---
title: "Australia ransomware payment reporting 72-hour duty"
canonical_url: "https://www.sorena.io/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-72-hours"
source_url: "https://www.sorena.io/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-72-hours"
author: "Sorena AI"
description: "Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain."
published_at: "2026-05-09"
updated_at: "2026-07-24"
keywords:
  - "Cyber Security Act 2024 ransomware payment report"
  - "Australia ransomware payment reporting"
  - "72 hour ransomware report"
  - "Cyber Security Ransomware Payment Reporting Rules 2025"
  - "Cyber Security Act 2024"
  - "ransomware payment reporting"
  - "cyber extortion payment reporting"
  - "72-hour reporting"
  - "Australia"
---
**[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform

[Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io)

---

# Australia ransomware payment reporting 72-hour duty

Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain.

*Artifact Guide* *Australia* *72-hour payment report*

## Cyber Security Act 2024 Ransomware payment reporting within 72 hours

A reporting business entity must give a ransomware payment report within 72 hours of making the payment or becoming aware that the payment has been made.

This page explains the statutory trigger, reporting-business-entity scope, report contents, current filing route, and evidence to preserve. It does not replace case-specific legal, sanctions, insurer, or law-enforcement advice.

Australia's Cyber Security Act 2024 has imposed a 72-hour ransomware payment reporting duty on a reporting business entity since Part 3 commenced on 29 May 2025. The report must be given to the designated Commonwealth body, in the form approved by the Secretary if one exists and in any manner prescribed by the rules. The Australian Government provides the section 27 reporting form on cyber.gov.au.

## Definitions

### Reporting business entity

A reporting business entity is determined at the time the ransomware payment is made. It is either a qualifying entity carrying on a business in Australia whose annual turnover for the previous financial year exceeds the prescribed threshold, or a responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies. The first route excludes Commonwealth bodies, State bodies, and responsible entities for critical infrastructure assets. The Rules prescribe an ordinary threshold of $3 million and a pro-rata formula for a business operated for only part of the previous financial year.

**Why it matters here:** This status decides whether Part 3 imposes the 72-hour duty. Keep the entity, turnover, exclusion, or Part 2B evidence that applied when payment was made.

Sources:

- [Cyber Security Act 2024, section 26](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io)
- [Cyber Security (Ransomware Payment Reporting) Rules 2025, section 6](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io)

### Ransomware payment

A ransomware payment under Part 3 is a payment or benefit made to an extorting entity, directly related to its demand, where the demand seeks to benefit from a cyber security incident or its impact on the reporting business entity. It includes a payment made by the reporting business entity and one made by another entity on its behalf, and it can be monetary or non-monetary.

**Why it matters here:** The report clock is tied to the payment, not merely to incident discovery or the demand: it runs from direct payment or from awareness that another entity paid on the reporting entity's behalf.

Sources:

- [Cyber Security Act 2024, sections 26 and 27](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io)

### Designated Commonwealth body

The Act defines the designated Commonwealth body as a Commonwealth body specified by rules for the relevant provision. If no body is specified, it means the Department of Home Affairs and the Australian Signals Directorate. Section 27 requires the ransomware payment report to be given to the designated Commonwealth body.

**Why it matters here:** Use the current government form and live instructions to submit the report, and retain the transmission record showing when it was given.

Sources:

- [Cyber Security Act 2024, sections 8 and 27](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io)
- [Australian Government ransomware and cyber extortion payment reporting form](https://www.cyber.gov.au/report-and-recover/report/ransomware-payment-and-cyber-extortion-payment-reporting?ref=sorena.io)

## When does the 72-hour ransomware payment reporting duty trigger?

Part 3 applies only when the incident is a cyber security incident, the incident has had, is having, or could reasonably be expected to have a direct or indirect impact on a reporting business entity, an extorting entity makes a demand to benefit from the incident or its impact, and the reporting business entity provides or becomes aware that another entity has provided a payment or benefit on its behalf that is directly related to the demand.

For this Act, a cyber security incident must be an event covered by the Security of Critical Infrastructure Act meaning or an unauthorised impairment of electronic communications to or from a computer, including mere interception for this purpose, and it must have one of the constitutional connections in section 9(2). For incidents outside the critical-infrastructure-asset and constitutional-corporation limbs, section 26 presumes the event is a cyber security incident if it was probably internet-enabled, probably impaired a computer's connection, or probably seriously prejudiced specified Australian interests. The presumption cannot make an entity liable to the Part 3 civil penalty when the relevant condition did not exist in fact.

