Australia Cyber Security Act 2024 Guide: Ransomware Reporting, Smart Device Rules and Incident Reviews

Australia's Cyber Security Act 2024 is the country's first standalone cyber security statute, and it now requires many businesses to tell the government within 72 hours if they pay a ransom. The Act (No. 98, 2024) received Royal Assent on 29 November 2024 and does four things: it sets mandatory security standards for consumer smart devices, creates the ransomware and cyber extortion payment reporting obligation, limits how the National Cyber Security Coordinator can use information that companies share voluntarily during an incident, and establishes the Cyber Incident Review Board (CIRB). This guide explains each Part section by section, the penalties, the current commencement status and what it means for teams that manage credentials, devices and automated systems. It is for security, legal and incident response leads at Australian businesses and at manufacturers selling connected products into Australia. It does not cover the Security of Critical Infrastructure Act, which has its own Australia SOCI Act Guide, or the Privacy Act, covered in the Australian Privacy and Cyber Rules Guide.

Status checked 27 October 2026: all Parts of the Act are in force. Ransomware payment reporting began on 30 May 2025, and the Department of Home Affairs moved from its education-first phase to active compliance on 1 January 2026. The smart device standards apply to in-scope products manufactured on or after 4 March 2026. The CIRB Rules began on 30 May 2025 and the Board's membership was announced on 4 May 2026. The Commonwealth penalty unit rose from $330 to $364 on 1 July 2026.

Key takeaways

• Report the payment, not the demand: section 27 requires a report within 72 hours of making a ransomware or cyber extortion payment, or of becoming aware that one was made on your behalf; a demand you refuse does not trigger it.
• The threshold is low: any business carrying on business in Australia with annual turnover above AUD 3 million in the previous financial year is covered, plus responsible entities for critical infrastructure assets under Part 2B of the SOCI Act.
• Smart devices need three basics: no universal default passwords, a published way to report vulnerabilities with status updates, and a published security support period with an end date, backed by a statement of compliance kept for five years.
• Voluntary sharing has legal protection: information given to the National Cyber Security Coordinator about a significant incident cannot generally be used against you to investigate or enforce other civil contraventions, and is mostly inadmissible against you.
• The CIRB is no-fault but can compel: it reviews significant incidents after they end, cannot assign blame, but can require documents from certain entities within at least 14 days on pain of a civil penalty.

Scope: who and what is covered

Three sets of Rules fill in the detail: the Cyber Security (Security Standards for Smart Devices) Rules 2025 (F2025L00276), the Cyber Security (Ransomware Payment Reporting) Rules 2025 (F2025L00278) and the Cyber Security (Cyber Incident Review Board) Rules 2025 (F2025L00277).

• Ransomware scope exclusions: Commonwealth and State bodies are not reporting business entities. Not-for-profits are not explicitly exempt. For a business operating for only part of the previous financial year, section 6 of the Rules pro-rates the AUD 3 million threshold.
• Smart device scope exclusions: section 8(1)(b) of the Rules excludes desktop and laptop computers, tablets, smartphones, therapeutic goods under the Therapeutic Goods Act 1989, and road vehicles and components under the Road Vehicle Standards Act 2018. In scope are consumer-grade products such as smart TVs, smartwatches, home assistants, baby monitors and consumer energy resources.

Key obligations

Part 3: ransomware and cyber extortion payment reporting

• Trigger (s 26): a cyber security incident has occurred, is occurring or is imminent; an extorting entity makes a demand; and the entity, or someone on its behalf, makes a payment directly related to the demand. Non-monetary benefits such as services count as payments. Scams and physical extortion are out of scope.
• Deadline (s 27): within 72 hours of making the payment or becoming aware it was made. If a parent company, insurer, broker or incident response firm pays for you, the obligation stays with you.
• Where: the Australian Signals Directorate (ASD) reporting form on cyber.gov.au. ASD receives reports but is not the regulator; Home Affairs handles compliance.
• Contents, where known or reasonably knowable: your contact and business details including ABN; when the incident occurred and was discovered; impacts on you and your customers; the malware variant and any vulnerabilities exploited; the amount and method of the demand and of the payment; communications and pre-payment negotiations with the extorting entity; and the details of any other entity that paid on your behalf.
• Use limits (ss 29 to 32): the information may be used to help your response, for intelligence functions and to inform Ministers, with strict limits on secondary use. It is generally inadmissible against you in civil and criminal proceedings, subject to exceptions such as false information, obstruction and civil penalty proceedings under the Act itself. Reporting does not waive legal professional privilege.

