Artifact GuideAustraliaCompliance

Australia Cyber Security Act Compliance

Use this guide to separate the Cyber Security Act 2024 compliance workstreams that affect connected products, ransomware payment reports, significant cyber incidents, and review-board evidence.

The page focuses on grounded statutory and rules-based requirements. This guidance is practical, source-linked, and should be validated against current legal and policy requirements before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

The Cyber Security Act 2024 is not a single one-size-fits-all cyber checklist. It creates separate compliance work for relevant connectable products, ransomware payment reports, voluntary significant-incident information sharing, and Cyber Incident Review Board interactions. Start by classifying which workstream is triggered, then assign the owner, evidence record, and source-linked action for that workstream.

Section 1

Classify the compliance workstream first

A useful Cyber Security Act compliance plan starts with scope classification. The Act covers mandatory security standards for certain internet-connectable products, reporting after ransomware payments, voluntary information sharing with the National Cyber Security Coordinator for significant cyber security incidents, and Cyber Incident Review Board reviews of certain incidents.

Treat those as separate workstreams. Product teams should not run the ransomware reporting checklist for a smart-device launch, and incident teams should not treat a ransomware payment as only a general security incident if the reporting-business-entity criteria are met.

For connected products, identify whether the item is a relevant connectable product that will be acquired in Australia and whether the smart-device rules apply.
For ransomware, check whether the entity is a reporting business entity, whether a cyber security incident affected it, and whether it made or became aware of a ransomware payment made on its behalf.
For significant incidents, separate voluntary information sharing with the National Cyber Security Coordinator from mandatory reports under other regimes.
For post-incident review readiness, preserve incident, response, remediation, and governance records that could support a Cyber Incident Review Board request or referral.

Sources for this answer

Cyber Security Act 2024

Supports the page's workstream split: product standards, ransomware reporting, significant-incident coordination, Cyber Incident Review Board reviews, and regulatory powers.

Cyber Security (Ransomware Payment Reporting) Rules 2025

Supports the ransomware scope test for reporting business entities, affected incidents, and payments made by or on behalf of the entity.

Section 2

Product compliance: smart-device standards and statements

For consumer-grade relevant connectable products, compliance work should produce a product-scope record, security-standard evidence, and a statement of compliance record before supply in Australia. The smart-device rules prescribe security standards for products intended or likely to be used for personal, domestic, or household use or consumption, with listed exclusions such as desktops, laptops, tablets, smartphones, therapeutic goods, road vehicles, and road vehicle components.

The operating record should show who prepared the statement, the product type and batch identifier, manufacturer and authorised-representative details, the compliance declaration, the defined support period, the signatory, and the place and date of issue. Keep the statement record for the prescribed 5-year period.

Confirm whether the product is consumer-grade and whether one of the listed excluded product categories applies.
Verify password controls: passwords must be unique per product or user-defined, and unique passwords must not be based on incremental counters or otherwise guessable in an unacceptable way.
Publish a clear point of contact for security-issue reports and explain when reporters receive acknowledgement and status updates.
Publish the defined support period for security updates as a period with an end date, and do not shorten it after publication.
Supply the product with a statement of compliance that meets the smart-device rules and retain it for 5 years.

Sources for this answer

Cyber Security (Security Standards for Smart Devices) Rules 2025

Supports smart-device scope, exclusions, statement-of-compliance contents, 5-year retention, password requirements, vulnerability-reporting contact requirements, and support-period publication.

Cyber Security Act 2024

Supports the Act-level duty for manufacturers and suppliers to comply with security standards and provide or supply products with statements of compliance.

Section 3

Incident compliance: ransomware payment reports

A ransomware payment report is not triggered by every cyber incident. The rules describe the reporting obligation where the entity is a reporting business entity, is impacted by a cyber security incident, and has provided a ransomware payment or knows another entity provided one on its behalf.

The rules set the turnover threshold at $3 million for the previous financial year, with a pro-rated formula for businesses carried on for only part of that year. They also limit the required report content to information the entity knows or can find out by reasonable search or enquiry within the 72-hour reporting period.

