Artifact GuideAustraliaTemplates

Australia Cyber Security Act Templates

Build implementation templates for connectable-product scope, manufacturer and supplier duties, statement of compliance evidence, ransomware report content, notice response, and SOCI overlap.

Keep product scope, statements, ransomware reports, SOCI overlap, and regulator responses in separate records, with the evidence needed to explain each decision.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 23, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 23, 2026

Overview

Use these templates as field lists for Australia Cyber Security Act implementation records. Start the smart-device template by deciding whether an item is a . Part 3 commenced on 29 May 2025 under section 2 of the Act; Home Affairs guidance incorrectly describes mandatory ransomware reporting as active from 30 May 2025. The prescribed smart-device standard and statement requirements commenced on 4 March 2026. The templates are based on the Act, the two 2025 Rules, and SOCI sources where critical-infrastructure overlap matters. Adapt them to the facts and the live filing instructions.

Section 1

Smart-device scope intake template

Use the scope intake to decide whether the product is a and whether the consumer-grade smart-device security standard applies. The official explanatory statement gives smart TVs, smart watches, home assistants, baby monitors, and consumer energy resources as examples. These examples do not classify a product automatically; record the binding connectivity, intended-use, acquisition, awareness, date, and exclusion tests for the specific product. Keep enough product evidence to explain the scope result.

Apply the Act's product-cohort test separately from the Rules scope test. Part 2 applies when a was manufactured on or after 29 November 2025 or supplied in Australia, other than as second-hand goods, on or after that date. The prescribed consumer-grade standard and statement requirements did not become operative until 4 March 2026.

Product identifiers and dates: product name, model, version, product type, batch identifier, intended purpose, manufacture date, Australian supply date, whether the supply is second-hand, and launch or supply channel.
Connectivity facts: whether the product connects to the internet using an internet-protocol communication; connects directly to an internet-connectable product using an internet-protocol communication; or meets the Act's non-internet-protocol test by connecting directly to two or more products at the same time and directly to an internet-connectable product. Record the statutory exceptions for mere wires or cables and linked computer-input products where relevant.
Consumer-grade test: intended personal, domestic, or household use; whether acquisition in Australia by a consumer is expected; and evidence from labels, instructions, promotional material, or sales material.
Exclusion check: desktop computer or laptop, tablet computer, smartphone, therapeutic good, road vehicle, or road vehicle component.
Security-standard evidence fields: whether covered passwords are user-defined or unique per product; evidence that unique passwords avoid incremental counters, public information, insecure identifier derivation, and other guessable methods; the location of the published security-issue reporting contact and acknowledgement and status-update timing; the with an end date; security-update coverage; proof that the support period was not shortened; and, where the manufacturer offers the product on a website it controls, each page where the support period must appear with acquisition information or product characteristics.

Sources for this answer

Cyber Security Act 2024

Supports Part 2 commencement and second-hand supply boundaries, the relevant connectable product tests, and manufacturer and supplier provisions.

Cyber Security (Security Standards for Smart Devices) Rules 2025

Supports the 4 March 2026 commencement, consumer-grade product class, six exclusions, password, security-issue reporting, support-period, and security-update fields.

Explanatory Statement to the Cyber Security (Security Standards for Smart Devices) Rules 2025

Official explanatory material gives representative consumer-grade smart-device examples; the template still applies the binding Act and Rules tests to each product.

Section 2

Statement of compliance and evidence-pack template

Mirror the Rules in the statement template and link an evidence pack that a manufacturer, supplier, reviewer, or regulator can test against the security standard.

The Rules prescribe the content of a but do not provide an official form or fixed wording. Keep the signed statement separate from the underlying technical evidence, and link both records to the covered product type and batch.

Statement fields: product type and batch identifier; manufacturer name and address; the name and address of an ; the name and address of each other authorised representative in Australia, if any; and the declaration that the statement was prepared by or on behalf of the manufacturer. Section 9 makes only the "other" Australian-representative list expressly conditional.
Compliance declaration fields: manufacturer opinion that the product was manufactured in compliance with the security standard and that other product obligations in the standard have been met.
Support-period fields: at the date of issue, published support-period URL or document location, security-update coverage for hardware and software, and owner for updating public support information.
Sign-off fields: signatory signature, name, function, place of issue, date of issue, reviewer, supplier handoff owner, and evidence-pack location.
Retention fields: manufacturer and supplier copy owners, documented basis for each retention start and end date, product or batch link, copy locations, and evidence that each statement is kept for the five-year Rules period. Section 10 specifies the period but not its starting event, so record the interpretation used and obtain advice where the date changes disposal timing.

Sources for this answer

Cyber Security Act 2024

Supports the manufacturer and supplier obligation to provide or supply a statement of compliance and retain a copy for the period specified in the Rules.

Cyber Security (Security Standards for Smart Devices) Rules 2025

Supports the required statement fields and the 5-year retention period for statements of compliance.

Section 3

Ransomware payment report template

The ransomware report template should separate reportability, 72-hour timing, known facts, reasonable search status, and the actual report payload. It should also record whether status makes the organisation a . The Act says the turnover route requires annual turnover that exceeds the prescribed threshold, and the Rules set that threshold at $3 million. Turnover of exactly $3 million therefore does not satisfy the turnover limb, although the Part 2B limb may still apply. The current cyber.gov.au form instead says "equal to or exceeds $3 million," but that form label does not change the Act's "exceeds" test.