Reporting a payment does not make it lawful in other respects. See the Ransomware Payments and Sanctions Guide.

Part 2: security standards for smart devices

• Statement of compliance (s 16 of the Act, s 9(3) of the Rules): product type and batch identifier; names and addresses of the manufacturer and its authorised representatives in Australia; declarations that it was prepared by or for the manufacturer and that the product complies; the defined support period at the date of issue; signatory name, function and signature; place and date of issue. Manufacturers and suppliers must keep it for five years (s 10).
• Alignment: Home Affairs states the standards closely follow the first three principles of ETSI EN 303 645 and align with the UK's 2023 product security regulations. A product built for the UK regime will usually be close. See the ETSI EN 303 645 Consumer IoT Guide and the UK PSTI Act Guide.
• Timing: products manufactured before 4 March 2026 do not need to comply.

Part 4: limited use of voluntarily shared information

• Voluntary (s 35): an impacted entity may share information with the National Cyber Security Coordinator about a significant cyber security incident; there is no obligation to answer a request.
• Significant (s 34): an incident with a material risk of seriously prejudicing Australia's social or economic stability, defence or national security, or that is, or could reasonably be expected to be, of serious concern to the Australian people.
• Limits (ss 38 to 40): the Coordinator must not use the information to investigate or enforce contraventions of other laws, except Part 4 itself and laws with criminal penalties. Secondary recipients are bound by similar purpose limits.
• Admissibility (s 42): the information is generally not admissible against the entity, with listed exceptions including false information and obstruction offences, coronial inquiries and Royal Commissions.
• Not a substitute: voluntary sharing does not satisfy the section 27 ransomware report, a SOCI notification or a Privacy Act notifiable data breach notice.

Part 5: Cyber Incident Review Board

• Purpose: no-fault, post-incident reviews of significant incidents, producing recommendations for government and industry. The Board does not assign blame.
• Criteria (s 46(3)): the incident seriously prejudiced or could seriously prejudice social or economic stability, defence or national security; or involved novel or complex methods or technologies; or is of serious concern to the Australian people. The review may start only after the incident and immediate response have ended and the Minister has approved terms of reference.
• Referral: by the Minister for Cyber Security, the Coordinator, an impacted entity or a Board member.
• Information powers (ss 49, 50): the Chair may require certain entities to produce documents, with a production period of at least 14 days. Production that would prejudice security, defence, international relations, intelligence or law enforcement is excluded.
• Composition: a Chair and six standing members, with review panels drawing on an Expert Panel whose members must hold or be eligible for an NV1 clearance. Published reports exclude personal and classified information.

Timeline and current status

1. 29 November 2024: Royal Assent. Parts 1, 4, 6 and 7 commence the next day.
2. March 2025: the three sets of Rules are made; the Smart Devices Rules are registered on 4 March 2025, starting the 12-month lead time for the standards.
3. 30 May 2025: ransomware payment reporting and the CIRB Rules commence. Phase 1, education first, runs to 31 December 2025, with regulatory action reserved for egregious non-compliance.
4. 1 January 2026: Phase 2, compliance and education, with a more active regulatory focus.
5. 4 March 2026: smart device standards apply to products manufactured on or after this date.
6. 4 May 2026: the Minister announces the Board's Chair and standing members.
7. 1 July 2026: Commonwealth penalty unit rises to $364.

Section 88 requires a review of the Act's operation. Check legislation.gov.au and the Home Affairs Cyber Security Act page for amendments before relying on these dates.

Enforcement and penalties

• Bodies corporate: under the Regulatory Powers (Standard Provisions) Act 2014, a court can generally impose a higher maximum on a body corporate than the stated amount; check the current multiplier with your lawyers rather than relying on the figures above.
• Tools (ss 78 to 83): civil penalty orders, infringement notices, enforceable undertakings, injunctions and monitoring powers, exercised by the Secretary of Home Affairs and authorised SES officers.
• Smart devices: the Technology Assessment and Regulation Office (TARO) in Home Affairs engages first, then the Secretary can issue compliance, stop or recall notices, request a statement of compliance, commission product testing and publicly name an entity that ignores a recall notice.
• Practical exposure: the dollar penalties are modest; the larger risks are public naming, recall cost and the overlap with SOCI, Privacy Act and directors' duties obligations.

