Compliance CalendarAustraliaCyber Security Act 2024

Australia Cyber Security Act Deadlines and Compliance Calendar

Use this calendar to track grounded Cyber Security Act 2024 milestones: commencement dates, ransomware reporting clocks, smart-device security standards, statement-of-compliance retention, and statutory review.

Dates below are included only where the grounding sources support them. Event-triggered obligations are separated from fixed calendar milestones.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

The Australia Cyber Security Act 2024 calendar has two kinds of work: fixed commencement milestones that compliance teams can place on a program roadmap, and rolling clocks that start only when a product, ransomware payment, regulator notice, or review event occurs.

Section 1

Fixed Cyber Security Act 2024 dates to put on the compliance calendar

Start the calendar with the Act's commencement table, then add the separate smart-device rules commencement table. Do not treat every calendar entry as a live filing deadline: some entries start a legal framework, while others activate a product or incident workflow.

For each milestone, record the affected cohort, the obligation that changes, the internal owner, and the source used to verify the date.

29 November 2024: the Cyber Security Act 2024 received Royal Assent.
30 November 2024: Parts 1, 4, 6, and 7 commenced, covering preliminary provisions, National Cyber Security Coordinator incident coordination, regulatory powers, and miscellaneous rule-making provisions.
29 May 2025: Parts 3 and 5 had default commencement dates if not fixed earlier by Proclamation, covering ransomware reporting obligations and the Cyber Incident Review Board framework.
29 November 2025: Part 2 had a default commencement date if not fixed earlier by Proclamation, covering security standards for smart devices.
4 March 2026: Part 2 and Schedule 1 of the Cyber Security (Security Standards for Smart Devices) Rules 2025 commence, activating the consumer-grade relevant connectable product security standard.
1 December 2027: the Parliamentary Joint Committee on Intelligence and Security may begin its review of the Act as soon as practicable after this date.

Sources for this answer

Cyber Security Act 2024

Supports the Act's Royal Assent, commencement dates for Parts 1 to 7, and the statutory review timing.

Cyber Security (Security Standards for Smart Devices) Rules 2025

Supports the 4 March 2025 registration date and 4 March 2026 commencement date for the smart-device rules' operative standards.

Recommended next step

Turn Cyber Security Act dates into tracked owners and evidence

Use this calendar to assign product, incident-response, legal, and compliance owners for fixed milestones and event-triggered Cyber Security Act obligations.

Assessment workflow

Open Assessment Autopilot for the Cyber Security Act

Convert calendar milestones into scoped questions, owners, evidence fields, and review tasks.

Explore next step

Research workflow

Review source evidence

Use Research Copilot to answer follow-up questions against the Act and official rules.

Explore next step

Talk to Sorena

Discuss calendar implementation

Review Australian cyber compliance dates, product scope, incident clocks, and next actions with Sorena.

Explore next step

Section 2

Event-triggered ransomware reporting clock

Ransomware reporting is not a standing monthly filing. The clock starts when a reporting business entity makes a ransomware payment or becomes aware that another entity has made the payment on its behalf after a cyber security incident.

Calendar owners should pre-build the intake fields before an incident: entity details, incident timing, impact, ransomware or malware variant, exploited vulnerabilities, demand details, payment details, communication timeline, and reasonable-search notes.

Trigger: a reporting business entity is impacted by a cyber security incident and provides, or becomes aware another entity has provided on its behalf, a ransomware payment.
Deadline: give the designated Commonwealth body a ransomware payment report within 72 hours of making the payment or becoming aware the payment was made.
Affected cohorts: responsible entities for critical infrastructure assets covered by SOCI Part 2B, and businesses carrying on business in Australia that exceed the $3 million previous-financial-year turnover threshold.
Evidence to keep: payment approval record, awareness timestamp, incident summary, demand communications, payment method, search/enquiry log, and submitted report confirmation.
Practical calendar control: keep a rolling 72-hour incident clock in the incident-response system, not only in the annual compliance calendar.

Sources for this answer

Cyber Security Act 2024

Supports the 72-hour ransomware payment reporting obligation in Part 3 of the Act.

Cyber Security (Ransomware Payment Reporting) Rules 2025

Supports the $3 million turnover threshold and the report content that can be found within the 72-hour period.

Section 3

Smart-device standards and statement-of-compliance dates

The smart-device calendar should be owned by product, supply-chain, legal, and go-to-market teams because the rules affect consumer-grade relevant connectable products acquired in Australia by consumers.

Before 4 March 2026, teams should identify affected product families, excluded product categories, manufacturer and supplier roles, support-period publication evidence, security-issue reporting process evidence, and statement-of-compliance issuance and retention records.

Affected products: consumer-grade relevant connectable products intended or likely to be used for personal, domestic, or household use or consumption, subject to listed exclusions such as desktops, laptops, tablets, smartphones, therapeutic goods, road vehicles, and road vehicle components.
Manufacturer workstream: verify the product is manufactured in compliance with the applicable security standard and that required manufacturer obligations are met.
Supplier workstream: verify the product is supplied in Australia with a statement of compliance meeting the rules.
Statement fields to prepare: product type and batch identifier, manufacturer and authorised representative details, compliance declaration, defined support period, signatory details, and place and date of issue.
Retention entry: keep the statement of compliance for 5 years under the smart-device rules.

Sources for this answer

Cyber Security Act 2024

Supports manufacturer and supplier obligations for relevant connectable products and statements of compliance.

Cyber Security (Security Standards for Smart Devices) Rules 2025

Supports the consumer-grade product scope, excluded categories, statement fields, and 5-year retention period.

Section 4

Calendar controls for notices, rules, and reviews

Some Cyber Security Act work cannot be scheduled as a fixed date because it depends on a regulator decision, a future rule-making process, or a review event. Those entries should appear as conditional controls with an owner and trigger source.

Treat these as watchlist entries: they require monitoring, assigned review ownership, and evidence that the team checked whether a trigger has occurred.

Rule changes: before making or amending rules, the Minister must publish draft rules or amendments and invite submissions for a period of at least 28 days.
Product enforcement notices: compliance, stop, recall, examination, and public-notification events need a response owner and evidence folder when a notice is received.
Cyber Incident Review Board activity: review notifications and information requests should be tracked as event-triggered response work, not guessed as annual deadlines.
Annual governance check: verify whether product families, Australian acquisition channels, SOCI responsible-entity status, turnover threshold, incident-response playbooks, and source URLs have changed.

Sources for this answer

Cyber Security Act 2024

Supports the 28-day minimum consultation period for rules and conditional enforcement or review workflows under the Act.

Cyber Security (Security Standards for Smart Devices) Rules 2025

Supports recall-notice publication details and consumer action recommendations for smart-device enforcement calendar entries.

Primary sources