We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideAustraliaChecklist

Australia Cyber Security Act Checklist

Verify Australian cyber-security obligations for smart-device security standards and statements, reporting, critical-infrastructure risk management, and APRA controls.

Each item names the condition to check, the evidence to keep, and the official Act or Rules provision that supports the obligation.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections6 primary sources
Overview

Use this checklist for an initial evidence review before supplying a smart device with a , responding to a , operating a critical-infrastructure asset, or maintaining APRA information-security assurance. These are separate regimes with different scope tests and records.

Section 1

Smart-device security standards and statements

Use these checks when the product is a -grade relevant connectable product that will be acquired in Australia by a consumer. Part 2 applies to products manufactured on or after 29 November 2025 or supplied in Australia, other than as second-hand goods, on or after that date. The operative Smart Devices Rules requirements commenced on 4 March 2026 and exclude desktop or laptop computers, tablet computers, smartphones, therapeutic goods, road vehicles, and road vehicle components.

  • Confirm the product is intended, or is of a kind likely, to be used for personal, domestic, or household use or consumption, and record any exclusion relied on.
  • If the product is supplied second hand, check its manufacture date before closing the Part 2 review: the second-hand qualification limits the supply trigger, but a product manufactured on or after 29 November 2025 can still satisfy the separate manufacture trigger.
  • Verify product passwords are either unique per product or user-defined; if unique per product, keep evidence that they are not based on incremental counters, public information, or serial numbers unless protected by accepted encryption or keyed hashing.
  • Publish a clear security-issue reporting point of contact and state when reporters receive an acknowledgement and status updates until resolution.
  • Publish the defined security-update support period with an end date. Preserve the published version, do not shorten it, and publish any extension as soon as practicable.
  • Make security-issue and support-period information accessible, clear, transparent, in English, free, available without prior request and without collecting personal information. For support-period information, also make it understandable without technical knowledge; if offering the product on a controlled website, show it prominently with purchase-decision information and with equal prominence to each publication of the main product characteristics.
  • Prepare the by or on behalf of the , including product type and batch identifier, manufacturer and authorised-representative details, compliance declarations, defined support period, signatory details, place, and date of issue.
  • Retain statements of compliance for the five-year period required by the Rules. Record how the satisfies the Act's duty to supply the product with the statement; the official explanatory statement says a physical statement is not required at the point of sale.
Section 2

Ransomware payment reporting evidence

Use these checks when an entity is impacted by a cyber security incident and has made, or becomes aware that another entity made on its behalf, a to an entity seeking to benefit from the incident.

  • Confirm scope: either a for a critical-infrastructure asset to which applies, or an entity carrying on business in Australia whose previous-financial-year annual turnover exceeds $3 million. The turnover limb excludes Commonwealth and State bodies and any responsible entity for a critical-infrastructure asset; the separate SOCI limb only captures responsible entities whose asset is subject to Part 2B.
  • Escalate an exact-$3-million result instead of closing the scope check automatically. Section 26 requires turnover to exceed the threshold, while the current cyber.gov.au form labels its ordinary-business option "equal to or exceeds $3 million." Record the calculation and confirm the filing position promptly because the form label does not amend the Act.
  • Start the 72-hour reporting evidence pack as soon as the payment is made or the entity becomes aware it was made, and limit mandatory content to information known or findable by reasonable search or enquiry within that period.
  • Capture the reporting entity , if any, and address; if another entity made the payment, capture that entity ABN, if any, and address as well.
  • Record when the incident occurred or is estimated to have occurred, when the entity became aware, impacts on infrastructure and customers, ransomware or malware variants, exploited vulnerabilities, and information that could assist Commonwealth or State response.
  • Record the amount or quantum and method demanded, the amount or quantum and method actually provided, and the nature, timing, description, and any pre-payment negotiations in communications with the extorting entity.
Section 3

SOCI critical-infrastructure risk program checks

Use these checks only when the organisation is a for a critical-infrastructure asset to which Part 2A applies and no exemption removes the program duty. Keep this stream separate from Cyber Security Act ransomware reporting: SOCI risk-program obligations attach to the covered asset regardless of whether a payment event occurs.

Use the 10 June 2026 compilation of the risk-management-program rules. It adds for specified broadcasting, domain-name-system, electricity, energy-market-operator, freight, gas, liquid-fuel, and water assets. Existing covered assets generally receive 12 months from the amending instrument's commencement for section 6A and specified parts of sections 8A and 9A, and 24 months for the other enhanced provisions; later-added assets receive the same periods from the date they become critical infrastructure assets.

