Cyber Security Act 2024 Recordkeeping

For smart devices, manufacturers and suppliers must keep the statement of compliance for the five-year period set by the Rules. The statement must identify the product type and batch, the manufacturer, an authorised representative, and any other authorised representatives in Australia, as well as compliance declarations, the defined support period, signatory details, and the place and date of issue. Keeping the product evidence behind the statement is a practical way to support those declarations, but the cited Rules prescribe the five-year period for the statement rather than every supporting record.

For ransomware payment reporting, keep a report file that can show whether the entity was a reporting business entity, when the payment was made or discovered, what information was known or findable by reasonable search or enquiry within the 72-hour reporting period, and what was submitted to the designated Commonwealth body. The Act and ransomware reporting rules do not prescribe a retention period for that report file. Retaining it with the source evidence is an operational recommendation, subject to other applicable legal, security, privacy, and records-management requirements.

Build the ransomware record around the required report fields. The Act requires contact and business details for the reporting entity or another payer, the cyber security incident and its impact, the extortion demand, the ransomware payment, and communications with the extorting entity.

The 2025 ransomware reporting rules make those categories more concrete. They add an Australian Business Number (ABN), if any, and address details, incident occurrence and awareness timing, impact on infrastructure and customers, ransomware or malware variant, exploited vulnerabilities, information useful to government response, payment quantum and method, and the nature, timing, and description of communications or negotiations.

Keep the filed report and independently obtained incident evidence distinguishable. The Act's use, disclosure, and admissibility protections apply to information obtained through the statutory reporting path and contain exceptions; they do not prevent a body from using the same information to the extent it was obtained through another route.

Do not merge every Australian cyber record into the Cyber Security Act file. SOCI overlap arises where section 26 of the Cyber Security Act covers a responsible entity for a critical infrastructure asset to which Part 2B of the SOCI Act applies. APRA overlap applies only to an APRA-regulated entity subject to CPS 234. CPS 234 is a separate prudential standard, so its incident and material-control-weakness notification records do not become Cyber Security Act records merely because the same event is involved.

Keep the Cyber Security Act submission evidence separate from adjacent SOCI or APRA evidence. Record which entity was in scope, which asset or prudential entity was affected, which regulator or body was notified, and which facts satisfied each regime's required fields. Do not omit a required fact merely because the same incident was reported through another route.