Frameworks
The obligations Australian organisations answer to, from their sources.
Adopt a framework and it becomes a programme: its obligations as controls, each with its section or paragraph, the version in force and where it was read. Add your own codes, contracts and standards as custom frameworks beside them.
Frameworks you can adopt today
| Framework | Who it applies to | Controls | Version shown |
|---|---|---|---|
| Privacy Act and APPs Privacy Act 1988 (Cth) | APP entities: Australian Government agencies and organisations. An organisation is an individual, body corporate, partnership, other unincorporated association or trust that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed State or Territory instrumentality. A small business operator (one that carries on only businesses with an annual turnover of $3,000,000 or less) is outside the Act unless an exception in section 6D(4) applies, regulations or section 6E treat it as an organisation, or it has chosen to be treated as one under section 6EA. The Notifiable Data Breaches scheme also covers credit reporting bodies, credit providers and holders of tax file number information. | 56 | From 11 December 2024 (Compilation No. 101 onwards) |
| Work health and safety Work health and safety laws | Every person conducting a business or undertaking (including self-employed people), its officers, its workers and other people at a workplace: each has its own duties under work health and safety law. | 9 jurisdictions | Each jurisdiction's own |
| Essential Eight ASD Essential Eight Maturity Model | Businesses, government agencies and other organisations protecting internet-connected information technology networks: ASD designed the Essential Eight for those networks, not for enterprise mobility or operational technology networks. An organisation picks a target maturity level suitable for its environment and implements each level in turn until it gets there. Independent certification isn't required, but a government directive or policy, a regulatory authority or a contract may require an independent assessment. | 152 | Essential Eight maturity model (November 2023), from 27 November 2023 |
| National Employment Standards National Employment Standards (Fair Work Act 2009 (Cth)) | National system employers, for their national system employees. A national system employer is a constitutional corporation, the Commonwealth or a Commonwealth authority (so far as it employs, or usually employs, an individual); a person employing flight crew officers, maritime employees or waterside workers in connection with constitutional trade or commerce; a body corporate incorporated in a Territory; or a person carrying on an activity in a Territory, for employees employed in connection with it. The meaning is extended in a referring State by sections 30D and 30N. Employers outside the national system are bound only by the extended unpaid parental leave, paid family and domestic violence leave and notice of termination provisions in Part 6-3. | 43 | Fair Work Act 2009 Part 2-2, as in force from 11 December 2024 (text current to Compilation No. 73) |
| APRA CPS 230 APRA CPS 230 Operational Risk Management | APRA-regulated entities: authorised deposit-taking institutions (including foreign ADIs) and authorised banking non-operating holding companies; general insurers (including Category C insurers), authorised insurance non-operating holding companies and parent entities of Level 2 insurance groups; life companies (including friendly societies and eligible foreign life insurance companies) and registered non-operating holding companies; private health insurers; and RSE licensees in respect of their business operations. For a foreign ADI, Category C insurer or eligible foreign life insurance company, only the Australian branch operations are covered. A Head of a group must also apply the standard throughout the group. | 38 | CPS 230 Operational Risk Management, remade from 1 July 2026 |
| APRA CPS 234 APRA CPS 234 Information Security | APRA-regulated entities: authorised deposit-taking institutions (including foreign ADIs) and authorised banking non-operating holding companies; general insurers (including Category C insurers), authorised insurance non-operating holding companies and parent entities of Level 2 insurance groups; life companies (including friendly societies and eligible foreign life insurance companies) and registered life non-operating holding companies; private health insurers; and RSE licensees in respect of their business operations. For a foreign ADI, Category C insurer or eligible foreign life insurance company, only the Australian branch operations are covered. A Head of a group must also apply the standard throughout the group. | 23 | CPS 234 Information Security, in force from 1 July 2019 |
| Custom frameworks | Your organisation: internal codes, policies, customer contracts and group standards. | Yours | Versioned as you change them |
Facts as shipped in made. Shield, each read from its primary source. "Version shown" is the version in force on 11 November 2026.
Work health and safety, by jurisdiction
Choose the states and territories you work in; there is no default. Each has its own law, regulator and notification rules.
Questions about frameworks and jurisdictions
Which frameworks does made. Shield cover?
made. Shield covers the Privacy Act and the Australian Privacy Principles, with the Notifiable Data Breaches scheme; work health and safety laws for each state and territory and the Commonwealth, including Victoria's Occupational Health and Safety Act; the ASD Essential Eight; the National Employment Standards; APRA CPS 230; APRA CPS 234; and custom frameworks built from your own codes, contracts and standards.
Every obligation is taken from its primary source, such as the official legislation register or the regulator's own publication, and records where and when it was read.
Can made. Shield work with our own codes and contracts?
Yes. made. Shield lets you build a custom framework from your internal codes of conduct, policies, customer contracts or group standards, and run it as a programme like any other.
Custom frameworks are included on every plan, during the trial too.
Which state's work health and safety law does made. Shield use?
made. Shield uses the law of each jurisdiction your organisation chooses: there is no default state. You pick the states and territories you operate in, and each work health and safety programme names the jurisdictions it covers.
Every state and territory and the Commonwealth has its own set of obligations, with its regulator, its sections and its effective dates, so a duty one state doesn't have is shown as absent there rather than guessed.
Does made. Shield cover Victoria's Occupational Health and Safety Act?
Yes. Victoria hasn't adopted the model work health and safety laws, so made. Shield keeps Victoria's own obligations under the Occupational Health and Safety Act 2004 and its Regulations, administered by WorkSafe Victoria.
Where a model-law duty has no Victorian equivalent, the Victorian programme shows it as none in Victoria, and duties only Victoria has are listed in their own right.
Where do made. Shield's obligations come from?
Every obligation in made. Shield comes from its primary source: the official legislation register, the regulator's standard or the framework owner's publication, never a secondary guide.
Each one records the section it comes from, the version in force and the date it was read. Our framework pages print the same facts, with links to the sources.
What happens in made. Shield when the law changes?
When a change is published before it starts, made. Shield lists the controls to re-map and the date the change takes effect, so you can update your evidence in time.
Programmes keep the version that applied on each date, so an earlier report still reads against the obligations in force when it was issued.
Does made. Shield help with the Notifiable Data Breaches scheme?
Yes. made. Shield keeps a breach assessment record against the Notifiable Data Breaches scheme's elements and assessment timeframe, from when you became aware of a suspected breach.
The decision whether a breach is notifiable is your organisation's. Shield prepares the record and any statement for you to submit; it doesn't lodge anything with the Commissioner.
Does made. Shield track Essential Eight maturity levels?
Yes. made. Shield lists each Essential Eight mitigation strategy's requirements by maturity level, so you can see where you are and what reaching the next level takes.
Set a target maturity level, link the evidence for each requirement, and draft a maturity uplift report for a named person to issue.
Does made. Shield cover APRA's prudential standards?
Yes. made. Shield includes CPS 230 Operational Risk Management and CPS 234 Information Security, for APRA-regulated entities.
Each paragraph is a control with its citation and effective dates, including the remade CPS 230 where it applies.