  • Confirm the asset, , and Part 2A or obligation being assessed before assigning any control or report owner.
  • Keep the current , change history, approvals, and evidence that the entity follows it for the asset.
  • Apply the current compiled risk-management-program rules when identifying cyber and information-security hazards, material risks, mitigations, baseline requirements, enhanced requirements, and the applicable grace period.
  • For each cyber or information-security hazard, record the asset function affected, plausible impact on essential goods or services, selected mitigations, residual risk, and governing-body approval or review evidence.
  • If the same incident also triggers reporting or another regulator notification, keep separate evidence packs so risk-program evidence is not confused with the Cyber Security Act payment report.
Section 4

APRA CPS 234 controls and notification checks

Use these checks for and groups applying Prudential Standard . The checklist should produce evidence that Board oversight, controls, incident response, testing, and assurance match the criticality and sensitivity of information assets.

  • Document Board, senior management, governing-body, and individual information-security roles and responsibilities.
  • Classify information assets, including assets managed by related parties and third parties, by criticality and sensitivity.
  • Map controls to vulnerabilities and threats, asset criticality and sensitivity, lifecycle stage, and potential incident consequences; include third-party control-design evaluations where relevant.
  • Maintain incident response plans covering detection through post-incident review, escalation, and reporting to the Board or other responsible bodies, and review and test those plans annually.
  • Run a systematic control-testing program using appropriately skilled and functionally independent specialists; escalate testing deficiencies that cannot be remediated in a timely manner.
  • Notify APRA no later than 72 hours after becoming aware of a qualifying material information-security incident, and no later than 10 business days after becoming aware of a material control weakness that will not be remediated in a timely manner.
Recommended next step

Turn the Australia cyber-security checklist into assigned evidence

Create scoped smart-device, ransomware-reporting, SOCI, and APRA CPS 234 evidence tasks in Sorena.

Assessment workflow
Open Assessment Autopilot for Australia cyber-security checks

Turn the checklist into scoped questions for smart devices, ransomware reports, SOCI assets, and CPS 234 controls.

Explore next step
Research workflow
Review Australian cyber-security source evidence

Use Research Copilot to inspect the official sources behind each checklist item.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence gaps, owners, and next implementation actions with Sorena.

Explore next step
Primary sources

References and citations

Security of Critical Infrastructure (Critical infrastructure risk management program) Rules 2023
legislation.gov.au2 citations
Referenced sections
  • Current 10 June 2026 compilation for baseline and enhanced critical infrastructure risk management program requirements, affected asset classes, and transitional grace periods.
  • Current 10 June 2026 compilation for Part 2A asset coverage, baseline program requirements, enhanced requirements for specified asset classes, and the 12- and 24-month grace periods.
Security of Critical Infrastructure Act 2018
legislation.gov.au2 citations
Referenced sections
  • Part 2A supports the asset-specific critical infrastructure risk management program duty, program purpose, and lifecycle requirements.
  • Part 2A supports the asset-specific program duty, program purpose, review, update, compliance, and annual-report checks.
"critical infrastructure risk management program"
APRA Prudential Standard CPS 234 information security
apra.gov.au
Referenced sections
  • Supports APRA-regulated entity checklist items for Board responsibility, asset classification, controls, incident response, testing, audit, and APRA notifications.
"The Board of an APRA-regulated entity is ultimately responsible"
Cyber Security (Ransomware Payment Reporting) Rules 2025
legislation.gov.au
Referenced sections
  • Supports ransomware-payment checklist items for reporting business entity scope, the $3 million turnover threshold, the 72-hour reporting period, and report content.
"within the 72 hour time period for giving the report"
Cyber Security (Security Standards for Smart Devices) Rules 2025
legislation.gov.au
Referenced sections
  • Supports the smart-device checklist items for covered consumer-grade relevant connectable products, password requirements, security-issue reporting, statements of compliance, and five-year statement retention.
"The statement must include the following information"

Related guides

Australia Compliance Statement Evidence Workflow

Evidence workflow for preparing, supplying, and retaining statements of compliance under Australia's Cyber Security Act 2024 and Smart Devices Rules.

Australia Cyber Security Act 2024 scope and definitions

Scope guide for Australia's Cyber Security Act 2024: relevant connectable products, consumer-grade smart devices, reporting business entities, ransomware payment reports, and SOCI overlap.

