Secompass - Security, Compliance & Assurance

Secompass - Security, Compliance & Assurance We keep Australian and New Zealand organisations safe from cyber threats.

Privileged access should not be a permanent decision.Throughout this week, we have looked at several questions around pr...
24/09/2026

Privileged access should not be a permanent decision.

Throughout this week, we have looked at several questions around privileged access.
Who genuinely needs it? What can those accounts reach? What could happen if a significant identity is compromised?

These questions all lead to one broader governance issue.

Access changes as organisations change.

People move between roles, responsibilities evolve and technology environments grow. Privileged access that was appropriate when it was granted may not remain appropriate indefinitely.

Good cybersecurity governance means maintaining visibility over significant access and regularly reviewing whether it still reflects a genuine business need.

Privileged access should change as your organisation changes.

If one privileged account were compromised, how much of your organisation could it reach?Privileged access is necessary ...
23/09/2026

If one privileged account were compromised, how much of your organisation could it reach?

Privileged access is necessary for people responsible for managing important systems and technology.

But not every privileged identity has the same reach.

Some accounts may provide access across multiple systems, applications, configurations or sensitive information. This is why organisations need visibility into not only who has privileged access, but also what that access allows them to reach.

The latest Australian and New Zealand guidance on Active Directory compromise reinforces the importance of understanding and protecting significant identities.
The impact of a compromised account depends partly on how much access that identity holds.

Do you know what your organisation’s privileged accounts can actually access?Monday's question was whether people with p...
21/09/2026

Do you know what your organisation’s privileged accounts can actually access?
Monday's question was whether people with privileged access still need it.

But knowing who has elevated permissions is only part of good access governance.

Organisations also need visibility into what those permissions allow someone to reach and do. A privileged account may provide access across important systems, applications, configurations or sensitive information.

Leadership does not need to understand every technical permission. But it should have confidence that significant access is understood, appropriately limited and connected to a genuine business need.

Knowing who has access is only part of the picture. You also need to understand what that access can reach.

Who in your organisation has privileged access, and do they still need it?Privileged access is necessary for people who ...
21/09/2026

Who in your organisation has privileged access, and do they still need it?
Privileged access is necessary for people who manage important systems, applications and information.

But access requirements change as people move roles, responsibilities evolve and organisations grow.

Good cybersecurity governance means knowing who has elevated permissions, understanding why they need them and regularly considering whether that level of access is still appropriate.

The Essential Eight specifically addresses restricting administrative privileges as part of reducing cybersecurity risk.

Privileged access should be limited to the people who genuinely need it.

How current is your confidence in your organisation’s cybersecurity? Implementing security controls is important. So is ...
17/09/2026

How current is your confidence in your organisation’s cybersecurity?

Implementing security controls is important. So is proving that they operate and understanding whether they are producing the expected outcome.

But cybersecurity assurance cannot rely entirely on what was demonstrated in the past.

Risks change, threats adapt and technology evolves. Leadership needs current evidence and visibility to understand whether the organisation’s critical controls continue to manage those risks effectively.

Cybersecurity confidence should come from what you can demonstrate today, not what you implemented yesterday.

When was the last time you asked whether your security controls are still effective? Implementing cybersecurity controls...
16/09/2026

When was the last time you asked whether your security controls are still effective?

Implementing cybersecurity controls is important, but threats, technology and operating environments continue to change.

As the risk environment evolves, organisations need ongoing assurance that the controls they rely on continue to deliver the outcomes expected of them.

This does not necessarily mean adding more technology. It means understanding what your critical controls are expected to achieve and having enough evidence to know whether they remain effective.

Cybersecurity assurance should not end when a control is implemented.

Good information governance includes knowing when to let go.Organisations make decisions about how information is collec...
10/09/2026

Good information governance includes knowing when to let go.

Organisations make decisions about how information is collected, stored, accessed and protected.

But good governance also considers what happens when that information is no longer required.

There may be legitimate business, legal or regulatory reasons to retain information. The important thing is knowing why it is being kept and having a clear process for what happens when that purpose ends.

If you keep the data, you keep the responsibility.Organisations spend significant effort protecting the information they...
09/09/2026

If you keep the data, you keep the responsibility.

Organisations spend significant effort protecting the information they collect. But good information governance also means understanding why that information is still being retained.

Accounts become inactive, customers leave and systems change, while information can remain.

There may be legitimate business, legal or regulatory reasons to keep it. The important question is whether retention is intentional.

Keeping data is a risk decision.

You cannot govern what you cannot see.Having clear responsibility for privacy is an important first step. But effective ...
07/09/2026

You cannot govern what you cannot see.

Having clear responsibility for privacy is an important first step. But effective oversight also depends on understanding how personal information is actually being handled across the organisation.

Information can move between different teams, systems, processes and external providers. Without sufficient visibility, gaps can be difficult to identify and address.

Good privacy governance therefore requires more than assigning responsibility.

It requires giving those responsible the visibility they need to provide meaningful oversight.

Who is actually responsible for privacy in your organisation?Personal information can move through many teams, systems a...
06/09/2026

Who is actually responsible for privacy in your organisation?

Personal information can move through many teams, systems and business processes.

Without clear accountability, it can become difficult to know who is monitoring privacy obligations, identifying gaps and making sure good practices continue as the organisation changes.

Privacy governance is not simply about having policies in place. It is about making sure someone has clear responsibility for ongoing oversight.
Good privacy governance starts with clear accountability.

Address

Suite 2, Level 1, 14-16 Yarra Street
South Yarra, VIC
3141

Opening Hours

Monday 9am - 5pm
Tuesday 9am - 5pm
Wednesday 9am - 5pm
Thursday 9am - 5pm
Friday 9am - 5pm

Website

Alerts

Be the first to know and let us send you an email when Secompass - Security, Compliance & Assurance posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category