Imagine arriving at a board meeting to learn that one of your mine sites has been offline for 12 hours following a cyber attack.
Production has stopped, critical systems are unavailable and the IT team is still trying to establish the extent of the damage. There are questions about how long recovery will take, what information may have been accessed and whether the incident needs to be reported to the ASX.
As a director, what happens next?
It’s a scenario mining boards need to be prepared for. With operations increasingly dependent on connected technology, cyber incidents can have serious financial, operational and safety consequences.
Cyber security is now firmly on the board agenda, and directors have responsibilities when it comes to understanding and managing that risk.
What are the cyber security responsibilities of ASX directors?
Under Section 180 of the Corporations Act 2001, directors are required to exercise their powers and duties with reasonable care and diligence.
This extends to cyber security. ASIC has made it clear that directors are expected to oversee cyber risk as part of their organisation’s broader risk management responsibilities.
In 2022, the Federal Court found that RI Advice, an Australian Financial Services licensee, had breached its licence obligations by failing to adequately manage cyber security risks. While the case concerned the company’s obligations as a licensee, ASIC has pointed to it as a reminder of the importance of cyber risk oversight.
For directors, the expectation is to understand the risks facing the organisation and make sure appropriate measures are in place to manage them.
You don’t need to understand every technical detail of your company’s security systems. That’s what your IT and cyber security experts are there for.
You should, however, be comfortable asking questions about the company’s security, understanding where the biggest risks sit and challenging management when something doesn’t add up.
ASIC’s cyber resilience guidance for directors is a useful starting point for understanding these responsibilities.
When does a cyber incident need to be reported to the ASX?
ASX Listing Rule 3.1 requires listed companies to immediately disclose information that a reasonable person would expect to materially affect the price or value of their securities, unless an exception applies.
That can include cyber incidents.
Consider a ransomware attack that shuts down a processing plant for several days, disrupts production forecasts or exposes commercially sensitive geological information.
Depending on the circumstances and materiality of the incident, the company may be required to inform the market.
The difficult part is that cyber incidents are rarely straightforward. Early information can be incomplete, the full impact may take time to establish and the situation can change quickly.
Boards need confidence that management knows when to escalate an incident and that the company has a process for assessing its disclosure obligations.
ASX provides further guidance, including an example involving a data breach, in its continuous disclosure guidance note.
One thing worth checking is whether your incident response plan has clear procedures for notifying senior management, involving the board and obtaining legal advice when a potentially material incident occurs.
These conversations are much easier to have before there’s an incident to deal with.
Why is cyber security a particular concern for mining companies?
Mining companies have some unique challenges when it comes to cyber security.
Many operate across remote sites, rely on complex supply chains and use a combination of older operational systems and modern connected technology.
There’s also Operational Technology (OT) to consider. This includes the systems responsible for controlling and monitoring physical processes, such as processing plants, industrial equipment and autonomous machinery.
A cyber incident affecting these systems could interrupt production and, depending on the equipment involved, introduce safety or environmental risks.
Even systems that don’t directly control mining equipment can have a serious impact when they become unavailable.
The Scope Systems cyber incident in May 2026 demonstrated this when mining companies lost access to hosted ERP services, including Pronto Xi.
For affected organisations, that meant disruption to systems supporting finance, procurement, maintenance, payroll and operational reporting.
It’s a good example of why boards need to understand their company’s reliance on technology providers and other third parties.
A supplier’s cyber incident can quickly become your operational problem.
We’ve explored this further in our article on cyber security for mid-tier mining companies.
What should mining directors be asking about cyber security?
One of the challenges for directors is knowing which questions to ask.
Cyber security reports can be full of technical information, but that doesn’t always help a board understand how well the business is protected.
A useful starting point is to focus on the systems and information that matter most to the organisation.
Some questions worth raising with management include:
- Which systems are critical to our operations?
What would happen if our ERP, processing systems or site communications became unavailable? - How long could we operate without them?
