Security Solution Consultants (SSC) provides cyber security services Hobart agencies, Tasmanian food and seafood exporters, and the businesses that keep the state’s power, water and ports running use to meet government, customer and SOCI Act requirements. We are based in Tarneit, Victoria 3029, deliver most work remotely across Bass Strait, and come to Hobart and regional Tasmania for workshops, plant and OT reviews, physical security and findings walkthroughs.
Tasmania’s rules sit in fewer documents than the larger states’, but they ask specific things of suppliers, especially cloud and outsourced IT providers. Knowing which ones apply is the first step.
Which rules apply in Tasmania
Tasmanian Government agencies. The Tasmanian Government Cyber Security Policy v1.1, issued in November 2022, is still the listed policy on the Department of Premier and Cabinet’s page, last updated on 3 August 2026. It applies to Schedule 1 agencies under the State Service Act 2000. The policy is risk based: agencies apply the Tasmanian Government Cyber Security Standards, notify incidents to the Tasmanian Government Chief Information Officer, report annually to the Secretaries Board, and work with AS ISO/IEC 27001, which the policy names. It does not set an Essential Eight maturity level.
Protective security and suppliers. The Tasmanian Protective Security Policy Framework (TAS-PSPF) v2.1, in its INFOSEC-3 requirement (December 2025), expects systems to be authorised to operate, requires an IRAP assessment for outsourced IT and cloud services, calls for supply chain security at every stage, and puts security terms into contracts. For a cloud or managed service provider supporting an agency, that IRAP expectation is the central question.
Privacy. The Personal Information Protection Act 2004 binds personal information custodians, a term that includes contractors working under a personal information contract. Tasmania has no mandatory data breach notification scheme of its own; the Tasmania Law Reform Institute’s Final Report 33 (May 2024) recommended one. Private organisations covered by the Commonwealth Privacy Act 1988 still notify under its Notifiable Data Breaches scheme.
What Audit Tasmania found. The Auditor-General’s report on the financial statements of State entities (Volume 1, published 12 August 2026) recorded repeated cyber and IT weaknesses, with the details withheld, alongside 227 new findings and 266 unresolved ones. It also found that the Department of Health’s engagement of an ICT contractor did not comply with Treasurer’s Instruction PF-3.
The incident Tasmanians remember. In 2023 the Clop group’s attack through GoAnywhere file transfer software hit the Department for Education, Children and Young People. About 16,000 documents were leaked, and the government said about 150,000 individuals and businesses were affected. It remains the clearest local example of third-party software risk.
Everyone else. Businesses with turnover above $3 million must report ransomware payments within 72 hours under the Cyber Security Act 2024, SOCI Act obligations apply to responsible entities, and PCI DSS applies to any business taking card payments, from Salamanca retailers to tourism operators.
Certifications Hobart businesses ask us about
- SOC 2. Hobart software and managed service firms selling to mainland or overseas customers are commonly asked for a SOC 2 report. A licensed CPA firm issues it; we prepare your controls, evidence and scope beforehand.
- ISO/IEC 27001. The state’s cyber security policy names AS ISO/IEC 27001, so a certified management system lines up with how agencies already think about security. We implement it and prepare you for the accredited certification body.
- ISO/IEC 42001. Tasmanian firms putting AI into products for government or larger customers are commonly asked how it is governed. The Commonwealth’s AI policy for government v2.0, in effect since 15 December 2025, does not mandate ISO 42001, but the standard gives a recognised way to show accountability, impact assessment and transparency.
- ISO 9001. Tasmanian manufacturers, engineering firms and contractors bidding for government and mainland work commonly meet a request for certified quality management. We build ISO 9001 so it can share documents with ISO 22000 or ISO 27001.
- ISO 22000 in Tasmania. Agri-food was worth $4.28 billion to the state in 2023-24, including $1.45 billion from seafood and $678 million in dairy farm-gate value. Export customers of salmon, seafood, dairy and other food producers commonly ask for ISO 22000 or FSSC 22000.
- Critical infrastructure (SOCI Act). Energy, water and port operators and their suppliers, covered in the next section.
Critical infrastructure in Tasmania
Tasmania joins the National Electricity Market through the Basslink interconnector, with Marinus Link planned as a second connection. TasNetworks, Hydro Tasmania, TasWater and TasPorts run the island’s core networks, generation, water services and ports. Because so much depends on a small number of operators and links, an incident at one of them, or at one of their suppliers, travels far.
Responsible entities under the Commonwealth SOCI Act must keep a critical infrastructure risk management program and give a board-approved annual report by 28 September. The enhanced CIRMP rules that commenced on 10 June 2026 add requirements as their 12 and 24 month grace periods expire, and NEM participants assess cyber maturity with the AESCSF. Contractors that maintain control systems, provide software or host data for these operators should expect supply chain questions as part of each CIRMP. We help with SOCI Act compliance and CIRMP audits, energy sector security assessments and critical infrastructure and OT security training.
Our services in Hobart and across Tasmania
- Policy and Standards gap assessment. For Schedule 1 agencies, a review against the Tasmanian Government Cyber Security Policy and Standards, with input to the annual report to the Secretaries Board.
- TAS-PSPF INFOSEC-3 supplier readiness. Contract security terms, supply chain controls and IRAP readiness for cloud and outsourced IT providers.
- Cyber security audits in Hobart and Tasmania. Independent audits against state policy, ISO 27001, SOCI or a customer’s requirements.
- Essential 8 compliance in Tasmania. Maturity assessment where a Commonwealth contract, insurer or customer asks for it, mapped to ASD Essentials.
- ISO 27001 implementation. Management system design, internal audit and certification readiness.
- PCI DSS compliance in Tasmania. Readiness for retailers, hospitality and tourism operators, and payment service providers.
