We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideAustraliaTemplates

Australia Cyber Security Act Templates

Build implementation templates for connectable-product scope, manufacturer and supplier duties, evidence, ransomware report content, notice response, and SOCI overlap.

Keep product scope, statements, ransomware reports, SOCI overlap, and regulator responses in separate records, with the evidence needed to explain each decision.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
5 sections9 primary sources
Overview

Use these templates as field lists for Australia Cyber Security Act implementation records. Start the smart-device template by deciding whether an item is a . The Federal Register displays 29 May 2025 for Part 3 commencement, while Home Affairs guidance describes mandatory ransomware reporting as active from 30 May 2025. Use 29 May as the conservative readiness date and obtain case-specific confirmation before deciding whether an event on that boundary triggered reporting. The prescribed smart-device standard and statement requirements commenced on 4 March 2026. The templates are based on the Act, the two 2025 Rules, and SOCI sources where critical-infrastructure overlap matters. Adapt them to the facts and the live filing instructions.

Section 1

Smart-device scope intake template

Use the scope intake to decide whether the product is a and whether the consumer-grade smart-device security standard applies. The official explanatory statement gives smart TVs, smart watches, home assistants, baby monitors, and consumer energy resources as examples. These examples do not classify a product automatically; record the binding connectivity, intended-use, acquisition, awareness, date, and exclusion tests for the specific product. Keep enough product evidence to explain the scope result.

Apply the Act's product-cohort test separately from the Rules scope test. Part 2 applies when a was manufactured on or after 29 November 2025 or supplied in Australia, other than as second-hand goods, on or after that date. The prescribed consumer-grade standard and statement requirements did not become operative until 4 March 2026.

  • Product identifiers and dates: product name, model, version, product type, batch identifier, intended purpose, manufacture date, Australian supply date, whether the supply is second-hand, and launch or supply channel.
  • Connectivity facts: whether the product connects to the internet using an internet-protocol communication; connects directly to an internet-connectable product using an internet-protocol communication; or meets the Act's non-internet-protocol test by connecting directly to two or more products at the same time and directly to an internet-connectable product. Record the statutory exceptions for mere wires or cables and linked computer-input products where relevant.
  • Consumer-grade test: intended personal, domestic, or household use; whether acquisition in Australia by a consumer is expected; and evidence from labels, instructions, promotional material, or sales material.
  • Exclusion check: desktop computer or laptop, tablet computer, smartphone, therapeutic good, road vehicle, or road vehicle component.
  • Security-standard evidence fields: whether covered passwords are user-defined or unique per product; evidence that unique passwords avoid incremental counters, public information, insecure identifier derivation, and other guessable methods; the location of the published security-issue reporting contact and acknowledgement and status-update timing; the with an end date; security-update coverage; proof that the support period was not shortened; and, where the manufacturer offers the product on a website it controls, each page where the support period must appear with acquisition information or product characteristics.
Section 2

Statement of compliance and evidence-pack template

Mirror the Rules in the statement template and link an evidence pack that a manufacturer, supplier, reviewer, or regulator can test against the security standard.

The Rules prescribe the content of a but do not provide an official form or fixed wording. Keep the signed statement separate from the underlying technical evidence, and link both records to the covered product type and batch.

  • Statement fields: product type and batch identifier; manufacturer name and address; the name and address of an ; the name and address of each other authorised representative in Australia, if any; and the declaration that the statement was prepared by or on behalf of the manufacturer. Section 9 makes only the "other" Australian-representative list expressly conditional.
  • Compliance declaration fields: manufacturer opinion that the product was manufactured in compliance with the security standard and that other product obligations in the standard have been met.
  • Support-period fields: at the date of issue, published support-period URL or document location, security-update coverage for hardware and software, and owner for updating public support information.
  • Sign-off fields: signatory signature, name, function, place of issue, date of issue, reviewer, supplier handoff owner, and evidence-pack location.
  • Retention fields: manufacturer and supplier copy owners, documented basis for each retention start and end date, product or batch link, copy locations, and evidence that each statement is kept for the five-year Rules period. Section 10 specifies the period but not its starting event, so record the interpretation used and obtain advice where the date changes disposal timing.
Section 3

Ransomware payment report template

The ransomware report template should separate reportability, 72-hour timing, known facts, reasonable search status, and the actual report payload. It should also record whether status makes the organisation a . The Act says the turnover route requires annual turnover that exceeds the prescribed threshold, and the Rules set that threshold at $3 million. Turnover of exactly $3 million therefore does not satisfy the turnover limb, although the Part 2B limb may still apply. The current cyber.gov.au form instead says "equal to or exceeds $3 million," but that form label does not change the Act's "exceeds" test.

