Government Cyber Security Policy

The WA Government Cyber Security Policy prescribes the baseline for cyber security capabilities and practices across the Western Australian Government. The current published version dates from 2024.

What distinguishes it from other state policies is how explicitly it borrows from established frameworks rather than inventing its own control set. It mandates the Essential Eight at Maturity Level One as a minimum, and integrates that with the NIST Cybersecurity Framework, the ASD Information Security Manual, and ASD's Further Five mitigation strategies — additional strategies beyond the eight.

Maturity Level One as the mandated floor is worth understanding correctly. It is a baseline, not a target. An entity holding significant personal information or operating critical services should be able to explain why Level One is where it stopped, because the policy is risk-based and the floor is a starting point rather than an answer.

Compliance is demonstrated through annual reporting rather than certification. There is no WA Cyber Security Policy certificate.

WA Government entities

Public sector entities to which the policy applies, for whom it sets the mandatory baseline and the annual reporting obligation.

Suppliers and service providers to WA Government

Where cyber security obligations flow down through contracts. As with every state framework, the binding document for a supplier is the contract rather than the policy itself.

Entities already working to NIST CSF or the ASD ISM

Because the policy integrates both, existing work under either maps across substantially rather than needing to be redone.

What triggers the work

The annual reporting cycle for entities, or a contract clause and assurance request for suppliers.

• For in-scope entities it is the mandated baseline, with annual reporting attached.
• The frameworks it borrows are portable. Because it builds on the Essential Eight, NIST CSF and the ISM rather than a bespoke control set, work done here transfers to other obligations.
• The Further Five close real gaps. The additional strategies address attack paths the eight do not, and they are frequently overlooked precisely because they sit outside the familiar framing.
• For suppliers it protects the contract, where flow-down obligations apply.
• Maturity Level One is achievable. A lower mandated floor than several other jurisdictions makes the baseline realistic, which is a genuine advantage provided it is treated as a floor.

The policy is a baseline, so the first question is where you sit against it and the second is whether the baseline is sufficient for your risk.

1. Confirm scope and applicability

Establish which entities and systems the policy covers in your context, and where obligations flow to suppliers.

2. Assess against the baseline

Including current Essential Eight maturity, assessed against evidence rather than self-assertion. Maturity Level One is a floor, not a target for an entity holding significant sensitive information.

3. Address the Further Five

The additional mitigation strategies the policy incorporates alongside the eight. These are frequently overlooked because they sit outside the more familiar Essential Eight framing.

4. Align with NIST CSF and the ISM

The policy draws on both. Where an entity already works to the NIST Cybersecurity Framework or the ASD ISM, that work maps across rather than being duplicated.

5. Build governance and evidence

Roles, accountability and the records that make a reporting position defensible.

6. Report annually

Against the policy requirements, with the evidence to support the position taken.

Soveriq assesses against the policy baseline using evidence rather than self-rating, covers the Further Five alongside the Essential Eight — which is the part most commonly missed — and maps existing NIST CSF or ISM work across instead of duplicating it.

For suppliers, we establish which obligations flow through your contract with a WA entity and build proportionate evidence.

We will also tell you plainly if Maturity Level One is not adequate for what you hold. A policy floor is not the same as an appropriate risk position, and treating it as one is how organisations end up compliant and breached.

On internal review. Where Soveriq has performed the uplift, we do not then assess it and present that as independent assurance. We provide readiness validation, labelled as such, with genuine independence supplied by someone independent of the build and disclosed in writing.

What we will not do. Soveriq does not approve reporting, does not speak for the Office of Digital Government, and does not promise an assessment outcome.

• Module 01 — Gap analysis against the policy, including current Essential Eight and Further Five posture.
• Module 02 — Build. Control implementation, governance and the evidence routines that support annual reporting.
• Module 03 — Internal review ahead of reporting, subject to the impartiality position above.
• Module 04 — Representation where an agency client engages directly.
• Module 05 — Continuous compliance across the annual cycle.

Engagements in this area are scoped and priced in writing after a scoping call, usually within one business day.