Cyber Security Act 2024: A Plain-English Guide for Australian Businesses

Australian businesses most often ask whether the A$3 million threshold captures them, when the 72-hour clock starts, and whether one report satisfies every regulator. A high-demand question missing from the fixed 10 is whether making a ransomware payment is lawful, insurable or affected by sanctions in the particular circumstances.

• previous-financial-year turnover exceeding A$3m — The ransomware payment reporting provisions can apply when the other statutory trigger elements are met.
• critical-infrastructure responsible entity covered by SOCI Part 2B — The ransomware payment reporting provisions can apply irrespective of the ordinary turnover limb.
• manufacturer or supplier of an in-scope smart device — Separate product-security and statement-of-compliance duties can apply without an A$3m turnover test.
• business below the ransomware threshold with no smart-device role — The mandatory payment-reporting and product rules may not apply, but Privacy Act, SOCI, contract and sector duties may still apply, and significant-incident information may be shared voluntarily.

Cyber Security Act applicability. The Legal and Incident Leads must assess each cyber event against four separate Cyber Security Act 2024 pathways: ransomware-payment reporting, smart-device obligations, voluntary limited-use information sharing, and Cyber Incident Review Board engagement. The assessment must record the applicable entity, turnover period, critical-infrastructure status, product role, overseas or group involvement, decision-maker and any parallel legal duties.

• more than A$3m in the previous financial year — The ordinary ransomware-reporting entity threshold is met, subject to all other statutory elements.
• exactly A$3m in the previous financial year — The Act and Rules use 'exceeds', but the factsheet also says 'A$3 million or more'; obtain advice rather than relying on the inconsistent summary wording.
• business operated for part of the previous financial year — Use the Rules formula: A$3m multiplied by days carried on, divided by days in the previous financial year.
• SOCI Part 2B critical-infrastructure responsible entity — Covered by a separate limb and may have concurrent SOCI incident-reporting duties.
• not-for-profit carrying on a business — Home Affairs states that not-for-profit organisations are not explicitly exempt; entity status and the statutory elements still need assessment.

Coverage check. Finance must record previous-financial-year turnover and any part-year calculation annually. Legal must record whether the entity carries on business in Australia, is a Commonwealth or State body, or is a responsible entity for an asset covered by SOCI Part 2B. An entity at exactly A$3 million turnover must obtain advice because Home Affairs guidance contains inconsistent boundary wording.

• reporting business that pays an extortion demand — Submit the prescribed payment report through the approved channel with the required incident, demand, payment and communication information.
• third party, insurer or related entity pays on the business's behalf — The covered business remains responsible once it makes or becomes aware of the on-behalf payment.
• smart-device manufacturer — Manufacture in-scope products to the prescribed standard and prepare the required statement of compliance.
• smart-device supplier — Do not supply a product required to comply if it is non-compliant, and supply it with the required statement of compliance.
• entity affected by a significant cyber incident — May share information voluntarily with the National Cyber Security Coordinator and may later be involved in a no-fault CIRB review.

Trigger actions. A ransom demand alone must be recorded and assessed, but the Part 3 report is triggered when a covered entity makes or becomes aware of a related payment or benefit made on its behalf. The Incident Lead must preserve the required incident, demand, payment and communication information, lodge the approved report, assess parallel reports, and separately decide whether voluntary NCSC or ASD sharing is appropriate.

• Cyber Security Act ransomware payment report — 72 hours from payment or awareness of an on-behalf payment.
• CIRB compulsory document notice — The notice period must not be less than 14 days.
• Privacy Act suspected eligible data breach — Take all reasonable steps to complete the assessment within 30 calendar days, then notify required parties as soon as practicable once eligibility is established.
• SOCI critical incident — Report within 12 hours of awareness of significant impact; relevant-impact incidents are reported within 72 hours.

Reporting clock register. For every cyber incident, the Legal Lead must record each law, regulator, contract and insurer trigger separately, including the trigger event, awareness time, due time, report owner, approval path and submission evidence. A 72-hour Cyber Security Act clock starts from payment or awareness of an on-behalf payment and must not be confused with clocks starting from incident discovery.