Australia Cyber Security Act and SOCI Act overlap

How the Australia Cyber Security Act overlaps with the Security of Critical Infrastructure Act for responsible entities, ransomware payment reporting, smart devices, and evidence records.

Australia Cyber Security Act Applicability Test

Decide whether the Australia Cyber Security Act 2024 applies to a smart-device product, supplier, manufacturer, or ransomware payment reporting scenario.

Australia Cyber Security Act Commencement Timeline

Cyber Security Act 2024 commencement timeline for ransomware reporting, CIRB reviews, smart-device duties, statement retention, and statutory review.

Australia Cyber Security Act Compliance Guide

A cited compliance guide for Australia Cyber Security Act smart-device statements, ransomware payment reporting, incident coordination, and review-board readiness.

Show all related guides (29)

Australia Cyber Security Act Deadlines and Calendar

Cyber Security Act 2024 dates and event-driven deadlines for ransomware payment reports, smart-device duties, records, notices, and statutory review.

Australia Cyber Security Act FAQ

Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review.

Australia Cyber Security Act penalties and fines

Cyber Security Act 2024 civil penalties explained by section, including ransomware reports, protected information, CIRB notices, and smart-device enforcement.

Australia Cyber Security Act Requirements

Australia Cyber Security Act requirements for smart-device security standards, statements of compliance, ransomware payment reports, notices, and evidence records.

Australia Cyber Security Act Statement of Compliance Evidence

Evidence guide for Australia Cyber Security Act smart-device statements of compliance: required fields, manufacturer and supplier records, five-year retention, and examination readiness.

Australia Cyber Security Act templates

Source-backed field lists for Australia Cyber Security Act smart-device scope, statements of compliance, ransomware reports, notices, SOCI overlap, and records.

Australia Cyber Security Act vs EU Cyber Resilience Act

Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes.

Australia Cyber Security Act vs UK PSTI Act Guide

Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime.

Australia ransomware payment reporting 72-hour duty

Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain.

Australia Ransomware Payment Reporting Workflow

Operational workflow for Australia Cyber Security Act 2024 ransomware payment reports: scope, 72-hour trigger, report fields, owners, evidence, and cited Act and Rules sources.

Australia Smart Device Applicability Workflow

Decide whether Australia's mandatory smart-device security standard applies, including commencement, connectivity, consumer use, exclusions, roles, and evidence.

Australia Smart Device Compliance Statement

What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Devices Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination.

Australia Smart Device Security Standards under the Cyber Security Act

Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records.

CSA 2024 Smart Device Applicability Test

Check whether a smart device is a consumer-grade relevant connectable product under Australia's Cyber Security Act and Smart Devices Rules.

Cyber Security Act 2024 Smart Device Compliance Checklist

Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence.

SOCI overlap triage workflow for Australia Cyber Security Act

Triage SOCI Act overlap with Australia Cyber Security Act ransomware reporting and smart-device standards using separate owners, evidence, and cited scope checks.

Australia Cyber Security Act recordkeeping FAQ

What records to keep for Cyber Security Act 2024 smart-device statements, ransomware payment reports, and supported SOCI or APRA overlap checks.

Australia Ransomware Payment Reporting: Threshold and Report Content

FAQ answer on Australia's Cyber Security Act ransomware payment reporting scope, $3 million turnover threshold, 72-hour trigger, report fields, and evidence.

Cyber Security Act 2024 Statements of Compliance FAQ

Australian smart-device statements of compliance: covered products, responsible actors, required contents, supporting evidence, and five-year retention.

How do notices and recalls work under the Australia Cyber Security Act?

FAQ on Australia Cyber Security Act compliance notices, stop notices, recall notices, public notifications, owners, evidence fields, and cited timing.

How does the Australia Cyber Security Act overlap with the SOCI Act?

FAQ on when Australia Cyber Security Act ransomware reporting overlaps with SOCI critical infrastructure assets, responsible entities, and smart-device duties.

Manufacturer, Importer, and Supplier Duties under Australia's Cyber Security Act 2024

Cyber Security Act 2024 smart-device duties for manufacturers, importers, and suppliers, including role tests, scope, statements, and records.

Which smart devices are in scope under Australia's Cyber Security Act 2024?

FAQ on Cyber Security Act 2024 smart-device scope: relevant connectable products, consumer-grade criteria, exclusions, Australian consumer acquisition, and records to keep.