Australia Cyber Security Act and SOCI Act overlap

The clearest statutory overlap is ransomware payment reporting. Cyber Security Act section 26 treats an entity as a reporting business entity if, when the ransomware payment is made, it is a responsible entity for a critical infrastructure asset to which SOCI Part 2B applies. SOCI status can therefore bring an impacted entity into Cyber Security Act ransomware reporting without the $3 million turnover test used for other businesses.

Keep the SOCI scope analysis separate from the Cyber Security Act event analysis. The SOCI record should show the asset, sector, responsible entity, whether Part 2B applies, the impact category, and the time the entity became aware. The Cyber Security Act record should show whether there is a cyber security incident, a demand, a ransomware payment or benefit, and the 72-hour reporting clock if a payment is made or discovered.

The overlap analysis should start with an asset register entry, not a generic cyber incident ticket. For SOCI purposes, the useful record identifies the asset, why it is treated as a critical infrastructure asset, the responsible entity, and whether the relevant SOCI Part applies to the asset.

For risk management program overlap, keep the Cyber Security Act incident evidence beside the SOCI all-hazards record but do not make them substitutes. Home Affairs guidance for the critical infrastructure risk management program describes material-risk work across cyber and information security, personnel, supply chain, and physical or natural hazards. A ransomware event may inform that program, but the Cyber Security Act ransomware report still needs its own payment, demand, and communication fields.

For a SOCI responsible entity, the ransomware question is not limited to annual turnover. Cyber Security Act section 26 includes responsible entities for critical infrastructure assets to which SOCI Part 2B applies. The Ransomware Payment Reporting Rules separately prescribe a $3 million threshold for other businesses, and section 26 requires turnover to exceed it. The current cyber.gov.au form says "equal to or exceeds $3 million," so an entity at exactly $3 million should confirm the filing position promptly. SOCI responsible-entity status should be checked first when a critical infrastructure asset is affected.

The report clock is triggered by the ransomware payment facts, not by completion of the broader incident investigation. The Cyber Security Act requires the report within 72 hours after the entity makes the payment or becomes aware that another entity made it on the reporting business entity's behalf. The rules require information only to the extent the reporting business entity knows it or can find it by reasonable search or enquiry within that period.

The Cyber Security Act smart-device regime is a product compliance track. Cyber Security Act Part 2 commenced on 29 November 2025. Part 2 and Schedule 1 of the Smart Devices Rules, which contain the consumer-grade standard and statement requirements, commenced on 4 March 2026. The Rules cover consumer grade relevant connectable products intended, or likely, to be used for personal, domestic, or household use or consumption when the manufacturer or supplier is aware, or could reasonably be expected to be aware, that a consumer will acquire the product in Australia. Listed exclusions include desktop and laptop computers, tablets, smartphones, therapeutic goods, road vehicles, and road vehicle components.

That product track can sit beside, but should not be blended with, SOCI obligations. A consumer energy product or connected device may need product-scope, security-standard, statement-of-compliance, support-period, and security-issue-reporting evidence. A critical-infrastructure operator may separately need SOCI asset, responsible-entity, incident-reporting, and risk-management evidence. The same incident can touch both tracks, but each track needs its own source, owner, trigger, and record.

Keep a two-column evidence file: one side for Cyber Security Act obligations and one side for SOCI Act obligations. Each row should show the source provision, factual trigger, accountable owner, evidence, report or action taken, and unresolved assumptions.

For a ransomware incident affecting a critical infrastructure asset, the record should be specific enough to prove why the entity was or was not a Cyber Security Act reporting business entity, whether SOCI Part 2B applied, whether a ransomware payment was made by the entity or on its behalf, and what information was known or reasonably searchable within the reporting period.