Document the trigger analysis before classifying a ransom negotiation as reportable. Capture the incident facts, the demand, the payment or benefit, who paid, whether the payment was on behalf of the reporting business entity, and how the incident connects to that entity.

- Confirm that the event is a cyber security incident for the Act, not only a fraud, commercial dispute, or unverified threat.
- Record the direct or indirect impact on the reporting business entity, including whether the incident is occurring, has occurred, or is imminent.
- Preserve the extortion demand and show how the payment or benefit is directly related to that demand.
- If a third party paid, record when the reporting business entity became aware of that payment and why it was made on its behalf.

Sources for this answer:

- [Cyber Security Act 2024 (Cth), sections 26 and 27](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Sections 9, 26, and 27 define the cyber-security-incident test and limited presumption, the Part 3 payment trigger, the meaning of ransomware payment for this duty, and the 72-hour reporting obligation.
- [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Explains the reporting obligation and says the report must include information about the cyber security incident, demand, and payment.

## Which entities are in scope, and when does the 72-hour clock start?

The duty applies to a reporting business entity at the time the ransomware payment is made. One route covers an entity carrying on a business in Australia whose annual turnover for the previous financial year exceeds the threshold, provided it is not a Commonwealth body, State body, or responsible entity for a critical infrastructure asset. The other covers a responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies.

The 2025 Rules set the ordinary turnover threshold at $3 million for the previous financial year and include a pro-rata formula where the business operated for only part of that year. The Act says turnover must exceed the threshold. The Rules' Explanatory Statement describes $3 million or more as captured, and the current cyber.gov.au form labels its turnover option "equal to or exceeds $3 million." Those non-binding descriptions do not match section 26. An entity at exactly $3 million should promptly confirm the filing position rather than treating either description as a change to the Act.

Once the scoped entity makes the payment, or becomes aware that the payment has been made, the report is due within 72 hours, whichever clock-start is applicable.

- Keep the turnover calculation or critical-infrastructure status used to decide whether the entity is a reporting business entity.
- Record the exact time the reporting business entity made the payment, if it paid directly.
- If another entity paid, record the exact time the reporting business entity became aware that the ransomware payment had been made.
- Track the 72-hour deadline from the applicable payment or awareness timestamp, not from discovery of the incident unless that is also when the payment awareness occurred.

Sources for this answer:

- [Cyber Security Act 2024 (Cth), sections 26 and 27](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Sets reporting-business-entity scope and starts the 72-hour clock when the payment is made or payment awareness occurs.
- [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Sets the $3 million turnover threshold and part-year formula for the reporting-business-entity threshold.
- [Australian Government ransomware and cyber extortion payment reporting form](https://www.cyber.gov.au/report-and-recover/report/ransomware-payment-and-cyber-extortion-payment-reporting?ref=sorena.io) - The live form currently says "equal to or exceeds $3 million," while section 26 of the Act uses "exceeds."
- [Explanatory Statement to the Ransomware Payment Reporting Rules 2025](https://www.legislation.gov.au/F2025L00278/asmade/2025-03-03/es/original/pdf?ref=sorena.io) - The non-binding Explanatory Statement describes $3 million or more as captured, which does not match the Act's requirement that turnover exceed the prescribed threshold.

## What must the ransomware payment report contain?

Section 27 requires the report to contain information the reporting business entity knows, or is able by reasonable search or enquiry to find out at the time of reporting, about the relevant entity details, the cyber security incident, the demand, the ransomware payment, and communications with the extorting entity.

The Rules prescribe details within those categories: ABN if any and address; incident and awareness timing; infrastructure and customer impacts; ransomware or malware variants and exploited vulnerabilities if any; information that could assist response, mitigation, or resolution; the amount or quantum and method demanded and provided; and the nature, timing, description, and pre-payment negotiation details of communications with the extorting entity. Section 27 also permits the entity to include other incident information.

- Entity details: reporting business entity contact and business details, or the paying entity's contact and business details if another entity paid.
- Incident details: when it occurred or is estimated to have occurred, awareness timing, infrastructure and customer impact, malware variant, exploited vulnerability, and useful response information.
- Demand and payment details: amount or quantum, non-monetary benefit description where relevant, and method of provision demanded and provided.
- Communication details: nature, timing, brief description of communications, and any pre-payment negotiations.

Sources for this answer:

- [Cyber Security Act 2024 (Cth), section 27](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Lists the statutory report categories: entity details, incident, demand, payment, and extorting-entity communications.
- [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Prescribes the detailed information fields required for report content under section 7 of the Rules.

