Skip to content
Layer 8 SecurityThe Human Factor
Standards

Governing the risk, not just spotting the link.

Executive & Board Variant

Everyday staff need to know how to spot a bad link. Executives and directors need to govern organisational risk, lead through a catastrophic breach, and protect themselves from sophisticated, AI-driven targeted attacks. This module aligns with the AICD Cyber Security Governance Principles, ASIC guidance and the emerging threat of deepfakes.

Let’s talk
Builds on the Core Baseline. Teams on this variant are trained to Core Baseline domains 1–5 first, then domains 14–17 below.Core Baseline
Specialist domains
4
Topics
12
Domains in total, with the Core Baseline
9

Domain 14

Strategic Cyber Governance & Board Accountability

Moving cyber security from an “IT problem” to a core strategic and legal responsibility for directors.

  1. 14.1

    Director Duties & Legal Liability

    Director obligations under the Corporations Act 2001, ASIC’s enforcement stance on cyber negligence, and personal liability under the Security of Critical Infrastructure (SOCI) Act.

  2. 14.2

    The AICD Principles in Practice

    Applying the AICD/CSCRC Cyber Security Governance Principles, including aligning cyber risk with business needs and bringing cyber expertise into board governance.

  3. 14.3

    Interrogating the CISO

    The metrics a board should demand: not vanity numbers (“we blocked 10,000 emails”) but economic-impact measures such as time-to-detect, time-to-patch and system recovery time.

Domain 15

Deepfake Whaling & Multi-Channel Impersonation

Executives are the highest-value targets. This domain covers advanced, targeted impersonation.

  1. 15.1

    AI-Enabled Voice & Video Cloning

    How attackers clone an executive’s voice from a few seconds of public audio, and the reality of live deepfake video calls, such as the US$25 million loss at engineering firm Arup in 2024.

  2. 15.2

    Multi-Channel Whaling

    Recognising how attackers combine compromised internal email threads with follow-up WhatsApp messages and phone calls to build an overwhelming illusion of urgency and legitimacy.

  3. 15.3

    Championing a “Zero-Trust” Culture

    Showing junior staff they are expected to verify urgent financial requests out of band, by calling the executive back on a known number, without fear of insubordination.

Domain 16

Public Profile Exploitation & Travel Security

Executives are public figures, so their attack surface reaches far beyond the corporate network.

  1. 16.1

    Reconnaissance & Pretexting

    How attackers mine ASX announcements, press releases and executive social media for believable lures, such as an email about a confidential acquisition the board is negotiating.

  2. 16.2

    International Travel Risks

    “Evil Maid” attacks on devices left in hotel rooms, border device searches, and clean “burner” devices for travel to high-risk jurisdictions.

  3. 16.3

    Secure Board Communications

    The risks of discussing strategy on personal WhatsApp or private Gmail, and the mandatory use of secure, encrypted board portals.

Domain 17

Crisis Leadership & Breach Response

When a catastrophic breach hits, the technical team contains the malware. The board has to manage the company’s survival.

  1. 17.1

    The Ransomware Dilemma

    The legal, ethical and practical implications of paying a ransom, including the risk of breaching Australian sanctions laws, and the reality that paying does not guarantee the data is deleted.

  2. 17.2

    Regulatory & Market Disclosure

    Balancing the reporting timelines of the Notifiable Data Breaches scheme and the SOCI Act with continuous disclosure rules for listed entities.

  3. 17.3

    Out-of-Band Crisis Comms

    If a ransomware gang is in the network, it is probably reading the executive team’s email and Teams chats. The board must know how to switch to pre-arranged, secure secondary channels.

Mapping to compliance

What this module evidences

  • ISO/IEC 27001:2022

    • Clause 5 Leadership and Commitment

  • AICD Cyber Security Governance Principles (Version 2)

    Demonstrates directors are fulfilling their oversight duties under the principles.

  • ASIC guidance

    Evidence of the board’s engagement with cyber risk, in line with ASIC’s expectations of directors.

Other standards

Train your team to the Executive & Board Variant

Tell us which roles you need to cover and what you have to evidence, and we will show you how a session maps to these domains.

Let’s talk