Resources

This page collects external resources related to social engineering defence, fraud prevention, identity, security awareness, tabletop exercises, incident response, and organisational resilience.

Resources last reviewed: September 2026

Resource library

Australian government and national cyber resources

Australian Signals Directorate / Australian Cyber Security Centre

• Cyber.gov.au - Social engineering
  Guidance on identifying and responding to social engineering attempts across email, SMS, social media, instant messaging, and vishing.

• Cyber.gov.au - Business email compromise
  Guidance on business email compromise, including impersonation and compromised accounts.

• Cyber.gov.au - Preventing business email compromise
  Practical measures for reducing business email compromise risk.

• Cyber.gov.au - Essential Eight
  ASD’s baseline mitigation strategies for making organisations harder to compromise.

• Cyber.gov.au - Information Security Manual
  ASD’s cyber security framework for protecting IT and operational technology systems.

• Cyber.gov.au - Scattered Spider advisory
  Advisory covering helpdesk social engineering, MFA resets, and identity systems.

Scamwatch and ACCC

• Scamwatch - Business email compromise scams
• Scamwatch - Fake business invoice scams
• Scamwatch - Protect your small business from scams

IDCARE

• IDCARE
• IDCARE - Email security for small businesses
• IDCARE - Popular events affecting small businesses in Australia

International government and national cyber resources

CISA

• CISA - Tabletop Exercise Packages
• CISA - Cybersecurity resources and tools
• CISA - Phishing Guidance: Stopping the Attack Cycle at Phase One
• CISA - StopRansomware

NCSC UK

• NCSC UK - Phishing: Spot and report scam emails, texts, websites and calls
• NCSC UK - Phishing attacks: defending your organisation
• NCSC UK - Report a scam email

FBI and IC3

• FBI - Business Email Compromise
• IC3 - Business Email Compromise
• IC3 - Business Email Compromise: The $55 Billion Scam

FTC

• FTC - How to recognise and avoid phishing scams
• FTC - ReportFraud

ENISA

• ENISA - Awareness and Cyber Hygiene
• ENISA - Raising Awareness of Cybersecurity

Frameworks, standards, and control references

Australian frameworks

• ASD Essential Eight
• ASD Information Security Manual

NIST

• NIST Cybersecurity Framework (CSF) 2.0
• NIST SP 800-61 Rev. 3 - Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• NIST SP 800-53 Rev. 5 - Security and Privacy Controls for Information Systems and Organizations
• NIST SP 800-53A Rev. 5 - Assessing Security and Privacy Controls
• NIST SP 800-63-4 - Digital Identity Guidelines
• NIST SP 800-63A-4 - Identity Proofing and Enrollment
• NIST SP 800-63B-4 - Authentication and Authenticator Management

ISO and international standards

• ISO/IEC 27001
• ISO/IEC 27002
• ISO 22301 - Business continuity management

CIS Controls

• CIS Critical Security Controls

Tabletop exercise resources

• CISA - Tabletop Exercise Packages
• CIS / MS-ISAC - Tabletop Exercises
• CIS - Six Tabletop Exercises to Help Prepare Your Cybersecurity Team
• CISA - Cyber Storm
  Large-scale national cyber exercise program and source of exercise lessons and planning insights.

Security awareness and human-risk resources

SANS Security Awareness

• SANS Security Awareness
• SANS - Phishing Awareness Training
• SANS Security Awareness Report

KnowBe4

• KnowBe4 Resources
• KnowBe4 - Free Phishing Security Resource Kit
• KnowBe4 - Free Cybersecurity Tools

Social engineering tactics and threat research

• MITRE ATT&CK - Phishing for Information (T1598)
• Google Cloud Threat Intelligence
• Google Cloud / Mandiant - Vishing threat analysis
• CrowdStrike - Scattered Spider activity
• Proofpoint - Threat Reports

Reporting and recovery links

Australia

• ReportCyber
• Cyber.gov.au - Report and recover
• Scamwatch - Report a scam
• IDCARE

International

• NCSC UK - Report a scam email
• IC3 - File a complaint
• FTC - ReportFraud