The Australian Signals Directorate published Cyber Action Year 2026 on 4 June 2026. It lists five critical actions for every organisation. Two are legacy technology and event logging. The others are secure by design buying, post-quantum cryptography and AI-enabled threats. Critical infrastructure should also be ready to isolate systems for up to three months.
Key takeaways
- Five actions apply to every organisation.
- A sixth applies to critical infrastructure only.
- ASD asks for an "assumed breach" planning mindset.
- Post-quantum transition should finish by the end of 2030.
- October 2026 is Cyber Security Action Month.
What ASD published
ASD describes Cyber Action Year as an ASD-led, industry-driven program for 2026. The page urges Australian industry to adopt an "assumed breach" mindset, planning for a compromise before one happens.
On 1 October 2026 ASD repeated the same five actions for Cyber Security Action Month, under the theme "Take a second. Stay secure."
The five actions, one at a time
1. Replace or mitigate legacy technologies. ASD does not define a list on the program page. A practical start is any system whose vendor support has ended.
2. Implement best practice event logging. Logs are what tell you whether an attacker got in, what they touched and when. Without them an incident review has nothing to work from.
3. Choose secure by design products and services. This is a buying decision. Ask vendors about default settings, multi-factor authentication and how they handle vulnerability reports.
4. Prepare for post-quantum cryptography. ASD's post-quantum planning guidance recommends ceasing traditional asymmetric cryptography such as RSA and ECDSA by the end of 2030. It sets milestones of a refined plan by the end of 2026 and a started transition by the end of 2028.
5. Prepare for AI-enabled cyber threats. The program page names the action without a checklist. The basics still apply: patch quickly and protect accounts that attackers can reach from the internet.
The sixth action for critical infrastructure
ASD adds that critical infrastructure entities should be prepared to isolate systems and networks for up to 3 months. Most software companies are outside that group, though their customers may not be.
Sorami’s view
This section is opinion. It is our prioritisation, not ASD advice.
If you can only start one action this quarter, start with event logging. It is the one that decides whether you can answer a customer, an insurer or a regulator after an incident. It also helps with every other action, because you cannot judge a legacy system you cannot see.
The post-quantum date is the one most teams will miss. The end of 2026 milestone is a plan, not a migration, and a plan starts with an inventory of where you use RSA and elliptic curve keys.
What to do now
- List systems with ended vendor support and decide replace or mitigate.
- Confirm sign-in, admin and data access events are logged and kept.
- Add secure by design questions to your vendor review.
- Inventory where RSA and elliptic curve keys are used.
- Turn on multi-factor authentication for every internet-facing account.
To check logging and patching against ASD guidance, see our Essential Eight assessment, or contact us to discuss scope.
Related guides
- ASD Essentials replaces the Essential Eight
- PSPF Direction 002-2026: the legacy technology stocktake
- Essential Eight Maturity Level 2 on AWS and Azure
- Every Sorami article is in the guides index.
Sources
- Australian Signals Directorate, Cyber Action Year 2026 (4 June 2026)
- ASD, Take a second to stay secure this Cyber Security Action Month (1 October 2026)
- ASD, Planning for post-quantum cryptography
Facts on this page were checked against these sources on 12 October 2026. We update the page when the source changes.