We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQAustraliaSOCI Act overlap

Australia Cyber Security Act SOCI Act overlap FAQ

The Cyber Security Act uses SOCI Act concepts for critical infrastructure assets and responsible entities. A enters the ransomware reporting regime only when applies to its asset.

SOCI incident notification, Cyber Security Act ransomware payment reporting, and smart-device compliance are separate checks with different triggers and clocks.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
3 sections3 primary sources
Overview

An Australian incident or payment can trigger the Cyber Security Act ransomware regime, the SOCI Act critical-infrastructure incident regime, both, or neither. The separate smart-device product regime depends on product manufacture and supply facts rather than incident or payment status.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

How does the Australia Cyber Security Act overlap with the Security of Critical Infrastructure Act?

The Cyber Security Act does not supersede the Security of Critical Infrastructure Act 2018 (SOCI Act). It imports SOCI concepts for a and a , and its ransomware payment reporting regime expressly covers a responsible entity for a critical infrastructure asset to which SOCI Act applies.

The same event can therefore require a Cyber Security Act ransomware payment report and a SOCI Act cyber security incident report. The triggers differ: the Cyber Security Act report follows a payment or benefit tied to an extortion demand, while SOCI reporting turns on the incident's impact on a covered asset. One report does not replace the other. For SOCI, a on availability uses the test in section 30BEA; other reportable incidents use the broader concept, which includes availability, integrity, reliability, and specified confidentiality impacts.

For the 12-hour critical-incident branch, section 30BC requires awareness that an incident has occurred or is occurring and has had or is having a significant direct or indirect impact on the asset's availability. Section 30BEA defines that : the asset is used to provide essential goods or services and the incident has materially disrupted their availability, or circumstances specified in rules under that section exist. Record the affected essential goods or services, the actual disruption, and any applicable rule; a general severity label does not apply this test.

For the 72-hour other-incident branch, section 30BD also covers an imminent incident and a likely . Section 8G(2) includes direct or indirect impacts on the asset's availability, integrity or reliability, or on the confidentiality of information about the asset, information stored in it, or computer data where the asset is computer data. An incident can therefore require notification without meeting the material-disruption test for the critical branch.

  • Confirm whether the affected system is a under SOCI Act materials.
  • Identify whether the organisation is the for that asset.
  • If a ransomware payment was made by, or on behalf of, that entity, assess the Cyber Security Act ransomware report obligation alongside SOCI incident notification.
  • Ransomware payment clock: give the report within 72 hours of payment or awareness of a payment made on the entity's behalf.
  • SOCI incident clocks: report as soon as practicable and within 12 hours of awareness for a critical incident, or within 72 hours for another reportable incident.
  • Written follow-up after an oral SOCI report: provide the approved-form record within 84 hours after an oral critical-incident report or 48 hours after another oral reportable-incident report, unless a written-record exemption is given under the SOCI Act.
  • Keep the impact decision with the reporting clock: asset and scope, affected service or information, observed or likely impact, facts supporting the section 30BEA or 8G test, awareness time, decision owner, notification deadline and submission receipt. Reassess the branch if disruption or the available facts change.
Question 2

What should be separated from SOCI overlap?

Keep the smart-device product regime outside the SOCI overlap analysis. Cyber Security Act Part 2 applies to relevant connectable products and product supply obligations. The SOCI overlap concerns critical infrastructure assets, responsible entities, SOCI incident notification, and Cyber Security Act ransomware payment reporting.

A manufacturer or supplier may have smart-device duties for a relevant connectable product even when it is not the for a SOCI asset. Conversely, a SOCI responsible entity can have ransomware reporting exposure even when the incident is not about placing a smart device on the Australian market.

  • Smart-device check: relevant connectable product, manufacture or supply in Australia, security standard, and statement of compliance.
  • SOCI overlap check: , , whether SOCI applies, incident impact, awareness time, and the applicable 12-hour or 72-hour clock.
  • Ransomware check: cyber security incident, extortion demand, payment or benefit, status, and report content.
Question 3

What evidence should support the SOCI overlap answer?

