· By Nicholas “Nick” O'Sullivan, Townsville
Australia's Cyber Security Strategy 2023–2030: the six shields, in plain English
Australia’s Cyber Security Strategy 2023–2030 is the umbrella document that everything else in this series sits under — the Cyber Security Act 2024, the work of the ACSC, and the sector-specific action plans, including the one that specifically named charities and not-for-profits. The stated goal is for Australia to be a world leader in cyber security by 2030. The strategy organises the work into six “cyber shields.”
Shield 1 — Strong businesses and citizens. The basics, at scale: helping individuals and organisations, especially small businesses, understand and manage their own cyber risk. This is the shield most directly relevant to a small business, church or charity — it’s the “raise the floor” layer the rest of the strategy is built on top of.
Shield 2 — Safe technology. Building security into products and services by design, including the mandatory smart-device security standards introduced under the Cyber Security Act. The logic: if the technology people buy is safer by default, individual users and small organisations don’t have to compensate for weak-by-design products.
Shield 3 — World-class threat sharing and blocking. Faster, better information-sharing between government and industry about active threats, and blocking known-bad infrastructure (malicious domains, phishing infrastructure) closer to real time. Mostly invisible to an end user, but it’s part of why a well-run email or DNS filtering setup catches more than it used to.
Shield 4 — Protected critical infrastructure. Hardening the systems that genuinely can’t fail — energy, water, telecommunications, banking. Not directly relevant to most small organisations, except that many local services (a community centre’s power, a church’s internet connection) ultimately depend on this infrastructure staying up.
Shield 5 — Sovereign capabilities. Growing Australia’s own cyber security workforce, skills and industry, so the country isn’t entirely dependent on overseas expertise and vendors for its own security.
Shield 6 — Resilient region and global leadership. Working with international and regional partners, since cyber threats don’t respect borders and a lot of the infrastructure attacking Australian organisations sits offshore.
The strategy is delivered across three “horizons”: Horizon 1 (2023–2025) focused on strengthening foundations, Horizon 2 (2026–2028) on scaling up and closing gaps — this is the horizon the NFP-specific action plan sits inside — and Horizon 3 (2029–2030) on advanced, mature cyber shields.
For a small-to-medium business, church, charity or community organisation, the honest summary is: shields 1 and 2 are where you actually live. You won’t be running critical infrastructure or shaping sovereign capability, but you are exactly the audience Shield 1 is written for — and a lot of practical guidance (the Small Business Cyber Security Hub, the Essential Eight, the free public checks) exists specifically because government policy has identified smaller organisations as needing a lower-friction way in.
A national strategy sets direction; it doesn’t configure your Microsoft 365 tenant or test your backups. That’s where a Leadership Technology Review comes in — translating “Australia should be a world leader in cyber security by 2030” into a specific, staged plan for your specific organisation, this year.
This wraps our short series demystifying Australian cyber security agencies and policy. Start from the beginning: ASD and ACSC explained.
