Cyber Security Act 2024 Recordkeeping

For smart devices, keep the statement of compliance and the product evidence behind it for the rule-backed retention period. The Security Standards for Smart Devices Rules say the statement must identify the product type and batch, manufacturer and Australian authorised representatives, compliance declarations, defined support period, signatory details, and place and date of issue; the same rules set a five-year retention period for those statements.

For ransomware payment reporting, keep a report file that can show whether the entity was a reporting business entity, when the payment was made or discovered, what information was known or findable by reasonable search within the 72-hour reporting period, and what was submitted to the designated Commonwealth body. The Act and ransomware reporting rules do not set a separate retention period for that report file, so retain it with the source evidence used to prepare the report for internal compliance and follow-up checks.

The ransomware record should be built around the report fields, not around a generic incident summary. The Act requires the report to cover contact and business details for the reporting entity or another payer, the cyber security incident and its impact, the extortion demand, the ransomware payment, and communications with the extorting entity.

The 2025 ransomware reporting rules make those categories more concrete. They add ABN and address details where available, incident occurrence and awareness timing, impact on infrastructure and customers, ransomware or malware variant, exploited vulnerabilities, information useful to government response, payment quantum and method, and the nature, timing, and description of communications or negotiations.

Do not merge every Australian cyber record into the Cyber Security Act file. SOCI overlap is supported where the ransomware rules refer to responsible entities for critical infrastructure assets to which Part 2B of the SOCI Act applies. APRA overlap is supported only for APRA-regulated entities, because CPS 234 separately requires notification to APRA for material information security incidents and material control weaknesses.

A clean record separates the Cyber Security Act submission evidence from adjacent SOCI or APRA evidence: which entity was in scope, which asset or prudential entity was affected, which regulator or body was notified, what facts were reused, and which facts were held back because the regimes have different purposes.