Keep a short overlap record covering the asset, entity, incident, and payment analysis. Record which asset was affected, why SOCI did or did not apply, who the was, whether a ransomware payment was made, when each reporting clock started, and which report fields could be completed within each window.

If the same event also touches a connected product, keep that product compliance file separate so SOCI incident triage is not confused with smart-device security-standard evidence.

  • Asset and role evidence: SOCI asset classification, responsible-entity reasoning, and any application-rule note used.
  • Incident evidence: incident timing, awareness time, impact on the entity and asset, critical-or-other incident classification, oral or written submission method, and information available when each report was made.
  • Oral-report follow-up: retain the oral-report time, the 84-hour critical-incident or 48-hour other-incident written-follow-up deadline, the written submission, or any written-record exemption.
  • Payment evidence: demand, amount or non-monetary benefit, method of provision, communications, and whether another entity paid on the 's behalf.
Recommended next step

Turn Australia Cyber Security Act and SOCI overlap into assigned work

Separate SOCI asset status, responsible-entity status, ransomware reporting, and smart-device compliance into evidence requests and owner tasks.

Assessment workflow
Open Assessment Autopilot for Australia Cyber Security Act

Turn SOCI overlap into scoped asset, entity, incident, payment, and product questions.

Explore next step
Research workflow
Review Australia Cyber Security Act source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

Cyber Security Act 2024
legislation.gov.au4 citations
Referenced sections
  • Primary legislation for smart-device duties, ransomware payment reporting, SOCI-linked definitions, and the responsible-entity reporting-business-entity test.
  • Defines critical infrastructure asset and responsible entity by reference to the SOCI Act and sets when responsible entities for Part 2B assets are reporting business entities.
  • Separates Part 2 smart-device obligations from Part 3 ransomware payment reporting, cross-references SOCI concepts, and lists the ransomware report-content categories.
Show 1 more
  • Primary legislation for the ransomware payment trigger, reporting-business-entity test, 72-hour deadline, and report-content categories.
"within 72 hours of making the ransomware payment"
Security of Critical Infrastructure (Application) Rules 2022
legislation.gov.au3 citations
Referenced sections
  • Application Rules source for documenting whether SOCI Act Part 2B applies before treating the entity as inside the critical-infrastructure ransomware overlap.
  • Application Rules source for checking whether SOCI Act Part 2 or Part 2B applies before treating the organisation as in the critical-infrastructure overlap path.
  • Application Rules source for documenting whether the SOCI Part 2B overlap assumption was checked against the relevant application rule.
"Application of Part 2B of the Act"
Security of Critical Infrastructure Act 2018
legislation.gov.au3 citations
Referenced sections
  • Primary SOCI source for asset and responsible-entity definitions, Part 2B application, and the 12-hour and 72-hour incident-notification duties.
  • Sections 8G(2), 30BB to 30BD and 30BEA support relevant-impact categories, Part 2B application, the significant-impact test, 12/72-hour incident notifications, 84/48-hour written follow-up after oral reports, and written-record exemptions.
  • Primary SOCI source for keeping critical infrastructure asset and responsible entity analysis separate from product-supply smart-device duties.
"Meaning of responsible entity"

Related guides

Australia Cyber Security Act recordkeeping FAQ

What records to keep for Cyber Security Act 2024 smart-device statements, ransomware payment reports, and supported SOCI or APRA overlap checks.

Australia Ransomware Payment Reporting: Threshold and Report Content

FAQ answer on Australia's Cyber Security Act ransomware payment reporting scope, $3 million turnover threshold, 72-hour trigger, report fields, and evidence.

Cyber Security Act 2024 Statements of Compliance FAQ

Australian smart-device statements of compliance: covered products, responsible actors, required contents, supporting evidence, and five-year retention.

How do notices and recalls work under the Australia Cyber Security Act?

FAQ on Australia Cyber Security Act compliance notices, stop notices, recall notices, public notifications, owners, evidence fields, and cited timing.

