• Conduct detailed root cause analysis.

• Ensure transparent reporting consistent with ASIC RG 78 and ethical standards.

• Identify regulatory, privacy, operational, reputational, and cultural risks arising from the breach.

• Implement dashboards for breach and compliance metrics.

Governance & Reporting

• Activate the Risk  and Compliance Committee.

• Clarify roles for Board, Executive, and Compliance teams.

• Strengthen delegations of authority for rapid breach escalation and reporting.

• Conduct independent reviews, audits, and scenario testing.

Aligning to compliance framework with AS ISO 37301

• Update policies, implement technical controls, and conduct mandatory training.

• Strengthen monitoring, audits, and continuous improvement processes.

• Proactively notify and cooperate with ASIC, APRA, and OAIC.

Ethical Leadership & Culture

• Reinforce a culture of transparency, early reporting, and accountability.

• Leadership to communicate clear expectations and model ethical behaviour.

• Embed ethical principles into decision-making and digital transformation activities.

The standard requires the bank to comply with social / ethical values - given the type of breach (data) and delay in reporting, it appears that this is not adequately addressed or embedded in the business and requires uplift.

The amendment requires the bank to integrate climate- related obligations and would expect that reporting produced to support compliance with the plan would include commentary and consideration of climate risks.