Do we have tested recovery plans, and how quickly could we get back up and running? - Where is our most sensitive information stored?
Who has access to geological data, financial records and other commercially sensitive information? - How are we managing third-party cyber risk?
Do we understand which suppliers and technology providers our operations depend on? - How would a major incident be escalated?
When would the board be informed, and who is responsible for assessing potential disclosure obligations? - When did we last test our response plans?
Have the relevant people worked through a realistic cyber incident together?
The answers will help directors understand where the company is well prepared and where further attention may be needed.
What does good cyber governance look like?
Every mining organisation has a different risk profile. A junior explorer with a small corporate team has very different technology requirements from a producer operating multiple remote sites.
Cyber security governance needs to reflect those differences.
At a board level, there are a few areas worth paying particular attention to.
Regular cyber risk reporting
Cyber security should form part of the company’s ongoing risk reporting. Directors need enough information to understand material risks, incidents, control weaknesses and the progress being made to address them.
A clear approach to managing risk
The board should understand the organisation’s cyber risk appetite and how management is assessing and treating risks across the business.
Incident response and business continuity planning
Plans need to account for the actual systems, suppliers and operational dependencies the business relies on. They should also be tested, including through tabletop exercises involving senior management and relevant board members.
Clear accountability
There should be no confusion about who is responsible for cyber security, who makes decisions during an incident and when an issue needs to be escalated.
Documented oversight
Board minutes and risk reporting should reflect the discussions, decisions and actions taken. This helps demonstrate how cyber risks are being considered and managed over time.
The Australian Signals Directorate also provides guidance on cyber security responsibilities for boards and executives.
Cyber security is a conversation worth having
Ever Nimble CEO Chris Morrissey regularly presents to ASX-listed boards about cyber risk and the responsibilities that come with it.
“I am fortunate enough to regularly present on cyber risk to ASX boards,” says Chris.
“They are highly engaged, asking the right questions, and fully grasping their responsibilities when it comes to cyber security. I often leave them with a copy of The Secure Board by Anna Leibel and Craig Sears-Black. It is an excellent place to start.”
For mining directors, having a good understanding of cyber risk puts you in a much better position to make informed decisions and ask the right questions of management.
Start with the systems that matter most to your operations. Understand the risks, review the plans and make sure the right people know what to do when something goes wrong.
Need some guidance on cyber risk?
At Ever Nimble, we work with mining and resources businesses to understand their technology risks, improve cyber security and strengthen business continuity.
If you’re reviewing your organisation’s cyber security or want to better understand where you may be exposed, get in touch with our Tech Experts.
FAQs
Are directors legally responsible for cyber security in Australia?
Directors have a duty to exercise reasonable care and diligence under the Corporations Act 2001. This includes appropriate oversight of cyber security risks. While directors aren’t expected to manage technical systems themselves, they should understand material risks and be satisfied that the organisation has suitable security and risk management arrangements.
Does every cyber attack need to be reported to the ASX?
No. ASX-listed companies are required to disclose information that could materially affect the price or value of their securities, subject to applicable exceptions. A cyber incident may trigger this obligation depending on its financial, operational or other consequences. Companies should seek appropriate legal advice when assessing disclosure requirements.
Why are mining companies at risk of cyber attacks?
Mining organisations rely on interconnected operational systems, remote communications, cloud platforms and third-party providers. A cyber incident can disrupt production, maintenance, procurement and other essential activities. Operational Technology may also introduce physical safety risks, making cyber security an important consideration for both business continuity and operational risk management.
How can mining boards improve cyber security governance?
Boards can strengthen oversight by including cyber risk in regular reporting, understanding critical technology dependencies and establishing clear accountability. Reviewing third-party risks, testing incident response plans and documenting decisions also help directors assess whether the organisation is adequately prepared to manage a significant cyber incident.
This article is general information and does not constitute legal advice. Directors and organisations should seek independent legal advice regarding their specific obligations.