- Incident response and recovery. Plans, playbooks and exercises, including third-party software scenarios of the kind the 2023 education department incident exposed.
- Business continuity and enterprise risk management. Continuity planning for an island economy where supply lines and interconnectors are few.
Food, seafood and the TAS-PSPF
Two parts of the Tasmanian economy pull security work in different directions.
The first is food. Salmon, seafood, dairy and fruit exporters depend on processing plants, cold storage and traceability records, and export buyers commonly ask for ISO 22000 or FSSC 22000. Many of those plants run on networked control systems, so a ransomware incident can stop production and corrupt the very records a food safety audit relies on. Salmon also has its own state industry plan, released in 2023. We build food safety management systems that include the information security controls protecting those records, and review the operational technology behind them.
The second is government supply. INFOSEC-3 of the TAS-PSPF expects outsourced IT and cloud services to have an IRAP assessment, supply chain security at every stage and security terms in contracts. For a Hobart IT provider, a SaaS company or a data centre operator supporting an agency, that is a significant gate. IRAP assessments can only be performed by ASD-endorsed assessors. We prepare you: mapping your controls to the ISM, closing gaps, organising the evidence and staying alongside you through the assessor’s review.
Some businesses sit in both groups, such as software providers that serve food exporters and agencies alike. For them, one ISO 27001 management system, extended with IRAP readiness where an agency contract needs it, avoids running two separate programs.
Essential Eight and ASD Essentials in Tasmania
Tasmania’s policy does not set an Essential Eight level, but Tasmanian firms still meet it through Commonwealth contracts, Defence supply chains, insurers and the enhanced CIRMP rules, where Maturity Level Two is one of the accepted framework options. ASD published the ASD Essentials series on 15 October 2026 as its successor, with enterprise IT, cloud and OT chapters. Requirements that name the Essential Eight still name it until updated, so we assess against what your contract says and map the result forward.
GRCLens: one control set for Tasmanian obligations
GRCLens, the GRC platform we build, links frameworks such as ISO 27001, the Essential Eight and SOCI CIRMP to a single set of controls. Tasmanian organisations capture evidence once and report it many times, to agencies, customers and the board.
When you need an independent point-in-time assessment, see our cyber security audits for Hobart and Tasmanian organisations.
Penetration testing and security testing in Hobart and Tasmania
In 2023 attackers exploited a vulnerability in the GoAnywhere file transfer software used by Tasmania’s Department for Education, Children and Young People, and the government said about 150,000 individuals and businesses were affected. Internet-facing file transfer, remote access and web applications are where penetration testing in Hobart should start, because that is where Tasmanian organisations have been hurt.
We test external services and web applications, run internal network tests, and review cloud and Microsoft 365 configuration for Tasmanian agencies and their suppliers. Note that the IRAP assessments TAS-PSPF INFOSEC-3 expects for outsourced IT and cloud services are a separate exercise performed by ASD-endorsed assessors; a penetration test complements an IRAP assessment rather than replacing it. Salmon, seafood and food processors can add a passive OT assessment of plant systems, and software teams can use secure code review and threat modelling to fix issues early. See our penetration testing services and our cyber security audits in Tasmania.
Frequently asked questions
Is the Essential Eight mandatory for Tasmanian Government agencies?
The Tasmanian Government Cyber Security Policy v1.1 does not set an Essential Eight maturity level. It is risk based, built on the Tasmanian Government Cyber Security Standards, and names AS ISO/IEC 27001. Tasmanian organisations still meet the Essential Eight through Commonwealth contracts, Defence work, insurers and SOCI obligations, so an assessment is often worthwhile even without a state mandate.
What does INFOSEC-3 mean for a cloud provider serving a Tasmanian agency?
INFOSEC-3 in TAS-PSPF v2.1 expects outsourced IT and cloud services to have an IRAP assessment, calls for supply chain security at every stage, and puts security terms in contracts. Only ASD-endorsed assessors can perform IRAP assessments. We prepare providers by mapping controls to the ISM, closing gaps and organising evidence, so the assessor’s time is spent confirming rather than discovering.
Do Tasmanian organisations have to report data breaches?
Not under state law. The Personal Information Protection Act 2004 has no mandatory breach notification scheme, although the Tasmania Law Reform Institute recommended one in its Final Report 33 in May 2024. Private organisations covered by the Commonwealth Privacy Act 1988 must still notify eligible breaches under the Notifiable Data Breaches scheme, and contracts may impose their own reporting duties.
Why would a seafood or dairy exporter link ISO 22000 with cyber security?
Because food safety now depends on digital records and networked plant. Traceability data, temperature logs and recall records sit in systems that ransomware can lock or corrupt, and processing lines run on control systems. Building information security into an ISO 22000 or FSSC 22000 system protects the evidence your certification and export customers rely on, and helps keep production running after an incident.
We supply a Tasmanian energy or water operator. Does SOCI affect us?
Indirectly, yes. The SOCI Act places obligations on responsible entities, but a critical infrastructure risk management program must address supply chain hazards, so operators commonly ask suppliers for evidence of their own controls. Having an ISO 27001 certificate, an Essential Eight assessment or an independent audit report ready makes those requests faster to answer.
Do you work outside Hobart, in Launceston or the north west?
Yes. We are based in Tarneit, Victoria, and most of our Tasmanian work is remote, so Launceston, Devonport, Burnie and the north west coast are served the same way as Hobart. We travel to Tasmania for workshops, processing plant and operational technology reviews, physical security and findings sessions where being present helps.
Next step
Let us know which agency contract, export customer or SOCI obligation is behind the question, and we will scope it to a fixed price. Contact us or email info@secsolutionshub.com. We also work with organisations in Melbourne, Adelaide and across New Zealand.
