Under the model Work Health and Safety Regulations, a person conducting a business or undertaking must identify psychosocial hazards, eliminate the risk so far as is reasonably practicable, and where elimination is not possible, minimise the risk using control measures. Since 1 December 2025 these duties have been enforceable in every Australian state and territory. From 1 July 2026, NSW businesses must comply with the approved Code of Practice: Managing psychosocial hazards at work or demonstrate an equivalent standard.
Regulators expect control measures based on the actual risk profile of the work. Generic statements do not satisfy the duty, and higher-order controls that change the work itself are preferred over controls that ask the worker to cope. For technology and cybersecurity businesses, this means the assessment must address the hazards that arise in your workplace rather than describing workplace stress in the abstract.
Psychosocial hazards specific to technology and cybersecurity businesses
Technology and cybersecurity work embeds psychosocial risk in the operating model. On-call rotations mean the working week never formally ends, and the anticipation of a page is itself a stressor even on nights when none arrives. Security operations add alert fatigue: sustained vigilance against a threat that is real but mostly invisible, with the failure mode being a breach the analyst will be asked to account for. Outages and incidents are frequently followed by blame rather than blameless review, which discourages the disclosure that prevents the next one. Distributed and remote teams remove the informal contact through which a struggling colleague would once have been noticed. Productivity and activity monitoring — keystroke, commit and screen tracking — is now common enough to constitute a recognised hazard in its own right, eroding autonomy and dignity where it exceeds operational need.
Service desk and IT support work concentrates a different hazard again. Ticket queues arrive at a volume the worker cannot influence, priorities are set elsewhere, and the person absorbing user frustration has no authority to fix the underlying cause — a combination of high job demands and low job control that the model WHS framework treats as a compounding exposure. Abuse and escalation from internal users is routine and frequently unreported, because the worker is expected to keep the requester satisfied. After-hours callouts break recovery time, and where a small team covers a whole business, one person carries the load alone.
Software and product teams carry release and deadline pressure that is often self-imposed by planning culture rather than by any external requirement. Sprint commitments, incident retrospectives that turn to fault-finding, and always-on chat channels remove the boundary between work and rest. In telecommunications, field technicians work alone at customer premises and in public spaces, face aggression from customers already frustrated by an outage, and restore services against clock pressure that discourages taking a break or standing down from an unsafe situation. Each of these is a psychosocial hazard the regulator expects to see assessed and controlled, not absorbed.
The 17 psychosocial hazards covered
SafeWize technology and cybersecurity kits include a separate risk assessment for each recognised psychosocial hazard, approximately 5 to 6 pages per hazard, with the hazard described in your industry's language, the risk rated, and controls selected and mapped to the hierarchy of controls. The full list is set out on the psychosocial kits page.
What documentation a regulator asks for
In a WHS investigation, documentary evidence determines the outcome. Inspectors typically ask for the psychosocial risk assessment, the control measures selected and their position in the hierarchy of controls, evidence of worker consultation, and records showing controls have been reviewed. A statement that the workplace culture is positive is not a defence and does not appear in an audit trail.
Authoritative sources
The obligations described on this page come from the model WHS Regulations and the psychosocial hazards Code of Practice. The primary sources are published by Safe Work Australia and the state and territory regulators:
Your regulator: SafeWork NSW · WorkSafe Victoria · WorkSafe Queensland · SafeWork SA · WorkSafe WA · WorkSafe Tasmania · WorkSafe ACT · NT WorkSafe · Comcare (Commonwealth)
SafeWize is not a regulator. The kits are compliance documentation, not legal advice. Always check the current requirements with the regulator in your jurisdiction.