Manufacturer, Importer, and Supplier Duties under Australia's Cyber Security Act 2024

Cyber Security Act 2024 smart-device duties for manufacturers, importers, and suppliers, including role tests, scope, statements, and records.

Which smart devices are in scope under Australia's Cyber Security Act 2024?

FAQ on Cyber Security Act 2024 smart-device scope: relevant connectable products, consumer-grade criteria, exclusions, Australian consumer acquisition, and records to keep.

Show all related guides (29)

Australia Compliance Statement Evidence Workflow

Evidence workflow for preparing, supplying, and retaining statements of compliance under Australia's Cyber Security Act 2024 and Smart Devices Rules.

Australia Cyber Security Act 2024 scope and definitions

Scope guide for Australia's Cyber Security Act 2024: relevant connectable products, consumer-grade smart devices, reporting business entities, ransomware payment reports, and SOCI overlap.

Australia Cyber Security Act and SOCI Act overlap

How the Australia Cyber Security Act overlaps with the Security of Critical Infrastructure Act for responsible entities, ransomware payment reporting, smart devices, and evidence records.

Australia Cyber Security Act Applicability Test

Decide whether the Australia Cyber Security Act 2024 applies to a smart-device product, supplier, manufacturer, or ransomware payment reporting scenario.

Australia Cyber Security Act Commencement Timeline

Cyber Security Act 2024 commencement timeline for ransomware reporting, CIRB reviews, smart-device duties, statement retention, and statutory review.

Australia Cyber Security Act Compliance Checklist

Concrete checklist items for Australian Cyber Security Act smart-device and ransomware duties, with SOCI and APRA CPS 234 evidence checks.

Australia Cyber Security Act Compliance Guide

A cited compliance guide for Australia Cyber Security Act smart-device statements, ransomware payment reporting, incident coordination, and review-board readiness.

Australia Cyber Security Act Deadlines and Calendar

Cyber Security Act 2024 dates and event-driven deadlines for ransomware payment reports, smart-device duties, records, notices, and statutory review.

Australia Cyber Security Act FAQ

Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review.

Australia Cyber Security Act penalties and fines

Cyber Security Act 2024 civil penalties explained by section, including ransomware reports, protected information, CIRB notices, and smart-device enforcement.

Australia Cyber Security Act Requirements

Australia Cyber Security Act requirements for smart-device security standards, statements of compliance, ransomware payment reports, notices, and evidence records.

Australia Cyber Security Act Statement of Compliance Evidence

Evidence guide for Australia Cyber Security Act smart-device statements of compliance: required fields, manufacturer and supplier records, five-year retention, and examination readiness.

Australia Cyber Security Act templates

Source-backed field lists for Australia Cyber Security Act smart-device scope, statements of compliance, ransomware reports, notices, SOCI overlap, and records.

Australia Cyber Security Act vs EU Cyber Resilience Act

Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes.

Australia Cyber Security Act vs UK PSTI Act Guide

Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime.

Australia ransomware payment reporting 72-hour duty

Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain.

Australia Ransomware Payment Reporting Workflow

Operational workflow for Australia Cyber Security Act 2024 ransomware payment reports: scope, 72-hour trigger, report fields, owners, evidence, and cited Act and Rules sources.

Australia Smart Device Applicability Workflow

Decide whether Australia's mandatory smart-device security standard applies, including commencement, connectivity, consumer use, exclusions, roles, and evidence.

Australia Smart Device Compliance Statement

What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Devices Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination.

Australia Smart Device Security Standards under the Cyber Security Act

Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records.

CSA 2024 Smart Device Applicability Test

Check whether a smart device is a consumer-grade relevant connectable product under Australia's Cyber Security Act and Smart Devices Rules.

Cyber Security Act 2024 Smart Device Compliance Checklist

Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence.

SOCI overlap triage workflow for Australia Cyber Security Act

Triage SOCI Act overlap with Australia Cyber Security Act ransomware reporting and smart-device standards using separate owners, evidence, and cited scope checks.