We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Compliance CalendarAustraliaCyber Security Act 2024

Australia Cyber Security Act Deadlines and Compliance Calendar

Use this calendar to track Cyber Security Act 2024 commencement dates, the 72-hour ransomware payment reporting clock, smart-device duties, statement retention, notices, and statutory review.

Fixed legal milestones are separated from deadlines that start only after a payment, notice, product event, or review request.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections7 primary sources
Overview

The Cyber Security Act 2024 calendar has two kinds of work: fixed commencement milestones and rolling clocks that start only when a product is manufactured or supplied, a ransomware payment is made or discovered, a notice is received, or a review request is issued.

Section 1

Fixed Cyber Security Act 2024 dates to put on the compliance calendar

Start with the Act's commencement table, then add the commencement provisions in each set of Rules. A commencement date starts a legal framework; it is not automatically a filing deadline.

The Federal Register's commencement table displays 29 May 2025 for Parts 3 and 5, but section 2 says the dates displayed in column 3 are not part of the Act. The binding column 2 mechanism starts each Part on the day after the six-month fallback period unless a proclamation fixes an earlier day. The Ransomware Payment Reporting Rules and Rules commence with those Parts. Home Affairs guidance says both regimes started on 30 May 2025. Because the official sources differ by one day, record the discrepancy and obtain case-specific advice before deciding whether an event on 29 May 2025 triggered either regime.

For each milestone, record the affected cohort, the obligation that changes, the internal owner, and the source used to verify the date.

  • 29 November 2024: the Cyber Security Act 2024 received Royal Assent.
  • 30 November 2024: Parts 1, 4, 6, and 7 commenced, covering preliminary provisions, National Cyber Security Coordinator incident coordination, regulatory powers, and miscellaneous rule-making provisions.
  • 29 May 2025 in the Federal Register commencement table; 30 May 2025 in Home Affairs guidance: the cited official sources differ on the start of Parts 3 and 5 and the linked ransomware and CIRB Rules.
  • 29 November 2025: Part 2 commenced, bringing within its application products manufactured on or after that date and products supplied, other than as second-hand goods, on or after that date.
  • 4 March 2026: Part 2 and Schedule 1 of the Cyber Security (Security Standards for Smart Devices) Rules 2025 commenced, activating the prescribed consumer-grade product standard and statement requirements.
  • After 1 December 2027: the Parliamentary Joint Committee on Intelligence and Security () may review the Act, provided it begins as soon as practicable after that date.
Recommended next step

Turn Cyber Security Act dates into tracked owners and evidence

This calendar helps assign product, incident-response, legal, and compliance owners for fixed milestones and event-triggered Cyber Security Act obligations.

Assessment workflow
Open Assessment Autopilot for the Cyber Security Act

Convert calendar milestones into scoped questions, owners, evidence fields, and review tasks.

Explore next step
Research workflow
Review source evidence

Use Research Copilot to answer follow-up questions against the Act and official rules.

Explore next step
Talk to Sorena
Discuss calendar implementation

Review Australian cyber compliance dates, product scope, incident clocks, and next actions with Sorena.

Explore next step
Section 2

Event-triggered ransomware reporting clock

Ransomware reporting is not a monthly filing. For a covered entity and payment, section 27 starts the clock when the makes the ransomware payment or becomes aware that another entity made it on its behalf.

Set up the intake fields before an incident: entity details, incident timing, impact, ransomware or malware variant, exploited vulnerabilities, demand details, payment details, communication timeline, and reasonable-search notes.

  • Trigger: a is impacted by a cyber security incident and provides, or becomes aware another entity has provided on its behalf, a ransomware payment.
  • Deadline: give the designated Commonwealth body a ransomware payment report within 72 hours of making the payment or becoming aware the payment was made.
  • Affected cohorts: responsible entities for critical infrastructure assets to which Part 2B applies, or an entity carrying on business in Australia whose previous-financial-year turnover exceeds the $3 million threshold and that is not a Commonwealth body, State body or responsible entity for a critical infrastructure asset. Apply the Rules' partial-year formula where relevant.
  • Evidence to keep: payment approval record, awareness timestamp, incident summary, demand communications, payment method, search/enquiry log, and submitted report confirmation.
  • Calendar control: keep the rolling 72-hour clock in the incident-response system, not only in the annual compliance calendar.
Section 3

Smart-device standards and statement-of-compliance dates

Product, supply-chain, legal, and go-to-market teams need the smart-device calendar because the Rules affect prescribed consumer-grade relevant connectable products acquired in Australia by consumers.