What it means for AI agents and non-human identities

• Your 72-hour report needs identity facts: the report asks for exploited vulnerabilities and how the incident occurred. Most ransomware intrusions run through stolen credentials, remote access accounts or service accounts, so you need logs that show which human or machine identity was used. The Caesars Entertainment breach, where a reported ransom payment followed social engineering of an outsourced IT support vendor, is the kind of case that would now need an Australian report if it happened to a business in scope.
• Default passwords are a device identity problem: the password clause is about the device's own credentials. Manufacturers should provision unique per-device credentials or certificates at the factory. See the Device and IoT Identity Guide.
• Support periods drive credential lifetimes: a device beyond its defined support period still holds keys and tokens to cloud services; plan revocation of those machine credentials at end of support.
• Automated payment paths: if an insurer, negotiator or AI-assisted response service acts for you, make sure contracts require them to tell you within hours of any payment, because the 72-hour clock starts when you become aware.
• Evidence for the CIRB: a notice to produce can ask for documents about how access was gained. Keep audit logs for service accounts, API keys and agent actions long enough to answer it.

Framework mapping

Compliance steps

1. Determine applicability: confirm previous-year turnover against AUD 3 million (pro-rated if needed) and whether you are a SOCI Part 2B responsible entity; record the decision each financial year.
2. Add the 72-hour report to the incident response plan: name an owner, pre-fill business details and ABN, and map each field of the ASD form to the evidence source that answers it.
3. Fix the awareness gap: require insurers, brokers, incident response firms and group entities to notify you of any payment immediately, in writing.
4. Test it: run a tabletop that ends with a payment decision and time how long it takes to assemble the report; repeat yearly.
5. Decide on voluntary sharing: agree in advance, with legal counsel, when you will engage the Coordinator, knowing the Part 4 limits do not cover other mandatory notices.
6. For manufacturers and suppliers: inventory products by manufacture date, remove universal default passwords, publish a vulnerability contact and support periods, produce a statement of compliance per product type or batch, and keep it for five years.
7. Prepare for a CIRB notice: retain incident records, timelines and access logs in a form you can produce within 14 days.
8. Review annually: recheck the Act, Rules and Home Affairs guidance, and update the plan when they change.

Detection and measurement

• Time from payment awareness to report: measured in exercises; target well under 72 hours.
• Report field coverage: percentage of ASD form fields your logging can answer within 24 hours.
• Third-party notice clauses: percentage of insurers and response providers with a payment notification term.
• Products with a current statement of compliance: percentage of in-scope products manufactured since 4 March 2026.
• Vulnerability report response: median time to acknowledge reports received through the published contact.

Common failure patterns

• Assuming the insurer reports: the obligation stays with the reporting business entity even when someone else pays.
• Waiting for full facts: the report covers what is known or reasonably knowable; delay for completeness risks missing the deadline.
• Confusing regimes: treating a voluntary Coordinator briefing as a SOCI or Privacy Act notification.
• Shared default credentials on older stock: new batches comply but firmware updates reintroduce a shared service password.
• Unanswerable root cause: no logs on which service account or remote access identity the attacker used.

Practitioner checklist

• Record each year whether you are a reporting business entity under section 26.
• Name an owner and a deputy for the section 27 report.
• Pre-fill the ASD report details and store them with the incident response plan.
• Add payment notification clauses to insurance, broker and response contracts.
• Exercise the 72-hour report at least once a year.
• Log authentication by service accounts, API keys, remote access and agents well enough to explain initial access.
• Agree with counsel when to share with the National Cyber Security Coordinator.
• For connected products: unique passwords, a vulnerability contact, published support periods and five-year retained statements of compliance.
• Track penalty unit changes and amendments to the Act and Rules.

Standards and references

• Federal Register of Legislation: Cyber Security Act 2024
• Federal Register of Legislation: Cyber Security (Security Standards for Smart Devices) Rules 2025
• Department of Home Affairs: Cyber Security Act
• Department of Home Affairs: Ransomware Payment Reporting Factsheet
• Department of Home Affairs: Security Standards for Smart Devices Factsheet
• Department of Home Affairs: Cyber Incident Review Board
• Commonwealth of Australia: Penalty Unit Increase 1 July 2026

This guide summarises the Cyber Security Act 2024 (Cth) and its Rules as of 27 October 2026 and is not legal advice. Related NHI Mgmt Group resources: Australian Privacy and Cyber Rules Guide · Australia SOCI Act Guide · Ransomware Response and Recovery Guide · Essential Eight Guide