## Where do you send the report and how is it filed?

The report must be given to the designated Commonwealth body. Under the Act's definition, if no rules specify another body, the designated bodies are the Department of Home Affairs and the Australian Signals Directorate. Section 27 requires the Secretary-approved form, if any, and any manner prescribed by the rules.

The Australian Government currently provides the Ransomware payment and cyber extortion payment reporting form on cyber.gov.au. The form allows a third party to submit on behalf of the reporting business entity and asks for both organisations' details where applicable. Confirm the live filing instructions at submission time and keep the completed report, confirmation page or transmission record, and submission timestamp.

- Recipient: the designated Commonwealth body under the Act.
- Form: use the current Australian Government ransomware and cyber extortion payment reporting form unless official instructions direct otherwise.
- Method: follow the live form instructions and any filing manner prescribed by the rules.
- Third-party filing: if an adviser, insurer, incident-response provider, or other entity submits the report, identify the reporting business entity and preserve evidence of the submitter's authority and the reporting entity's deadline calculation.
- Evidence: keep the final report, transmission record, and timestamp for the 72-hour deadline file.

Sources for this answer:

- [Cyber Security Act 2024 (Cth), section 27](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Requires the report to be given to the designated Commonwealth body within 72 hours, in a Secretary-approved form if one exists and in any manner prescribed by the rules.
- [Australian Government ransomware and cyber extortion payment reporting form](https://www.cyber.gov.au/report-and-recover/report/ransomware-payment-and-cyber-extortion-payment-reporting?ref=sorena.io) - Current official form for reports under section 27 and the practical submission fields.

## What evidence should teams preserve before and after submitting the report?

The report-content duty is limited to information the reporting business entity knows or can find out by reasonable search or enquiry within the 72-hour reporting period. The search log should show what was checked, who was asked, what was known at submission time, and which items remained genuinely unknown.

Failure to give a required report carries an express civil penalty of 60 penalty units. The report protections are qualified: the Act limits specified use, disclosure, and admissibility of report information and preserves privilege claims in most proceedings, but those protections do not cover the same information when a body obtains it independently or when it is already lawfully public. They also contain exceptions for enforcement of Part 3, specified criminal-law matters, coronial inquiries, Royal Commissions, and certain federal-court proceedings.

Keep the report itself, the deadline calculation, the scope assessment, the demand and payment evidence, communication records, malware or vulnerability findings, customer and infrastructure impact notes, approval records, and any follow-up corrections or incident-response actions. Separate the ransomware payment report from other SOCI, privacy, law-enforcement, insurer, or contractual notifications so each obligation has its own trigger and evidence trail.

- Trigger evidence: incident chronology, demand record, payment approval, payer identity, and relationship between the payment and the demand.
- Scope evidence: Australian business status, turnover threshold analysis or Part 2B critical-infrastructure status, and exclusions considered.
- Clock evidence: payment timestamp, awareness timestamp for third-party payment, 72-hour deadline, reviewer sign-off, and submission time.
- Reasonable-search evidence: teams contacted, systems checked, unavailable facts, and the basis for any unknown malware, vulnerability, impact, or payment details.

Sources for this answer:

- [Cyber Security Act 2024 (Cth), sections 27 to 32](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Supports the 60-penalty-unit consequence and the evidence trail for the clock, report content, permitted use and disclosure, legal professional privilege, and qualified admissibility protections.
- [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Confirms that required information is limited to what the entity knows or can find out within the 72-hour period.

*Recommended next step*

*Placement: after the practical guidance*

## Turn the 72-hour ransomware payment report into assigned incident work

Assign the trigger review, deadline calculation, report-field collection, and evidence preservation tasks in Sorena.

- [Open Assessment Autopilot for Australia Cyber Security Act](/solutions/assessment.md): Convert the ransomware payment reporting trigger, 72-hour clock, and report fields into assigned evidence tasks.
- [Review Australia Cyber Security Act source evidence](/solutions/research-copilot.md): Use Research Copilot to answer follow-up questions with cited source material.
- [Talk through implementation](/contact.md): Review scope, evidence, owners, and the next compliance actions with Sorena.