Part 2 applies to products manufactured on or after 29 November 2025 or supplied, other than as second-hand goods, on or after that date. The prescribed standard and statement provisions became operative on 4 March 2026.

  • Affected products: each consumer-grade intended or likely to be used for personal, domestic, or household use or consumption, subject to listed exclusions such as desktops, laptops, tablets, smartphones, therapeutic goods, road vehicles, and road vehicle components.
  • Manufacturer workstream: confirm the product meets the password, security-issue reporting, and defined-support-period requirements in Schedule 1 and prepare the statement of compliance.
  • Supplier workstream: do not supply a covered product that was not manufactured in compliance when the supplier knows, or could reasonably be expected to know, it will be acquired in Australia by a consumer. Supply it with the manufacturer's statement of compliance and retain a copy.
  • Statement fields to prepare: product type and batch identifier, manufacturer and authorised representative details, compliance declaration, defined support period, signatory details, and place and date of issue.
  • Retention entry: manufacturers and suppliers must retain a copy of each statement for 5 years. Create a retention record for each statement; the Act and Rules do not set one common calendar destruction date.
Section 4

Calendar controls for notices, rules, and reviews

Some Cyber Security Act work depends on a regulator decision, future rule-making, or a review event and cannot be scheduled as a fixed date. Record these items as conditional controls with an owner and trigger source.

Treat these as watchlist entries with a trigger, owner, response period, and evidence location.

  • Rule changes: before making or amending rules, the Minister must publish draft rules or amendments and invite submissions for a period of at least 28 days.
  • Product enforcement notices: compliance, stop, recall, examination, and public-notification events need a response owner and evidence folder when a notice is received.
  • activity: a section 48 request is voluntary. After such a request, a section 49 notice may compel an involved non-government entity to produce specified relevant documents; the production period stated in the notice must be at least 14 days.
  • Annual governance check: verify whether product families, Australian acquisition channels, responsible-entity status, turnover threshold, incident-response playbooks, and source URLs have changed.
Primary sources

References and citations

Cyber Security Act 2024
legislation.gov.au5 citations
Referenced sections
  • Primary Act source for Royal Assent, commencement dates, ransomware reporting timing, smart-device obligations, rule consultation, enforcement powers, and statutory review.
  • Supports Royal Assent, the commencement table for Parts 1 to 7, and the statutory review timing. The Act states that dates inserted in column 3 are not part of the Act.
  • Supports the 72-hour ransomware payment reporting obligation in Part 3 of the Act.
Show 2 more
  • Supports manufacturer and supplier obligations for relevant connectable products and statements of compliance.
  • Supports the 28-day minimum consultation period for rules, the voluntary section 48 request, and the section 49 production period of at least 14 days.
"This Act is the Cyber Security Act 2024."
More quoted passages
"Commencement information"
"within 72 hours"
"Obligation to provide and supply products"
"The period specified in the notice must not be shorter than 28 days."
Cyber Security (Security Standards for Smart Devices) Rules 2025
legislation.gov.au3 citations
Referenced sections
  • Official rules source for smart-device commencement, consumer-grade product scope, statement-of-compliance fields, and 5-year retention.
  • Supports the 4 March 2025 registration date and 4 March 2026 commencement date for the smart-device rules' operative standards.
  • Supports the consumer-grade product scope, excluded categories, statement fields, and 5-year retention period.
"This instrument is the Cyber Security (Security Standards for Smart Devices) Rules 2025."
More quoted passages
"Part 2 and Schedule 1"
"the period is 5 years"
Cyber Security (Cyber Incident Review Board) Rules 2025
legislation.gov.au2 citations
Referenced sections
  • Official Rules source for commencement with Part 5 and the post-incident review process.
  • Supports that the Rules commenced at the same time as Part 5 of the Act.
"at the same time as Part 5"
Department of Home Affairs - Cyber Security Act
homeaffairs.gov.au2 citations
Referenced sections
  • Departmental guidance states 30 May 2025 for ransomware reporting and the CIRB Rules; the Federal Register commencement table lists 29 May 2025.
  • Departmental guidance states 30 May 2025, one day later than the Federal Register commencement table; this source documents the discrepancy.
"start from 30 May 2025"
Cyber Security (Ransomware Payment Reporting) Rules 2025
legislation.gov.au
Referenced sections
  • Official rules source for ransomware reporting scope, $3 million turnover threshold, and report content required within the 72-hour clock.
"This instrument is the Cyber Security (Ransomware Payment Reporting) Rules 2025."

Related guides

Australia Compliance Statement Evidence Workflow

Evidence workflow for preparing, supplying, and retaining statements of compliance under Australia's Cyber Security Act 2024 and Smart Devices Rules.

