Artifact GuideAustraliaChecklist

Australia Cyber Security Act Checklist

Verify Australian cyber-security obligations for smart-device security standards and statements, ransomware payment reporting, SOCI critical-infrastructure risk management, and APRA CPS 234 controls.

Each item names the condition to check, the evidence to keep, and the official Act or Rules provision that supports the obligation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 25, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 25, 2026

Overview

Use this checklist for an initial evidence review before supplying a smart device with a , responding to a , operating a critical-infrastructure asset, or maintaining APRA information-security assurance. These are separate regimes with different scope tests and records.

Section 1

Smart-device security standards and statements

Use these checks when the product is a -grade relevant connectable product that will be acquired in Australia by a consumer. Part 2 applies to products manufactured on or after 29 November 2025 or supplied in Australia, other than as second-hand goods, on or after that date. The operative Smart Devices Rules requirements commenced on 4 March 2026 and exclude desktop or laptop computers, tablet computers, smartphones, therapeutic goods, road vehicles, and road vehicle components.

Confirm the product is intended, or is of a kind likely, to be used for personal, domestic, or household use or consumption, and record any exclusion relied on.
If the product is supplied second hand, check its manufacture date before closing the Part 2 review: the second-hand qualification limits the supply trigger, but a product manufactured on or after 29 November 2025 can still satisfy the separate manufacture trigger.
Verify product passwords are either unique per product or user-defined; if unique per product, keep evidence that they are not based on incremental counters, public information, or serial numbers unless protected by accepted encryption or keyed hashing.
Publish a clear security-issue reporting point of contact and state when reporters receive an acknowledgement and status updates until resolution.
Prepare the by or on behalf of the , including product type and batch identifier, manufacturer and authorised-representative details, compliance declarations, defined support period, signatory details, place, and date of issue.
Retain statements of compliance for the five-year period required by the Rules. Record how the satisfies the Act's duty to supply the product with the statement; the official explanatory statement says a physical statement is not required at the point of sale.

Sources for this answer

Cyber Security (Security Standards for Smart Devices) Rules 2025

Supports the smart-device checklist items for covered consumer-grade relevant connectable products, password requirements, security-issue reporting, statements of compliance, and five-year statement retention.

Section 2

Ransomware payment reporting evidence

Use these checks when an entity is impacted by a cyber security incident and has made, or becomes aware that another entity made on its behalf, a to an entity seeking to benefit from the incident.

Confirm scope: either a for a critical-infrastructure asset to which applies, or an entity carrying on business in Australia whose previous-financial-year annual turnover exceeds $3 million. The turnover limb excludes Commonwealth and State bodies and any responsible entity for a critical-infrastructure asset; the separate SOCI limb only captures responsible entities whose asset is subject to Part 2B.
Escalate an exact-$3-million result instead of closing the scope check automatically. Section 26 requires turnover to exceed the threshold, while the current cyber.gov.au form labels its ordinary-business option "equal to or exceeds $3 million." Record the calculation and confirm the filing position promptly because the form label does not amend the Act.
Start the 72-hour reporting evidence pack as soon as the payment is made or the entity becomes aware it was made, and limit mandatory content to information known or findable by reasonable search or enquiry within that period.
Capture the reporting entity , if any, and address; if another entity made the payment, capture that entity ABN, if any, and address as well.
Record when the incident occurred or is estimated to have occurred, when the entity became aware, impacts on infrastructure and customers, ransomware or malware variants, exploited vulnerabilities, and information that could assist Commonwealth or State response.
Record the amount or quantum and method demanded, the amount or quantum and method actually provided, and the nature, timing, description, and any pre-payment negotiations in communications with the extorting entity.

Sources for this answer

Cyber Security (Ransomware Payment Reporting) Rules 2025

Supports ransomware-payment checklist items for reporting business entity scope, the $3 million turnover threshold, the 72-hour reporting period, and report content.

Australian Government ransomware and cyber extortion payment reporting form

Current filing route; its ordinary-business option says "equal to or exceeds $3 million," while section 26 of the Act requires turnover to exceed the prescribed threshold.

Section 3

SOCI critical-infrastructure risk program checks

Use these checks only when the organisation is a for a critical-infrastructure asset to which Part 2A applies and no exemption removes the program duty. Keep this stream separate from Cyber Security Act ransomware reporting: SOCI risk-program obligations attach to the covered asset regardless of whether a payment event occurs.

Use the 10 June 2026 compilation of the risk-management-program rules. It adds for specified broadcasting, domain-name-system, electricity, energy-market-operator, freight, gas, liquid-fuel, and water assets. Existing covered assets generally receive 12 months from the amending instrument's commencement for section 6A and specified parts of sections 8A and 9A, and 24 months for the other enhanced provisions; later-added assets receive the same periods from the date they become critical infrastructure assets.