  • Reportability fields: Australian business status, whether previous-financial-year turnover exceeds $3 million, SOCI responsible-entity and Part 2B asset status, turnover-route exclusion checks for Commonwealth or State bodies and responsible entities for any critical infrastructure asset, incident impact on the entity, demand, payment or benefit, and whether another entity paid on the entity's behalf.
  • Timing and filing fields: payment timestamp, timestamp when the entity became aware another entity paid on its behalf, 72-hour deadline, cyber.gov.au reporting-form URL confirmed at submission time, submitter, approver, submission confirmation, and late-risk escalation owner.
  • Business details fields: reporting entity legal name, Australian Business Number (ABN) if any, address, contact person, and the same details for another paying entity if applicable.
  • Incident fields: when the incident occurred or is estimated to have occurred, when the reporting entity became aware, infrastructure impact, customer impact, ransomware or malware variants, exploited vulnerabilities, and information that could assist Commonwealth or State response, mitigation, or resolution.
  • Demand and payment fields: amount or quantum demanded, non-monetary benefit description where relevant, demanded method of provision, amount or quantum paid, payment method, communication timing, communication summary, and pre-payment negotiation summary.
  • Additional-information field: any other incident information the reporting entity chooses to include under subsection 27(3), kept distinct from the mandatory Act and Rules fields.
Section 4

Compliance, stop, recall, and public-notification template

Notice-response templates should be tied to the smart-device obligations in sections 15 and 16. Capture what the notice says, what action is within the entity's control, what evidence must be produced, and whether internal review is available.

Keep the notice stages distinct. A compliance notice can address non-compliance or possible non-compliance. A stop notice follows a compliance notice that was not complied with or did not adequately rectify the problem, and a recall notice follows an inadequate or unfulfilled stop notice. Before issuing any of the three notices, the Secretary must allow at least 10 days for representations.

  • Notice fields: notice type, issuing authority, entity name, product details, non-compliance or possible non-compliance summary, affected section 15 or section 16 obligation, date given, response owner, and evidence owner.
  • Action fields: required corrective action, required stop action or restraint, recall action, return pathway, consumer communication owner, specified period for action, and specified period for evidence if included in the notice.
  • Review fields: the pre-issue representation deadline of at least 10 days; the internal-review application deadline, which is 30 days after the notice was given; review applicant; grounds for review; decision-maker; 30-day decision deadline after receipt of the application; and outcome field for an affirmed, varied, or revoked decision.
  • Public-notification fields: entity identity, product details, non-compliance details, product risks, recall-notice details, and recommended consumer actions such as destroying the product or taking extra precautions when using it.
  • Evidence fields: product test material, , password evidence, published security-issue reporting process, support-period publication, consumer notice copy, supplier notification log, and remediation verification.
Section 5

SOCI overlap and records template

The Cyber Security Act template set should include a SOCI overlap record because ransomware reporting can apply through responsible-entity status for a critical infrastructure asset to which applies. Separately, section 44 preserves other Commonwealth information-reporting duties for information provided under Part 4.

  • SOCI overlap fields: critical infrastructure asset name, sector, responsible entity, whether applies, source used for application status, and responsible SOCI incident-reporting owner.
  • Ransomware overlap fields: whether the incident affects a SOCI responsible entity, whether the payment-reporting obligation is triggered through SOCI status or turnover status, and whether another Commonwealth reporting requirement also applies.
  • Risk-management-program fields: asset covered by a critical infrastructure risk management program, cyber and information security hazard owner, material-risk record, control record, program review owner, and annual-report owner where applicable.
  • Protected record controls: report version, privilege flag, permitted-use note, disclosure owner, Commonwealth or State body disclosure status, and internal access list for ransomware or incident-coordination material.
  • Record index: scope intake, , evidence pack, support-period publication proof, security-issue reporting publication proof, notice log, ransomware report, SOCI overlap assessment, and post-incident lessons record.
Recommended next step

Turn Australia Cyber Security Act templates into assigned work

Convert smart-device, ransomware, notice, SOCI overlap, and recordkeeping fields into owners, evidence requests, and review tasks in Sorena.

Assessment workflow
Open Assessment Autopilot for Australia Cyber Security Act templates

Turn template fields into scoped questions, evidence requests, and assigned reviews.

Explore next step
Research workflow
Review Australia Cyber Security Act source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through template implementation

Review scope, statement evidence, ransomware reporting records, and SOCI overlap with Sorena.