## Primary sources

- [Cyber Security Act 2024 (Cth), Part 3](https://www.legislation.gov.au/C2024A00098/latest/text?ref=sorena.io) - Primary legislation for the cyber-security-incident test, ransomware payment reporting trigger, scoped reporting entities, 72-hour clock, report categories, civil penalty, and qualified information protections.
  - Quote: "within 72 hours of making the ransomware payment"
- [Cyber Security (Ransomware Payment Reporting) Rules 2025](https://www.legislation.gov.au/F2025L00278/latest/text?ref=sorena.io) - Rules setting the $3 million turnover threshold and prescribing detailed report-content fields for the Cyber Security Act 2024 ransomware payment report.
  - Quote: "the amount of turnover threshold for a business for the previous financial year is $3 million"
- [Australian Government ransomware and cyber extortion payment reporting form](https://www.cyber.gov.au/report-and-recover/report/ransomware-payment-and-cyber-extortion-payment-reporting?ref=sorena.io) - Current official filing route and report field sequence.
  - Quote: "You are only required to disclose information you know, or by reasonable search or enquiry, are able to find out."
- [Explanatory Statement to the Ransomware Payment Reporting Rules 2025](https://www.legislation.gov.au/F2025L00278/asmade/2025-03-03/es/original/pdf?ref=sorena.io) - Non-binding explanatory material that describes $3 million or more as captured, in tension with section 26's "exceeds" wording.

