Artifact GuideAustraliaTemplates

Australia Cyber Security Act Templates

Build implementation templates around the fields that change the answer: connectable-product scope, manufacturer and supplier duties, statement of compliance evidence, ransomware report content, notice response, and SOCI overlap.

This page translates official Act and Rules requirements into record structures for product, security, legal, compliance, and incident-response teams. This guidance is practical, source-linked, and should be validated against current legal and policy requirements before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

Use these templates as field lists for Australia Cyber Security Act implementation records. Each template is grounded in the Cyber Security Act 2024, the Smart Devices Rules, the Ransomware Payment Reporting Rules, and SOCI sources where critical-infrastructure overlap matters.

Section 1

Smart-device scope intake template

The scope intake should decide whether the product is a relevant connectable product and whether the consumer-grade smart-device security standard applies. Keep enough product evidence to show the route into or out of scope, not just a yes-or-no answer.

Product identifiers: product name, model, version, product type, batch identifier, intended purpose, launch or supply channel, and whether the product is manufactured or supplied in Australia.
Connectivity facts: whether the product connects to the internet using an internet protocol, connects to an internet-connectable product, or connects to two or more products and an internet-connectable product by non-internet-protocol communication.
Consumer-grade test: intended personal, domestic, or household use; whether acquisition in Australia by a consumer is expected; and evidence from labels, instructions, promotional material, or sales material.
Exclusion check: desktop computer or laptop, tablet computer, smartphone, therapeutic good, road vehicle, or road vehicle component.
Security-standard evidence fields: password design, security-issue reporting contact, acknowledgement and status-update process, defined support period, and security-update publication location.

Sources for this answer

Cyber Security Act 2024

Supports the relevant connectable product, internet-connectable product, network-connectable product, manufacturer, supplier, and notice provisions used in the scope intake.

Cyber Security (Security Standards for Smart Devices) Rules 2025

Supports the consumer-grade product class, listed exclusions, password, security-issue reporting, support-period, and security-update fields.

Section 2

Statement of compliance and evidence-pack template

The statement template should mirror the Rules and keep a linked evidence pack that a manufacturer, supplier, reviewer, or regulator can test against the security standard.

Statement fields: product type and batch identifier; manufacturer name and address; authorised representative name and address; Australian authorised representatives, if any; and the declaration that the statement was prepared by or on behalf of the manufacturer.
Compliance declaration fields: manufacturer opinion that the product was manufactured in compliance with the security standard and that other product obligations in the standard have been met.
Support-period fields: defined support period at the date of issue, published support-period URL or document location, security-update coverage for hardware and software, and owner for updating public support information.
Sign-off fields: signatory signature, name, function, place of issue, date of issue, reviewer, supplier handoff owner, and evidence-pack location.
Retention fields: statement copy owner, retention start date, retention end date, product or batch link, supplier copy location, and evidence that the statement is kept for the 5-year Rules period.

Sources for this answer

Cyber Security Act 2024

Supports the manufacturer and supplier obligation to provide or supply a statement of compliance and retain a copy for the period specified in the Rules.

Cyber Security (Security Standards for Smart Devices) Rules 2025

Supports the required statement fields and the 5-year retention period for statements of compliance.

Section 3

Ransomware payment report template

The ransomware report template should separate reportability, 72-hour timing, known facts, reasonable search status, and the actual report payload. It should also record whether SOCI Part 2B status creates a reporting-business-entity route.

Reportability fields: Australian business status, previous financial year turnover check, SOCI responsible-entity and Part 2B asset status, Commonwealth or State body exclusion check, incident impact on the entity, demand, payment or benefit, and whether another entity paid on the entity's behalf.
Timing fields: payment timestamp, timestamp when the entity became aware another entity paid, 72-hour deadline, designated Commonwealth body submission channel, submitter, approver, and late-risk escalation owner.
Business details fields: reporting entity legal name, ABN if any, address, contact person, and the same details for another paying entity if applicable.
Incident fields: when the incident occurred or is estimated to have occurred, when the reporting entity became aware, infrastructure impact, customer impact, ransomware or malware variants, exploited vulnerabilities, and information that could assist Commonwealth or State response, mitigation, or resolution.
Demand and payment fields: amount or quantum demanded, non-monetary benefit description where relevant, demanded method of provision, amount or quantum paid, payment method, communication timing, communication summary, and pre-payment negotiation summary.

Sources for this answer

Cyber Security Act 2024

Supports the 72-hour reporting obligation, reporting-business-entity test, ransomware payment report categories, and interaction with other reporting duties.

Cyber Security (Ransomware Payment Reporting) Rules 2025

Supports the $3 million turnover threshold and the detailed report fields for incident, demand, payment, and extorting-entity communications.

Section 4

Compliance, stop, recall, and public-notification template

Notice-response templates should be tied to the smart-device obligations in sections 15 and 16. Capture what the notice says, what action is within the entity's control, what evidence must be produced, and whether independent review is available.