Explore next step
Primary sources

References and citations

Cyber Security Act 2024
legislation.gov.au6 citations
Referenced sections
  • Primary Act source for smart-device security standards, statements of compliance, notices, ransomware reporting, 72-hour timing, and SOCI overlap.
  • Supports Part 2 commencement and second-hand supply boundaries, the relevant connectable product tests, and manufacturer and supplier provisions.
  • Supports the manufacturer and supplier obligation to provide or supply a statement of compliance and retain a copy for the period specified in the Rules.
Show 3 more
  • Supports the 72-hour reporting obligation, reporting-business-entity test, and ransomware payment report categories.
  • Sections 17 to 23 support compliance, stop, and recall notice stages; the minimum 10-day representation period; public notification; internal review within 30 days; and examination fields.
  • Section 26 links reporting-business-entity status to responsible entities for critical infrastructure assets to which SOCI Part 2B applies. Section 44 separately preserves other Commonwealth reporting requirements for information provided under Part 4.
"Security standards for smart devices"
More quoted passages
"A relevant connectable product is a product that:"
"The entity must retain a copy of the statement of compliance for the period specified in the rules"
"within 72 hours of making the ransomware payment or becoming aware that the ransomware payment has been made"
"A compliance notice, a stop notice and a recall notice may be given for non-compliance with obligations in this Part"
"Information provided by an entity under this Part does not affect any other requirement of the entity to provide that information"
Cyber Security (Security Standards for Smart Devices) Rules 2025
legislation.gov.au4 citations
Referenced sections
  • Rules source for consumer-grade smart-device scope, statement of compliance fields, 5-year statement retention, password requirements, vulnerability-reporting publication, support periods, and recall-notice publication matters.
  • Supports the 4 March 2026 commencement, consumer-grade product class, six exclusions, password, security-issue reporting, support-period, and security-update fields.
  • Supports the required statement fields and the 5-year retention period for statements of compliance.
Show 1 more
  • Supports the additional public-notification matters for failure to comply with a recall notice, including recall notice details and recommended consumer actions.
"Requirements for statement of compliance"
More quoted passages
"Part 1 of Schedule 1 prescribes the security standard for the class of relevant connectable products"
"The statement must include the following information"
"actions consumers are recommended to consider taking"
Australian Government ransomware and cyber extortion payment reporting form
cyber.gov.au2 citations
Referenced sections
  • Current official submission form for mandatory reports under section 27.
  • Current official filing route and field sequence. The live form's "equal to or exceeds $3 million" label differs from, and does not alter, the Act's binding "exceeds" test.
"Ransomware payment and cyber extortion payment reporting"
More quoted passages
"equal to or exceeds $3 million"
Cyber Security (Ransomware Payment Reporting) Rules 2025
legislation.gov.au2 citations
Referenced sections
  • Rules source for the $3 million turnover threshold and detailed ransomware payment report content fields.
  • Supports the $3 million turnover threshold and the detailed report fields for incident, demand, payment, and extorting-entity communications.
"Requirements for information that ransomware payment report must contain"
More quoted passages
"the amount of turnover threshold for a business for the previous financial year is $3 million"
Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022
legislation.gov.au2 citations
Referenced sections
  • Application Rules source for checking whether SOCI Part 2B applies to a critical infrastructure asset in ransomware and incident-reporting overlap templates.
  • Supports the template field that checks whether Part 2B of the SOCI Act applies to the relevant critical infrastructure asset.
"Application of Part 2B of the Act"
Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023
legislation.gov.au2 citations
Referenced sections
  • Risk-management-program Rules source for SOCI overlap fields that track hazards, controls, program review, and program evidence.
  • Supports risk-management-program fields for hazards, controls, review ownership, and records where a SOCI responsible entity also has Cyber Security Act work.
"Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023"
More quoted passages
"critical infrastructure risk management program"
Security of Critical Infrastructure Act 2018
legislation.gov.au2 citations
Referenced sections
  • SOCI source for responsible-entity, critical-infrastructure-asset, Part 2B incident-notification, and risk-management-program overlap records.
  • Supports the SOCI responsible-entity, critical-infrastructure-asset, Part 2B incident-notification, and risk-management-program overlap checks.
"Security of Critical Infrastructure Act 2018"
More quoted passages
"Part 2B—Notification of cyber security incidents"

Related guides

Australia Compliance Statement Evidence Workflow

Evidence workflow for preparing, supplying, and retaining statements of compliance under Australia's Cyber Security Act 2024 and Smart Devices Rules.

Australia Cyber Security Act 2024 scope and definitions

Scope guide for Australia's Cyber Security Act 2024: relevant connectable products, consumer-grade smart devices, reporting business entities, ransomware payment reports, and SOCI overlap.

Australia Cyber Security Act and SOCI Act overlap

How the Australia Cyber Security Act overlaps with the Security of Critical Infrastructure Act for responsible entities, ransomware payment reporting, smart devices, and evidence records.

Australia Cyber Security Act Applicability Test

Decide whether the Australia Cyber Security Act 2024 applies to a smart-device product, supplier, manufacturer, or ransomware payment reporting scenario.

Australia Cyber Security Act Commencement Timeline

Cyber Security Act 2024 commencement timeline for ransomware reporting, CIRB reviews, smart-device duties, statement retention, and statutory review.