Record the basis for reporting-business-entity status: responsible entity for a Part 2B SOCI critical infrastructure asset, or Australian business turnover above the rules threshold.
Capture entity contact and business details, including ABN if any and address.
Capture incident facts: when the incident occurred or is estimated to have occurred, when the entity became aware, infrastructure and customer impacts, malware variants, exploited vulnerabilities, and information that could assist Commonwealth or State response.
Capture demand and payment facts: demanded amount or non-monetary benefit, demanded method of provision, actual payment amount or non-monetary benefit, and actual method of provision.
Capture extorting-entity communications, including timing, nature, brief description, and any pre-payment negotiations.

Sources for this answer

Cyber Security (Ransomware Payment Reporting) Rules 2025

Supports the reporting trigger, $3 million turnover threshold, 72-hour reasonable-search boundary, and the required report content categories.

Security of Critical Infrastructure Act 2018

Supports the SOCI cross-reference for responsible entities of critical infrastructure assets when assessing ransomware reporting-business-entity status.

Section 4

Governance evidence for significant incidents and reviews

The Act allows impacted entities to voluntarily provide information to the National Cyber Security Coordinator for significant cyber security incidents, while also limiting how certain information provided under the Act may be used or disclosed. Keep that information-sharing decision separate from mandatory notices under privacy, SOCI, prudential, or customer-contract processes.

For Cyber Incident Review Board readiness, preserve a review-quality record after major incidents: the incident chronology, response decisions, remediation status, external communications, legal privilege handling, and records showing which other investigations or proceedings are active. The Board rules require review timing to avoid interference with investigations or proceedings, and require published notification once a review is to be conducted.

Create one register entry per significant incident that distinguishes voluntary Coordinator information sharing from any mandatory report elsewhere.
Track what was shared, who approved it, the permitted cyber security purpose, and any confidentiality or admissibility assumptions that legal reviewers relied on.
For potential Board matters, preserve response and remediation evidence without rewriting it into a public-facing narrative before legal and incident leaders review it.
Watch for written referrals or information/document requests and route them to legal, security leadership, and the incident owner immediately.
Keep SOCI, privacy, prudential, customer, and Cyber Security Act evidence linked but not merged, because each regime may ask different questions about the same incident.

Sources for this answer

Cyber Security Act 2024

Supports voluntary significant-incident information sharing with the National Cyber Security Coordinator and Act-level protections and limitations on use, disclosure, and admissibility.

Cyber Security (Cyber Incident Review Board) Rules 2025

Supports review-board purpose, referral consideration, prioritisation factors, terms of reference, non-interference timing, and public notification of reviews.

Recommended next step

Turn Cyber Security Act compliance into assigned work

Use this guide to scope the relevant Cyber Security Act workstream, assign product or incident owners, and collect the evidence needed for smart-device statements, ransomware reports, or review-board readiness.

Assessment workflow

Open Assessment Autopilot for Cyber Security Act

Turn product and incident scope into assigned questions, evidence fields, and review tasks.

Explore next step

Research workflow

Review Cyber Security Act source evidence

Use Research Copilot to answer follow-up questions against cited source material.

Explore next step

Talk to Sorena

Talk through implementation

Review scope, owners, evidence gaps, and next compliance actions with Sorena.

Explore next step

Primary sources

References and citations

Cyber Security (Cyber Incident Review Board) Rules 2025

legislation.gov.au

Referenced sections

Supports review-board purpose, referral consideration, prioritisation factors, terms of reference, non-interference timing, and public notification of reviews.

"A review must not be conducted"

Cyber Security (Ransomware Payment Reporting) Rules 2025

legislation.gov.au

Referenced sections

Supports the reporting trigger, $3 million turnover threshold, 72-hour reasonable-search boundary, and the required report content categories.

"the amount of turnover threshold"

Cyber Security (Security Standards for Smart Devices) Rules 2025

legislation.gov.au

Referenced sections

Supports smart-device scope, exclusions, statement-of-compliance contents, 5-year retention, password requirements, vulnerability-reporting contact requirements, and support-period publication.

"the period is 5 years"

Cyber Security Act 2024

legislation.gov.au

Referenced sections

Supports voluntary significant-incident information sharing with the National Cyber Security Coordinator and Act-level protections and limitations on use, disclosure, and admissibility.

"Information may be voluntarily provided"

Security of Critical Infrastructure Act 2018

legislation.gov.au

Referenced sections

Supports the SOCI cross-reference for responsible entities of critical infrastructure assets when assessing ransomware reporting-business-entity status.