CyberCon 2026: A Cyber Security Standards Guide for Every Team

CyberCon 2026 is underway, running 14–16 October at the Melbourne Convention and Exhibition Centre. This year’s theme from the Australian Information Security Association (AISA) is ‘Empowered Together’.

October also marks Cybersecurity Awareness Month, a global initiative highlighting the importance of strengthening cyber resilience. This aligns closely with the themes of CyberCon 2026, where collaboration across IT, procurement, operational technology (OT) and critical infrastructure teams is essential to managing shared cyber risks.

This article explores the key standards that support cyber resilience and how each addresses different aspects of cybersecurity risk.

CyberCon is AISA's flagship event and Australia's largest annual gathering of cyber security professionals. The 2026 program is built around six content themes, including a track specifically on supply chain, dependency and provenance risk, alongside tracks on secure technology, operations, and governance. That structure reflects how cyber risk now affects the whole organisation, not just IT.

Cybersecurity Awareness Month reinforces the same message at a broader public level, encouraging organisations and individuals to review their security practices. Together, they're a timely prompt to check whether your organisation's approach to cyber security standards is as joined-up as the risk itself.

Five standards map directly to CyberCon 2026's focus areas, each covering a different layer of cyber risk.


For IT and Information Security Teams

ISO/IEC 27001:2022, amended in 2024, sets requirements for an information security management system (ISMS): the policies, risk assessments and controls an organisation puts in place to protect information.

Its companion, ISO/IEC 27002:2022, gives detailed guidance on the 93 controls referenced in ISO/IEC 27001's Annex A. This is adopted in Australia and New Zealand as AS/NZS ISO/IEC 27002:2022.

For more details about ISO/IEC 27001, read our guide to ISO/IEC 27001:2022.


For Procurement and Vendor Management Teams

The ISO/IEC 27036 series guides procurement and vendor management because it addresses cyber security risk in supplier and acquirer relationships. It has four parts: an overview (Part 1:2021), requirements (Part 2:2022), guidelines for hardware, software and services supply chain security (Part 3:2023), and guidelines for cloud services (Part 4:2016).

This is a standard for the team, even where IT already holds ISO/IEC 27001 certification. A supplier's own security certification describes their practices; it doesn't describe how your organisation manages vendor relationships or assesses the risk of onboarding them, which is specifically what the 27036 series is focused on.


For OT, Industrial and Critical Infrastructure Teams

For operational technology (OT) environments that run manufacturing, utilities and critical infrastructure, the IEC 62443 series sets security requirements for industrial automation and control systems.

It defines distinct requirements for product suppliers, system integrators, service providers and asset owners. IEC 62443 also gives a different structure from ISO/IEC 27001's single-organisation ISMS model, reflecting how OT environments typically involve several parties across a system's lifecycle.

OT, industrial and critical infrastructure teams are also most directly affected by regional critical infrastructure regulation. In Australia, the Security of Critical Infrastructure Act 2018 (SOCI Act) remains in force. An independent review was delivered on 31 January 2026, and related reforms are still under consultation.

In the European Union, the NIS2 Directive has been in force since 16 January 2023 and EU member states were given until 17 October 2024 to turn it into national law. In the United States, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) establishes similar federal baselines, but the Cybersecurity and Infrastructure Security Agency (CISA) has not yet finalised the reporting rules.

Specific obligations vary by organisation and sector, so confirm your own position with a regulator or legal adviser rather than relying on this as a complete summary.


How ISO 22301 Ties Every Team Together

ISO 22301:2019, amended in 2024, sets the requirements for a business continuity management system (BCMS): the plans and capabilities an organisation needs to keep operating, or recover quickly, when there’s a disruption, regardless of which team or system it came from.

ISO 22301 doesn't belong to any one of the three teams we’ve mentioned. Whether a disruption hits IT, a supplier or an OT environment, the impact lands in the same place. It’s why ISO 22301 is commonly implemented alongside ISO/IEC 27001 rather than treated as a separate, unrelated program.

Matching Teams with Cyber Risk Standards

Putting these standards into practice generally involves a few steps.

1. List which of these four areas - IT information security, supplier relationships, OT and business continuity - already have a standard in place. This shows you where the gaps are.
   
   
2. For any gap, confirm whether it needs a full management system (ISO/IEC 27001, ISO 22301) or a more targeted set of requirements (ISO/IEC 27036, IEC 62443).
   
   
3.  Check the current edition and any amendments for each standard you already use, since several in this group, including ISO/IEC 27001 and ISO 22301, have been amended since their base edition was published.
   
   
4.  If CyberCon's supply chain or OT security sessions are relevant to your role, use them to pressure-test whether your current standards coverage actually matches how your organisation's risk is distributed.

Cyber risk isn't just an IT problem, and neither is the solution. Different teams rely on different standards: ISO/IEC 27001 and ISO/IEC 27002 for information security management, ISO/IEC 27036 for supplier relationships, IEC 62443 for operational technology and ISO 22301 for staying operational through disruption. 

CyberCon 2026's collaborative theme is a timely reminder to assess your organisation's standards coverage. Intertek Inform brings these standards together in one place, so IT, OT, procurement and critical infrastructure teams can work from the same current editions.