After ASIC v FIIG: what every financial services leader must do next
Key moments from the conversation with Wotton Kearney: AI, quantum and the evidence regulators will ask for.
Read article ›
Financial services
The right technology and cyber security for Australian financial services
Financial services firms hold some of the most sensitive data in the country, and ASIC now expects licensees to prove their cyber controls work. andersenIT designs, secures and manages the IT that keeps your firm compliant, resilient and ready for review, with a team that understands your obligations.
Briefing
After FIIG: a practical briefing
Written for financial services IT and risk leaders. Free download.
RecordingMark Andersen and Leah Mooney
A one hour conversation on the ruling and what to do next. Watch on demand.
ArticlesThe financial services library
Eight articles on the ruling, APRA obligations and evidence.
Free briefing
After FIIG: a practical briefing for financial services IT leaders
A short, board ready read on the first case to impose civil penalties on an AFS licensee over cyber security failures, and what it changes for everyone else holding a licence.
- 1What the court actually found, in the words of the judgment
- 2How regulator enforcement has escalated, and where it points next
- 3The questions a board should be able to answer on the spot
- 4What adequate preparation looks like, control by control
- 5The cost of getting it right, set against the cost of getting it wrong
Outsourcing your IT does not outsource the obligation. The accountability stays with the licensee and the board.
Get the briefing
Sent straight to your inbox. No cost and no obligation.
Executive briefing, on demand
After ASIC v FIIG: unpacking cyber governance and what financial services leaders need to do next
A one hour conversation between Mark Andersen, Managing Director of andersenIT, and Leah Mooney, Partner at Wotton Kearney. The technology view and the legal view on what the ruling means in practice, where boards are most exposed, and the steps to work through this quarter.
MA
The technology view
Mark Andersen
Managing Director, andersenIT
LM
The legal view
Leah Mooney
Partner, Wotton Kearney
Latest ASIC enforcement, 14 October 2026
Fortnum Private Wealth penalised $1.35 million for cybersecurity failures
The Supreme Court of NSW ordered Fortnum to pay a $1.35 million penalty, plus $250,000 towards ASIC's costs, after it admitted failing to adequately manage cybersecurity risk across its financial advice network. It is ASIC's third cyber outcome against a licensee, after RI Advice and the ASIC vs FIIG ruling, and each case asks the same question: can you show cyber risk is governed across everything that operates under your licence?
What Fortnum admitted, April 2021 to May 2023
- No adequate cybersecurity policy across the business and its authorised representative network
- No adequate processes to oversee and monitor its authorised representatives' cyber resilience
- Not enough staff with specialised cybersecurity expertise
- No adequate cybersecurity risk management systems
81 to 94advice practices
200+authorised advisers
~55,000retail clients exposed
"Strong cyber resilience is critical to maintaining trust and confidence in our financial system."
Sarah Court, ASIC ChairMay 2022RI Advice
Feb 2026FIIG Securities
Oct 2026Fortnum
Article library
Everything we have written for financial services
Newest first. Each one is a short read written for the people who have to answer for the controls.
22 September 2026
.png)
8 July 2026
What lawyers are saying about the ASIC vs FIIG ruling
The legal read on the judgment and what it signals about where enforcement goes next.
Read article ›
3 June 2026
Maintaining operational consistency across financial services environments
Why consistency across sites, systems and devices is what makes a control defensible.
Read article ›.png)
29 April 2026
Three questions financial services leaders should now be asking after the ASIC vs FIIG ruling
The three board level questions the judgment puts in front of every licensee.
Read article ›
29 April 2026
What adequate cyber preparation looks like in financial services after FIIG
Turning the word adequate into a set of controls and records you can point to.
Read article ›-1.png)
27 February 2026
Why confidence in financial services depends on defensible records
Evidence is the difference between believing you are covered and being able to show it.
Read article ›
7 January 2026
Digital readiness in financial services: building confidence for 2026
Where to put effort and budget across the year to lift your position in a measurable way.
Read article ›
26 August 2025
Is your cloud tenancy aligned to APRA CPS 234?
Governance, access control and monitoring in Microsoft 365 and Azure, checked against CPS 234.
Read article ›
What we do
IT built for a regulated environment
andersenIT works with AFS licensees, banks and credit unions, wealth and advice practices, accounting firms and investment managers across Australia. Our services protect data integrity, streamline reporting and support compliance with industry standards.
The work is designed so the controls hold up under scrutiny and the evidence exists when a regulator, an auditor, an insurer or a board asks for it. andersenIT is certified to ISO 27001 and ISO 9001.
Cybersecurity
Protection, detection and response
Layered controls, monitoring, incident response and the reporting that shows the controls are working.
Cybersecurity › Managed ITA stable, documented environment
Day to day management with defined service levels, asset records and change history you can hand to an auditor.
Managed IT services › CloudTenancy governance and data control
Microsoft 365 and Azure configured for identity, access, retention and data residency in a regulated setting.
Cloud services › Professional servicesAssessment, uplift and advisory
Independent review of where your controls sit today and a costed plan to close the gaps that matter most.
Professional services › ConnectivityResilience and continuity
Networks and links built with redundancy, so a critical operation keeps running when something fails.
Connectivity › End-user computingManaged devices and access
Standard operating environments, patching and access control across every device that touches client data.
End-user computing ›
Regulatory standards
The obligations and frameworks we work to
Which of these apply to you depends on your licence, your size and the data you hold. The common thread is that each one asks you to show your controls are adequate, tested and overseen, and to have the records that prove it.
ASIC
AFS licence obligations, Corporations Act s912A
The general obligations to have adequate risk management systems and adequate technological and human resources. These are the obligations ASIC relied on in ASIC v RI Advice in 2022 and again in ASIC v FIIG Securities.
APRA
CPS 234 Information Security
Applies to APRA regulated entities. Clear roles and responsibilities, information security capability sized to the threat, systematic control testing and notification of material incidents.
APRA
CPS 230 Operational Risk Management
In effect since 1 July 2025. Identify critical operations, set tolerance levels, manage material service providers and be able to keep operating through a disruption.
OAIC
Privacy Act 1988 and the NDB scheme
Reasonable steps to protect personal information under APP 11, and the obligation to assess and notify eligible data breaches to the OAIC and to affected individuals.
Certification
ISO 27001 and the SOCI Act
andersenIT holds ISO 27001 and ISO 9001 certification. For entities captured by the Security of Critical Infrastructure Act, financial services and markets is a covered sector with its own risk management and reporting duties.
Not sure which apply?
Get in touch
Talk to the team about where your controls sit today
We will map the obligations that apply to your licence and show you what it would take to close the gaps.