Australia Cyber Security Act Compliance Checklist

Concrete checklist items for Australian Cyber Security Act smart-device and ransomware duties, with SOCI and APRA CPS 234 evidence checks.

Show all related guides (29)

Australia Cyber Security Act Compliance Guide

A cited compliance guide for Australia Cyber Security Act smart-device statements, ransomware payment reporting, incident coordination, and review-board readiness.

Australia Cyber Security Act Deadlines and Calendar

Cyber Security Act 2024 dates and event-driven deadlines for ransomware payment reports, smart-device duties, records, notices, and statutory review.

Australia Cyber Security Act FAQ

Answers to Australia Cyber Security Act questions on smart device scope, statements of compliance, ransomware reports, enforcement notices, and incident review.

Australia Cyber Security Act penalties and fines

Cyber Security Act 2024 civil penalties explained by section, including ransomware reports, protected information, CIRB notices, and smart-device enforcement.

Australia Cyber Security Act Requirements

Australia Cyber Security Act requirements for smart-device security standards, statements of compliance, ransomware payment reports, notices, and evidence records.

Australia Cyber Security Act Statement of Compliance Evidence

Evidence guide for Australia Cyber Security Act smart-device statements of compliance: required fields, manufacturer and supplier records, five-year retention, and examination readiness.

Australia Cyber Security Act vs EU Cyber Resilience Act

Compare Australia's Cyber Security Act 2024 with the EU Cyber Resilience Act across smart-device duties, ransomware reporting, product-with-digital-elements scope, actors, records, and enforcement routes.

Australia Cyber Security Act vs UK PSTI Act Guide

Compare Australia's Cyber Security Act 2024 smart-device, ransomware, and SOCI-adjacent obligations with the UK's PSTI connected-product regime.

Australia ransomware payment reporting 72-hour duty

Explain when Australia's Cyber Security Act 2024 requires a ransomware payment report, when the 72-hour clock starts, and what information the report must contain.

Australia Ransomware Payment Reporting Workflow

Operational workflow for Australia Cyber Security Act 2024 ransomware payment reports: scope, 72-hour trigger, report fields, owners, evidence, and cited Act and Rules sources.

Australia Smart Device Applicability Workflow

Decide whether Australia's mandatory smart-device security standard applies, including commencement, connectivity, consumer use, exclusions, roles, and evidence.

Australia Smart Device Compliance Statement

What a smart-device statement of compliance must contain under Australia's Cyber Security Act 2024 and Smart Devices Rules, who prepares and supplies it, how long to retain it, and how to prepare for examination.

Australia Smart Device Security Standards under the Cyber Security Act

Plain-English guide to Australia's Cyber Security (Security Standards for Smart Devices) Rules 2025: scope, passwords, vulnerability reporting, support periods, statements of compliance, and evidence records.

CSA 2024 Smart Device Applicability Test

Check whether a smart device is a consumer-grade relevant connectable product under Australia's Cyber Security Act and Smart Devices Rules.

Cyber Security Act 2024 Smart Device Compliance Checklist

Checklist for Australia Cyber Security Act 2024 smart-device scope, password controls, vulnerability reporting, security-update support periods, statements of compliance, retention, and evidence.

SOCI overlap triage workflow for Australia Cyber Security Act

Triage SOCI Act overlap with Australia Cyber Security Act ransomware reporting and smart-device standards using separate owners, evidence, and cited scope checks.

Australia Cyber Security Act recordkeeping FAQ

What records to keep for Cyber Security Act 2024 smart-device statements, ransomware payment reports, and supported SOCI or APRA overlap checks.

Australia Ransomware Payment Reporting: Threshold and Report Content

FAQ answer on Australia's Cyber Security Act ransomware payment reporting scope, $3 million turnover threshold, 72-hour trigger, report fields, and evidence.

Cyber Security Act 2024 Statements of Compliance FAQ

Australian smart-device statements of compliance: covered products, responsible actors, required contents, supporting evidence, and five-year retention.

How do notices and recalls work under the Australia Cyber Security Act?

FAQ on Australia Cyber Security Act compliance notices, stop notices, recall notices, public notifications, owners, evidence fields, and cited timing.

How does the Australia Cyber Security Act overlap with the SOCI Act?

FAQ on when Australia Cyber Security Act ransomware reporting overlaps with SOCI critical infrastructure assets, responsible entities, and smart-device duties.

Manufacturer, Importer, and Supplier Duties under Australia's Cyber Security Act 2024

Cyber Security Act 2024 smart-device duties for manufacturers, importers, and suppliers, including role tests, scope, statements, and records.

Which smart devices are in scope under Australia's Cyber Security Act 2024?

FAQ on Cyber Security Act 2024 smart-device scope: relevant connectable products, consumer-grade criteria, exclusions, Australian consumer acquisition, and records to keep.