• missing or late ransomware payment report — Maximum civil penalty is 60 Commonwealth penalty units.
• failure to comply with CIRB section 49 notice — Maximum civil penalty is also 60 penalty units.
• smart-device non-compliance — Regulatory responses can include compliance, stop and recall notices, public notification, monitoring, enforceable undertakings and injunctions rather than one universal fixed fine for every breach.
• parallel legal breach — Privacy, SOCI, sanctions, criminal, consumer, contractual and sector consequences remain separate.

Penalty control. The Incident Lead must escalate any possible ransom payment before it is made, preserve evidence of the payment decision and time, and ensure the statutory report is submitted within 72 hours. Legal must separately assess sanctions, criminal law, privacy, critical-infrastructure, consumer, contract and insurance consequences; filing a Cyber Security Act report is not an approval or safe harbour for the payment.

• ransomware payment reporting — Commenced 30 May 2025; active compliance focus applies from 1 January 2026.
• smart-device standards — Commenced 4 March 2026 for most in-scope devices manufactured from that date.
• Cyber Incident Review Board — Board appointments were announced on 1 May 2026; reviews occur after immediate response activity has ended.
• future statutory review — PJCIS may commence its Act review as soon as practicable after 1 December 2027.

Regulatory change control. The Policy Owner must review this policy whenever Cyber Security Act Rules, Home Affairs guidance, penalty-unit values or related Privacy Act and SOCI obligations change, and at least annually. The obligations register must record commencement dates, product manufacture dates, current thresholds, enforcement phase and the source version relied upon.

• business exposed to ransomware — Maintain a payment decision process, turnover record, third-party payment notification clause, 72-hour report workflow and evidence register.
• insurer, broker, incident responder or negotiator acting for a client — Contracts and playbooks should require immediate notice to the covered client when a payment is made or authorised on its behalf.
• smart-device manufacturer or supplier — Maintain product classifications, security-standard evidence, vulnerability contacts, support-period publications and statements of compliance.
• organisation likely to share with government during a significant incident — Pre-authorise who can share, under which ASD or NCSC pathway, with what legal review and recordkeeping.

Readiness requirements. The business must maintain: an annual turnover and entity-status record; a ransom-payment decision and third-party notification workflow; a 72-hour ReportCyber procedure; a multi-regulator reporting matrix; an evidence and privilege protocol; named ASD and NCSC sharing authorities; and, where relevant, smart-device product classifications, vulnerability-reporting contacts, published support periods and statements of compliance.

• Cyber Security Act Part 3 — Reports a covered ransomware or cyber-extortion payment; it is not a general incident or data-breach report.
• Privacy Act NDB scheme — Focuses on eligible personal-information breaches likely to cause serious harm, whether or not a ransom is paid.
• SOCI Part 2B — Focuses on relevant or significant impacts to covered critical-infrastructure assets and may require 12-hour or 72-hour reports.
• ASD or NCSC limited-use sharing — Can support coordinated response but does not acquit mandatory reports to regulators.
• state, territory, sector, contract or insurer duties — May operate concurrently and require additional notifications or approvals.

No single-report assumption. Submission to ASD, the National Cyber Security Coordinator or under one statutory scheme does not satisfy another reporting duty unless the receiving regulator confirms this in writing. The Legal Lead must assess the Cyber Security Act, Privacy Act, SOCI Act, Telecommunications Act, sector regulation, contracts, insurance and State or Territory law separately.

• ransom demand with no payment — Not reportable under Part 3 solely because the demand was made, though other incident and breach duties may apply.
• exactly A$3m — Do not assume the factsheet's 'or more' wording resolves the issue; primary legislation uses 'exceeds'.
• limited-use information sharing — Not a safe harbour, not immunity, and not satisfaction of separate reports.
• buyer or user of existing smart devices — The direct product regime focuses on manufacturers and suppliers of covered products manufactured from 4 March 2026; existing devices may remain a security risk without being retrospectively covered.
• CIRB review — No-fault and post-incident, but relevant documents can become subject to a compulsory notice.

Interpretation safeguards. Staff must not describe the Act as requiring every cyber incident to be reported within 72 hours, as banning or approving ransom payments, as creating a legal safe harbour, or as replacing Privacy Act, SOCI or contractual reports. Any public or internal statement about coverage must identify the specific Part, trigger, entity, product, threshold and clock relied upon.

This guide and its templates are a professionally drafted starting point, not legal advice. Your obligations depend on your industry, your contracts and your data. Have a qualified adviser review anything high stakes before you rely on it.