Navigating the Complexities of the Australian Privacy Act and the ISM

I have worked in multiple ServiceNow transformation projects, in particular from legacy on-prem solutions migrating to ServiceNow in the Cloud.

A recurring theme in my consultations with the Cyber security teams is a skepticism toward multi-tenant cloud architectures. They ask questions such as "Does ServiceNow really support the privacy requirements of the Australian Privacy Act and the ISM?" or "Can a multi-tenant cloud platform like ServiceNow truly support the privacy requirements of a PROTECTED-level agency?"

The answer is "Yes," but the implementation must follow a "Privacy by Design" architectural mindset that goes beyond the default settings. The settings are also not just within ServiceNow, it is within the customer's security architecture, policies and practices.