In today’s cloud-first environment, organisations across Australia and New Zealand are accelerating their cloud adoption to gain agility, scale, and cost efficiency. But as the region becomes increasingly digitised, it also becomes more exposed — and the cloud, for all its benefits, is no exception. The question is no longer if risk exists in the cloud, but how it is being managed
Cloud Risk Is Business Risk
Cloud environments are dynamic, decentralised, and complex. Misconfigurations, over-permissioned identities, shadow IT, lack of visibility, and third-party reliance all contribute to a growing attack surface. In 2023 and 2024 alone, both Australia and New Zealand witnessed several high-profile cyber incidents where cloud platforms were either the target or the weak link in the chain.
Case Reference:
- Latitude Financial (AU) breach revealed in 2023 showed attackers gaining access to customer records via a cloud-based service provider.
- Waikato DHB ransomware attack (NZ) impacted critical health systems, with cloud backup strategies and recovery processes being scrutinised.
These incidents highlight the importance of understanding that cloud risk is not a technical problem alone — it’s an enterprise-wide resilience issue.
Regulatory Lens: A Catalyst for Better Controls
Both countries are tightening the screws:
Australia:
- The Australian Prudential Regulation Authority (APRA) CPS 230 (effective July 2025) will require entities to implement operational risk management, business continuity planning, and third-party management — directly impacting cloud service use.
- ACSC’s Essential Eight and ISM provide clear security baselines that extend to cloud environments.
New Zealand:
- While NZ has a lighter regulatory footprint, the NZISM (NZ Information Security Manual) and the Cloud Risk Assessment Tool (NZGCIO) provide practical guidance for government agencies and enterprises.
- The Office of the Privacy Commissioner increasingly expects data custodianship responsibilities, especially where public cloud is used for storing or processing personal data.
Shared Responsibility, Uneven Execution
The shared responsibility model in cloud computing is well understood in theory — but execution is where many fall short. When resilience and controls are not embedded at the design and procurement stages, cloud implementations become patchwork solutions that are hard to govern and harder to defend.
A recent NZ study by CERT NZ found that 63% of cloud-related incidents involved misconfigurations, while the 2024 State of Cyber Security in Australia survey revealed that only 28% of organisations regularly audit their cloud control frameworks.
Key Pillars for Managing Cloud Risk
- Visibility and Inventory Management: Know what’s running, where, and under what conditions.
- Cloud Governance Frameworks: Establish clear policies for provisioning, configuration, and usage.
- Zero Trust Architecture: Implement least privilege, continuous verification, and strong identity management.
- Continuous Assurance: Leverage CSPM (Cloud Security Posture Management) tools, audits, and compliance testing.
- Third-Party Risk Management: Extend due diligence to cloud providers and service integrators.
- Resilience-by-Design: Prioritise disaster recovery, multi-region deployments, and operational continuity planning.
Opportunities for Leaders
Executives in both Australia and New Zealand should treat cloud resilience as an ongoing strategic capability — not just a security or IT concern. This includes:
- Board-level engagement on cloud-related risks
- Investment in cloud-specific security expertise
- Regular simulation of cloud outage and cyber-attack scenarios
- Cross-border data flow assessments to ensure compliance with privacy laws
Conclusion
Cloud is no longer new — but managing cloud risk remains a maturing discipline, especially in the context of AU/NZ’s regulatory landscape and cyber threat environment. As businesses become increasingly dependent on these platforms, ensuring resilience, visibility, and control in cloud environments must become a boardroom mandate, not just a backend function.
By treating cloud risk as a business risk, organisations can build a stronger, more resilient foundation — not just to survive disruption, but to thrive in it.
✅ Take the First Step Toward Cloud Resilience
At Cybertech Risk Consultants, we help organisations across Australia and New Zealand cut through the complexity of cloud risk — aligning strategy, governance, and security with practical, resilient outcomes.
🔍 Not sure where your gaps are?
📊 Need to prepare for CPS 230 or NZISM expectations?
💡 Want a fresh, independent view of your cloud controls?
Let’s talk.
📨 Book a free 30-minute consultation and discover how we can help build cloud confidence in your business.
About the Author
Terry-Sue V., Founder of Cybertech Risk Consultants, is a recognised leader in risk management and cloud resilience. With extensive experience in system design, policy uplift, and IT governance across Australia and New Zealand, Terry-Sue brings clarity to complex digital risk challenges.
