Australia Cyber Security Act Compliance

Start a Cyber Security Act compliance plan by classifying scope. The Act covers mandatory security standards for certain connectable products, reporting after ransomware payments, voluntary information sharing with the National Cyber Security Coordinator for a significant cyber security incident, and Cyber Incident Review Board reviews of certain incidents.

Treat those as separate workstreams. Product teams should not run the ransomware reporting checklist for a smart-device launch, and incident teams should not treat a ransomware payment as only a general security incident if the reporting-business-entity criteria are met.

For consumer-grade relevant connectable products, compliance work should produce a product-scope record, security-standard evidence, and a statement of compliance record before supply in Australia. The smart-device rules prescribe security standards for products intended or likely to be used for personal, domestic, or household use or consumption, with listed exclusions such as desktops, laptops, tablets, smartphones, therapeutic goods, road vehicles, and road vehicle components. The required Australian consumer acquisition can include some business purchases: section 3 of the Australian Consumer Law covers goods priced at no more than the prescribed $100,000 amount or ordinarily acquired for personal, domestic or household use, but excludes acquisitions for resale and specified production, manufacture, repair, or treatment uses.

The operating record should show who prepared the statement, the product type and batch identifier, manufacturer and authorised-representative details, the compliance declaration, the defined support period, the signatory, and the place and date of issue. Keep the statement record for the prescribed 5-year period. The official explanatory statement clarifies that it need not be physically provided at the point of sale.

A ransomware payment report is not triggered by every cyber incident. The rules describe the reporting obligation where the entity is a reporting business entity, is impacted by a cyber security incident, and has provided a ransomware payment or knows another entity provided one on its behalf. Give the report within 72 hours of making the payment or becoming aware that another entity made it on the reporting entity's behalf, whichever event applies.

The rules set the turnover threshold at $3 million for the previous financial year, with a pro-rated formula for businesses carried on for only part of that year. Section 26 requires turnover to exceed the threshold. The current cyber.gov.au form instead labels its business option "equal to or exceeds $3 million," so an entity at exactly $3 million should confirm the filing position promptly. The Rules also limit the required report content to information the entity knows or can find out by reasonable search or enquiry within the 72-hour reporting period.

The Act allows impacted entities to voluntarily provide information to the National Cyber Security Coordinator for significant cyber security incidents, while also limiting how certain information provided under the Act may be used or disclosed. Keep that information-sharing decision separate from mandatory notices under privacy, SOCI, prudential, or customer-contract processes.

For Cyber Incident Review Board readiness, preserve a review-quality record after major incidents: the incident chronology, response decisions, remediation status, external communications, legal privilege handling, and records showing which other investigations or proceedings are active. The Board rules require review timing to avoid interference with investigations or proceedings, and require published notification once a review is to be conducted.