Confirm the asset, , and Part 2A or obligation being assessed before assigning any control or report owner.
Keep the current , change history, approvals, and evidence that the entity follows it for the asset.
Apply the current compiled risk-management-program rules when identifying cyber and information-security hazards, material risks, mitigations, baseline requirements, enhanced requirements, and the applicable grace period.
For each cyber or information-security hazard, record the asset function affected, plausible impact on essential goods or services, selected mitigations, residual risk, and governing-body approval or review evidence.
If the same incident also triggers reporting or another regulator notification, keep separate evidence packs so risk-program evidence is not confused with the Cyber Security Act payment report.

Sources for this answer

Security of Critical Infrastructure Act 2018

Part 2A supports the asset-specific program duty, program purpose, review, update, compliance, and annual-report checks.

Security of Critical Infrastructure (Critical infrastructure risk management program) Rules 2023

Current 10 June 2026 compilation for Part 2A asset coverage, baseline program requirements, enhanced requirements for specified asset classes, and the 12- and 24-month grace periods.

Cyber Security (Ransomware Payment Reporting) Rules 2025

Supports ransomware-payment checklist items for reporting business entity scope, the $3 million turnover threshold, the 72-hour reporting period, and report content.

Section 4

APRA CPS 234 controls and notification checks

Use these checks for and groups applying Prudential Standard . The checklist should produce evidence that Board oversight, controls, incident response, testing, and assurance match the criticality and sensitivity of information assets.

Document Board, senior management, governing-body, and individual information-security roles and responsibilities.
Classify information assets, including assets managed by related parties and third parties, by criticality and sensitivity.
Map controls to vulnerabilities and threats, asset criticality and sensitivity, lifecycle stage, and potential incident consequences; include third-party control-design evaluations where relevant.
Maintain incident response plans covering detection through post-incident review, escalation, and reporting to the Board or other responsible bodies, and review and test those plans annually.
Run a systematic control-testing program using appropriately skilled and functionally independent specialists; escalate testing deficiencies that cannot be remediated in a timely manner.
Notify APRA no later than 72 hours after becoming aware of a qualifying material information-security incident, and no later than 10 business days after becoming aware of a material control weakness that will not be remediated in a timely manner.

Sources for this answer

APRA Prudential Standard CPS 234 information security

Supports APRA-regulated entity checklist items for Board responsibility, asset classification, controls, incident response, testing, audit, and APRA notifications.

Recommended next step

Turn the Australia cyber-security checklist into assigned evidence

Create scoped smart-device, ransomware-reporting, SOCI, and APRA CPS 234 evidence tasks in Sorena.

Assessment workflow

Open Assessment Autopilot for Australia cyber-security checks

Turn the checklist into scoped questions for smart devices, ransomware reports, SOCI assets, and CPS 234 controls.

Explore next step

Research workflow

Review Australian cyber-security source evidence

Use Research Copilot to inspect the official sources behind each checklist item.

Explore next step

Talk to Sorena

Talk through implementation

Review scope, evidence gaps, owners, and next implementation actions with Sorena.

Explore next step

Primary sources

References and citations

APRA Prudential Standard CPS 234 information security

apra.gov.au

Referenced sections

Supports APRA-regulated entity checklist items for Board responsibility, asset classification, controls, incident response, testing, audit, and APRA notifications.

"The Board of an APRA-regulated entity is ultimately responsible"

Australian Government ransomware and cyber extortion payment reporting form

cyber.gov.au

Referenced sections

Current filing route; its ordinary-business option says "equal to or exceeds $3 million," while section 26 of the Act requires turnover to exceed the prescribed threshold.

Cyber Security (Ransomware Payment Reporting) Rules 2025

legislation.gov.au

Referenced sections

Supports ransomware-payment checklist items for reporting business entity scope, the $3 million turnover threshold, the 72-hour reporting period, and report content.

"within the 72 hour time period for giving the report"

Cyber Security (Security Standards for Smart Devices) Rules 2025

legislation.gov.au

Referenced sections

Supports the smart-device checklist items for covered consumer-grade relevant connectable products, password requirements, security-issue reporting, statements of compliance, and five-year statement retention.

"The statement must include the following information"

Security of Critical Infrastructure (Critical infrastructure risk management program) Rules 2023

legislation.gov.au

Referenced sections

Current 10 June 2026 compilation for Part 2A asset coverage, baseline program requirements, enhanced requirements for specified asset classes, and the 12- and 24-month grace periods.

Security of Critical Infrastructure Act 2018

legislation.gov.au

Referenced sections