Notice fields: notice type, issuing authority, entity name, product details, non-compliance or possible non-compliance summary, affected section 15 or section 16 obligation, date given, response owner, and evidence owner.
Action fields: required corrective action, required stop action or restraint, recall action, return pathway, consumer communication owner, specified period for action, and specified period for evidence if included in the notice.
Review fields: representation period before notice issue where applicable, internal-review deadline, review applicant, grounds for review, and outcome field for affirmed, varied, or revoked decisions.
Public-notification fields: entity identity, product details, non-compliance details, product risks, recall-notice details, and recommended consumer actions such as destroying the product or taking extra precautions when using it.
Evidence fields: product test material, statement of compliance, password evidence, published security-issue reporting process, support-period publication, consumer notice copy, supplier notification log, and remediation verification.

Sources for this answer

Cyber Security Act 2024

Supports compliance notice, stop notice, recall notice, public notification, independent review, and examination fields.

Cyber Security (Security Standards for Smart Devices) Rules 2025

Supports the additional public-notification matters for failure to comply with a recall notice, including recall notice details and recommended consumer actions.

Section 5

SOCI overlap and records template

The Cyber Security Act template set should include a SOCI overlap record because ransomware reporting can apply through responsible-entity status for a critical infrastructure asset to which SOCI Part 2B applies, and the Act preserves other Commonwealth information-reporting duties.

SOCI overlap fields: critical infrastructure asset name, sector, responsible entity, whether SOCI Part 2B applies, source used for application status, and responsible SOCI incident-reporting owner.
Ransomware overlap fields: whether the incident affects a SOCI responsible entity, whether the payment-reporting obligation is triggered through SOCI status or turnover status, and whether another Commonwealth reporting requirement also applies.
Risk-management-program fields: asset covered by a critical infrastructure risk management program, cyber and information security hazard owner, material-risk record, control record, program review owner, and annual-report owner where applicable.
Protected record controls: report version, privilege flag, permitted-use note, disclosure owner, Commonwealth or State body disclosure status, and internal access list for ransomware or incident-coordination material.
Record index: scope intake, statement of compliance, evidence pack, support-period publication proof, security-issue reporting publication proof, notice log, ransomware report, SOCI overlap assessment, and post-incident lessons record.

Sources for this answer

Cyber Security Act 2024

Supports the SOCI overlap fields by linking reporting-business-entity status to responsible entities for critical infrastructure assets to which SOCI Part 2B applies and by preserving other reporting requirements.

Security of Critical Infrastructure Act 2018

Supports the SOCI responsible-entity, critical-infrastructure-asset, Part 2B incident-notification, and risk-management-program overlap checks.

Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022

Supports the template field that checks whether Part 2B of the SOCI Act applies to the relevant critical infrastructure asset.

Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023

Supports risk-management-program fields for hazards, controls, review ownership, and records where a SOCI responsible entity also has Cyber Security Act work.

Recommended next step

Turn Australia Cyber Security Act templates into assigned work

Use this guide to convert smart-device, ransomware, notice, SOCI overlap, and recordkeeping fields into owners, evidence requests, and review tasks inside Sorena.

Assessment workflow

Open Assessment Autopilot for Australia Cyber Security Act templates

Turn template fields into scoped questions, evidence requests, and assigned reviews.

Explore next step

Research workflow

Review Australia Cyber Security Act source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step

Talk to Sorena

Talk through template implementation

Review scope, statement evidence, ransomware reporting records, and SOCI overlap with Sorena.

Explore next step

Primary sources

References and citations

Cyber Security (Ransomware Payment Reporting) Rules 2025

legislation.gov.au

Referenced sections

Supports the $3 million turnover threshold and the detailed report fields for incident, demand, payment, and extorting-entity communications.

"the amount of turnover threshold for a business for the previous financial year is $3 million"

Cyber Security (Security Standards for Smart Devices) Rules 2025

legislation.gov.au

Referenced sections

Supports the additional public-notification matters for failure to comply with a recall notice, including recall notice details and recommended consumer actions.

"actions consumers are recommended to consider taking"

Cyber Security Act 2024

legislation.gov.au

Referenced sections

Supports the SOCI overlap fields by linking reporting-business-entity status to responsible entities for critical infrastructure assets to which SOCI Part 2B applies and by preserving other reporting requirements.

"Information provided by an entity under this Part does not affect any other requirement of the entity to provide that information"

Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022

legislation.gov.au

Referenced sections

Supports the template field that checks whether Part 2B of the SOCI Act applies to the relevant critical infrastructure asset.

"Application of Part 2B of the Act"

Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023

legislation.gov.au

Referenced sections

Supports risk-management-program fields for hazards, controls, review ownership, and records where a SOCI responsible entity also has Cyber Security Act work.