Australia Cyber Security Act Ransomware payment threshold and report content

Part 3 applies only where an incident has occurred, is occurring, or is imminent; it is a cyber security incident that has had, is having, or could reasonably be expected to have a direct or indirect impact on a reporting business entity; an extorting entity makes a demand to benefit from the incident or its impact; and the reporting business entity provides, or knows another entity has provided on its behalf, a payment or benefit directly related to that demand.

The cyber security incident test is narrower than a general label for any digital disruption. Section 9 requires an event covered by the SOCI Act meaning or an unauthorised impairment of electronic communications to or from a computer, plus a listed constitutional connection. For incidents outside the critical-infrastructure-asset and constitutional-corporation limbs, section 26 presumes the event is a cyber security incident if it was probably internet-enabled, probably impaired a computer's connection, or probably seriously prejudiced specified Australian interests. That presumption does not create civil-penalty liability if the relevant condition did not exist in fact.

A reporting business entity is either a responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies, or an entity carrying on business in Australia whose annual turnover for the previous financial year exceeds the turnover threshold and that is not a Commonwealth body, State body, or responsible entity for a critical infrastructure asset.

The 2025 Rules prescribe a $3 million threshold for the previous financial year. Section 26 of the Act says annual turnover must exceed that threshold, so turnover of exactly $3 million does not satisfy the ordinary-business limb. If the business operated for only part of the previous financial year, the Rules prorate the threshold: $3 million multiplied by the number of days the business operated in that year, divided by the number of days in the year. The Act still requires turnover to exceed the resulting amount.

The Federal Register displays 29 May 2025 for Part 3 commencement, while Home Affairs says ransomware payment reporting started on 30 May 2025. Obtain case-specific advice for an event on 29 May. Commonwealth bodies and State bodies are excluded from the ordinary-business limb. A responsible entity for a critical infrastructure asset must use the separate limb, which applies only where SOCI Act Part 2B applies to the asset.

The current cyber.gov.au form describes its ordinary-business option as turnover that is equal to or exceeds $3 million. That wording conflicts with section 26 of the Act, which says turnover must exceed the prescribed threshold. For turnover of exactly $3 million, preserve the calculation and seek confirmation from Home Affairs rather than treating the form label as an amendment to the Act.

The reporting business entity must give the designated Commonwealth body a ransomware payment report within 72 hours of making the ransomware payment or becoming aware that another entity made it on its behalf, whichever applies. The Australian Government provides the current reporting form through cyber.gov.au.

The Act requires the report to include information the reporting business entity knows or can find out by reasonable search or enquiry at the time of reporting. The report must cover contact and business details for the reporting business entity if it made the payment, or the other entity if another entity paid; the cyber security incident and its impact; the extortion demand; the ransomware payment; and communications with the extorting entity about the incident, demand, and payment.

The Rules add detail: Australian Business Number (ABN), if any, and address for the reporting entity or other payer; when the incident occurred or is estimated to have occurred; when the reporting business entity became aware of it; impacts on infrastructure and customers; ransomware or malware variants; exploited vulnerabilities; response-useful information; the amount or quantum and method demanded; the amount or quantum and method provided, including non-monetary benefits; and the nature, timing, description, and any pre-payment negotiations in communications with the extorting entity.

An incident-response policy or payment approval note does not establish whether section 27 applies. The record needs the reporting-business-entity analysis, threshold calculation, 72-hour clock, and report-content inventory tied to the Act and Rules.

Do not rely on a generic ransomware playbook to decide whether the Part 3 report is triggered. Preserve the facts that distinguish a non-reportable incident from a reportable ransomware payment: entity status, Australian business activity, turnover, critical-infrastructure responsibility, the demand, the payment or benefit, and awareness that another entity paid on the reporting entity's behalf.

The Act limits how a designated Commonwealth body and later recipients may use or disclose information obtained through a ransomware payment report. Permitted purposes include helping respond to the incident, administering the reporting regime, government cyber-response functions, National Cyber Security Coordinator functions, ministerial advice, intelligence functions, and specified proceedings about false or misleading information or obstruction.

The protections are qualified. They do not stop use for enforcing Part 3 or laws that impose a penalty or sanction for a criminal offence, and they do not cover information to the extent a body obtained it through another route. Providing information in the report does not otherwise affect a legal professional privilege claim, subject to the statutory exceptions for coronial inquiries, Royal Commissions, and specified federal-court proceedings.

Section 32 also restricts admissibility of report information held by a Commonwealth or State body against the reporting business entity in listed proceedings, with exceptions. Treat these provisions as limits on specified use and admissibility, not as secrecy, immunity from the reporting duty, or a guarantee that the underlying facts cannot be obtained elsewhere.