## Related Topic Guides

- [Australia Compliance Statement Evidence Workflow](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence-workflow.md): Evidence workflow for preparing, supplying, and retaining statements of compliance under Australia's Cyber Security Act 2024 and Smart Devices Rules.
- [Australia Cyber Security Act 2024 scope and definitions](/artifacts/apac/australia-cyber-security-act/scope-and-definitions.md): Official source scope guide for Australia's Cyber Security Act 2024: relevant connectable products, consumer-grade smart devices, reporting business entities, ransomware payment reports, and SOCI overlap.
- [Australia Cyber Security Act and SOCI Act overlap](/artifacts/apac/australia-cyber-security-act/security-of-critical-infrastructure-act-overlap.md): How the Australia Cyber Security Act overlaps with the Security of Critical Infrastructure Act for responsible entities, ransomware payment reporting, smart devices, and evidence records.
- [Australia Cyber Security Act Applicability Test](/artifacts/apac/australia-cyber-security-act/applicability-test.md): Decide whether the Australia Cyber Security Act 2024 applies to a smart-device product, supplier, manufacturer, or ransomware payment reporting scenario.
- [Australia Cyber Security Act Commencement Timeline](/artifacts/apac/australia-cyber-security-act/timeline-and-commencement.md): Cyber Security Act 2024 commencement timeline for ransomware reporting, CIRB reviews, smart-device duties, statement retention, and statutory review.
- [Australia Cyber Security Act Compliance Checklist](/artifacts/apac/australia-cyber-security-act/checklist.md): Concrete checklist items for Australian Cyber Security Act smart-device and ransomware duties, with SOCI and APRA CPS 234 evidence checks.
- [Australia Cyber Security Act Compliance Guide](/artifacts/apac/australia-cyber-security-act/compliance.md): A cited compliance guide for Australia Cyber Security Act smart-device statements, ransomware payment reporting, incident coordination, and review-board readiness.
- [Australia Cyber Security Act Deadlines and Calendar](/artifacts/apac/australia-cyber-security-act/deadlines-and-compliance-calendar.md): Cyber Security Act 2024 dates and event-driven deadlines for ransomware payment reports, smart-device duties, records, notices, and statutory review.
- [Australia Cyber Security Act FAQ](/artifacts/apac/australia-cyber-security-act/faq.md): Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review.
- [Australia Cyber Security Act penalties and fines](/artifacts/apac/australia-cyber-security-act/penalties-and-fines.md): Cyber Security Act 2024 civil penalties explained by section, including ransomware reports, protected information, CIRB notices, and smart-device enforcement.
- [Australia Cyber Security Act recordkeeping FAQ](/artifacts/apac/australia-cyber-security-act/faq/recordkeeping.md): What records to keep for Cyber Security Act 2024 smart-device statements, ransomware payment reports, and supported SOCI or APRA overlap checks.
- [Australia Cyber Security Act Requirements](/artifacts/apac/australia-cyber-security-act/requirements.md): Australia Cyber Security Act requirements for smart-device security standards, statements of compliance, ransomware payment reports, notices, and evidence records.
- [Australia Cyber Security Act Statement of Compliance Evidence](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-evidence.md): Evidence guide for Australia Cyber Security Act smart-device statements of compliance: required fields, manufacturer and supplier records, five-year retention, and examination readiness.
- [Australia Cyber Security Act templates](/artifacts/apac/australia-cyber-security-act/templates.md): Source-backed field lists for Australia Cyber Security Act smart-device scope, statements of compliance, ransomware reports, notices, SOCI overlap, and records.
- [Australia Cyber Security Act vs EU Cyber Resilience Act](/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-eu-cyber-resilience-act.md): Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes.
- [Australia Cyber Security Act vs UK PSTI Act Guide](/artifacts/apac/australia-cyber-security-act/australia-cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime.
- [Australia Ransomware Payment Reporting Workflow](/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-workflow.md): Operational workflow for Australia Cyber Security Act 2024 ransomware payment reports: scope, 72-hour trigger, report fields, owners, evidence, and cited Act and Rules sources.
- [Australia Ransomware Payment Reporting: Threshold and Report Content](/artifacts/apac/australia-cyber-security-act/faq/ransomware-payment-threshold-and-report-content.md): FAQ answer on Australia's Cyber Security Act ransomware payment reporting scope, $3 million turnover threshold, 72-hour trigger, report fields, and evidence.
- [Australia Smart Device Applicability Workflow](/artifacts/apac/australia-cyber-security-act/smart-device-applicability-workflow.md): Decide whether Australia's mandatory smart-device security standard applies, including commencement, connectivity, consumer use, exclusions, roles, and evidence.
- [Australia Smart Device Compliance Statement](/artifacts/apac/australia-cyber-security-act/statement-of-compliance-and-recordkeeping.md): What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Devices Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination.
- [Australia Smart Device Security Standards under the Cyber Security Act](/artifacts/apac/australia-cyber-security-act/smart-device-security-standards.md): Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records.
- [CSA 2024 Smart Device Applicability Test](/artifacts/apac/australia-cyber-security-act/smart-device-applicability-and-product-scope.md): Check whether a smart device is a consumer-grade relevant connectable product under Australia's Cyber Security Act and Smart Devices Rules.
- [Cyber Security Act 2024 Smart Device Compliance Checklist](/artifacts/apac/australia-cyber-security-act/smart-device-compliance-checklist.md): Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence.
- [Cyber Security Act 2024 Statements of Compliance FAQ](/artifacts/apac/australia-cyber-security-act/faq/statements-of-compliance.md): Australian smart-device statements of compliance: covered products, responsible actors, required contents, supporting evidence, and five-year retention.
- [Cyber Security Act vs EU CRA: scope and obligations comparison](/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-eu-cyber-resilience-act.md): Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes.
- [Cyber Security Act vs UK PSTI Act: device security obligations compared](/artifacts/apac/australia-cyber-security-act/cyber-security-act-vs-uk-psti-act.md): Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime.
- [How do notices and recalls work under the Australia Cyber Security Act?](/artifacts/apac/australia-cyber-security-act/faq/notices-and-recalls.md): FAQ on Australia Cyber Security Act compliance notices, stop notices, recall notices, public notifications, owners, evidence fields, and cited timing.
- [How does the Australia Cyber Security Act overlap with the SOCI Act?](/artifacts/apac/australia-cyber-security-act/faq/security-of-critical-infrastructure-act-overlap.md): FAQ on when Australia Cyber Security Act ransomware reporting overlaps with SOCI critical infrastructure assets, responsible entities, and smart-device duties.
- [Manufacturer, Importer, and Supplier Duties under Australia's Cyber Security Act 2024](/artifacts/apac/australia-cyber-security-act/faq/manufacturer-and-importer-obligations.md): Cyber Security Act 2024 smart-device duties for manufacturers, importers, and suppliers, including role tests, scope, statements, and records.
- [SOCI overlap triage workflow for Australia Cyber Security Act](/artifacts/apac/australia-cyber-security-act/soci-overlap-triage-workflow.md): Triage SOCI Act overlap with Australia Cyber Security Act ransomware reporting and smart-device standards using separate owners, evidence, and cited scope checks.
- [Which smart devices are in scope under Australia's Cyber Security Act 2024?](/artifacts/apac/australia-cyber-security-act/faq/smart-device-scope.md): FAQ on Cyber Security Act 2024 smart-device scope: relevant connectable products, consumer-grade criteria, exclusions, Australian consumer acquisition, and records to keep.


---

[Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md)

(c) 2026 Sorena AB (559573-7338). All rights reserved.

Source: https://www.sorena.io/artifacts/apac/australia-cyber-security-act/ransomware-payment-reporting-72-hours.md