Australia Cyber Security Act 2024 scope and definitions

Scope guide for Australia's Cyber Security Act 2024: relevant connectable products, consumer-grade smart devices, reporting business entities, ransomware payment reports, and SOCI overlap.

Australia Cyber Security Act and SOCI Act overlap

How the Australia Cyber Security Act overlaps with the Security of Critical Infrastructure Act for responsible entities, ransomware payment reporting, smart devices, and evidence records.

Australia Cyber Security Act Applicability Test

Decide whether the Australia Cyber Security Act 2024 applies to a smart-device product, supplier, manufacturer, or ransomware payment reporting scenario.

Australia Cyber Security Act Commencement Timeline

Cyber Security Act 2024 commencement timeline for ransomware reporting, CIRB reviews, smart-device duties, statement retention, and statutory review.

Australia Cyber Security Act Compliance Checklist

Concrete checklist items for Australian Cyber Security Act smart-device and ransomware duties, with SOCI and APRA CPS 234 evidence checks.

Show all related guides (29)

Australia Cyber Security Act Compliance Guide

A cited compliance guide for Australia Cyber Security Act smart-device statements, ransomware payment reporting, incident coordination, and review-board readiness.

Australia Cyber Security Act FAQ

Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review.

Australia Cyber Security Act penalties and fines

Cyber Security Act 2024 civil penalties explained by section, including ransomware reports, protected information, CIRB notices, and smart-device enforcement.

Australia Cyber Security Act Requirements

Australia Cyber Security Act requirements for smart-device security standards, statements of compliance, ransomware payment reports, notices, and evidence records.

Australia Cyber Security Act Statement of Compliance Evidence

Evidence guide for Australia Cyber Security Act smart-device statements of compliance: required fields, manufacturer and supplier records, five-year retention, and examination readiness.

Australia Cyber Security Act templates

Source-backed field lists for Australia Cyber Security Act smart-device scope, statements of compliance, ransomware reports, notices, SOCI overlap, and records.

Australia Cyber Security Act vs EU Cyber Resilience Act

Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes.

Australia Cyber Security Act vs UK PSTI Act Guide

Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime.

Australia ransomware payment reporting 72-hour duty

Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain.

Australia Ransomware Payment Reporting Workflow

Operational workflow for Australia Cyber Security Act 2024 ransomware payment reports: scope, 72-hour trigger, report fields, owners, evidence, and cited Act and Rules sources.

Australia Smart Device Applicability Workflow

Decide whether Australia's mandatory smart-device security standard applies, including commencement, connectivity, consumer use, exclusions, roles, and evidence.

Australia Smart Device Compliance Statement

What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Devices Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination.

Australia Smart Device Security Standards under the Cyber Security Act

Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records.

CSA 2024 Smart Device Applicability Test

Check whether a smart device is a consumer-grade relevant connectable product under Australia's Cyber Security Act and Smart Devices Rules.

Cyber Security Act 2024 Smart Device Compliance Checklist

Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence.

SOCI overlap triage workflow for Australia Cyber Security Act

Triage SOCI Act overlap with Australia Cyber Security Act ransomware reporting and smart-device standards using separate owners, evidence, and cited scope checks.

Australia Cyber Security Act recordkeeping FAQ

What records to keep for Cyber Security Act 2024 smart-device statements, ransomware payment reports, and supported SOCI or APRA overlap checks.

Australia Ransomware Payment Reporting: Threshold and Report Content

FAQ answer on Australia's Cyber Security Act ransomware payment reporting scope, $3 million turnover threshold, 72-hour trigger, report fields, and evidence.

Cyber Security Act 2024 Statements of Compliance FAQ

Australian smart-device statements of compliance: covered products, responsible actors, required contents, supporting evidence, and five-year retention.

How do notices and recalls work under the Australia Cyber Security Act?

FAQ on Australia Cyber Security Act compliance notices, stop notices, recall notices, public notifications, owners, evidence fields, and cited timing.

How does the Australia Cyber Security Act overlap with the SOCI Act?

FAQ on when Australia Cyber Security Act ransomware reporting overlaps with SOCI critical infrastructure assets, responsible entities, and smart-device duties.

Manufacturer, Importer, and Supplier Duties under Australia's Cyber Security Act 2024

Cyber Security Act 2024 smart-device duties for manufacturers, importers, and suppliers, including role tests, scope, statements, and records.

Which smart devices are in scope under Australia's Cyber Security Act 2024?

FAQ on Cyber Security Act 2024 smart-device scope: relevant connectable products, consumer-grade criteria, exclusions, Australian consumer acquisition, and records to keep.