Reportability fields: Australian business status, whether previous-financial-year turnover exceeds $3 million, SOCI responsible-entity and Part 2B asset status, Commonwealth or State body exclusion check, incident impact on the entity, demand, payment or benefit, and whether another entity paid on the entity's behalf.
Timing and filing fields: payment timestamp, timestamp when the entity became aware another entity paid on its behalf, 72-hour deadline, cyber.gov.au reporting-form URL confirmed at submission time, submitter, approver, submission confirmation, and late-risk escalation owner.
Business details fields: reporting entity legal name, Australian Business Number (ABN) if any, address, contact person, and the same details for another paying entity if applicable.
Incident fields: when the incident occurred or is estimated to have occurred, when the reporting entity became aware, infrastructure impact, customer impact, ransomware or malware variants, exploited vulnerabilities, and information that could assist Commonwealth or State response, mitigation, or resolution.
Demand and payment fields: amount or quantum demanded, non-monetary benefit description where relevant, demanded method of provision, amount or quantum paid, payment method, communication timing, communication summary, and pre-payment negotiation summary.
Additional-information field: any other incident information the reporting entity chooses to include under subsection 27(3), kept distinct from the mandatory Act and Rules fields.

Sources for this answer

Cyber Security Act 2024

Supports the 72-hour reporting obligation, reporting-business-entity test, and ransomware payment report categories.

Cyber Security (Ransomware Payment Reporting) Rules 2025

Supports the $3 million turnover threshold and the detailed report fields for incident, demand, payment, and extorting-entity communications.

Australian Government ransomware and cyber extortion payment reporting form

Current official filing route and field sequence. The live form's "equal to or exceeds $3 million" label differs from, and does not alter, the Act's binding "exceeds" test.

Section 4

Compliance, stop, recall, and public-notification template

Notice-response templates should be tied to the smart-device obligations in sections 15 and 16. Capture what the notice says, what action is within the entity's control, what evidence must be produced, and whether internal review is available.

Keep the notice stages distinct. A compliance notice can address non-compliance or possible non-compliance. A stop notice follows a compliance notice that was not complied with or did not adequately rectify the problem, and a recall notice follows an inadequate or unfulfilled stop notice. Before issuing any of the three notices, the Secretary must allow at least 10 days for representations.

Notice fields: notice type, issuing authority, entity name, product details, non-compliance or possible non-compliance summary, affected section 15 or section 16 obligation, date given, response owner, and evidence owner.
Action fields: required corrective action, required stop action or restraint, recall action, return pathway, consumer communication owner, specified period for action, and specified period for evidence if included in the notice.
Review fields: the pre-issue representation deadline of at least 10 days; the internal-review application deadline, which is 30 days after the notice was given; review applicant; grounds for review; decision-maker; 30-day decision deadline after receipt of the application; and outcome field for an affirmed, varied, or revoked decision.
Public-notification fields: entity identity, product details, non-compliance details, product risks, recall-notice details, and recommended consumer actions such as destroying the product or taking extra precautions when using it.
Evidence fields: product test material, , password evidence, published security-issue reporting process, support-period publication, consumer notice copy, supplier notification log, and remediation verification.

Sources for this answer

Cyber Security Act 2024

Sections 17 to 23 support compliance, stop, and recall notice stages; the minimum 10-day representation period; public notification; internal review within 30 days; and examination fields.

Cyber Security (Security Standards for Smart Devices) Rules 2025

Supports the additional public-notification matters for failure to comply with a recall notice, including recall notice details and recommended consumer actions.

Section 5

SOCI overlap and records template

The Cyber Security Act template set should include a SOCI overlap record because ransomware reporting can apply through responsible-entity status for a critical infrastructure asset to which applies. Separately, section 44 preserves other Commonwealth information-reporting duties for information provided under Part 4.

SOCI overlap fields: critical infrastructure asset name, sector, responsible entity, whether applies, source used for application status, and responsible SOCI incident-reporting owner.
Ransomware overlap fields: whether the incident affects a SOCI responsible entity, whether the payment-reporting obligation is triggered through SOCI status or turnover status, and whether another Commonwealth reporting requirement also applies.
Risk-management-program fields: asset covered by a critical infrastructure risk management program, cyber and information security hazard owner, material-risk record, control record, program review owner, and annual-report owner where applicable.
Protected record controls: report version, privilege flag, permitted-use note, disclosure owner, Commonwealth or State body disclosure status, and internal access list for ransomware or incident-coordination material.
Record index: scope intake, , evidence pack, support-period publication proof, security-issue reporting publication proof, notice log, ransomware report, SOCI overlap assessment, and post-incident lessons record.

Sources for this answer

Cyber Security Act 2024

Section 26 links reporting-business-entity status to responsible entities for critical infrastructure assets to which SOCI Part 2B applies. Section 44 separately preserves other Commonwealth reporting requirements for information provided under Part 4.

Security of Critical Infrastructure Act 2018

Supports the SOCI responsible-entity, critical-infrastructure-asset, Part 2B incident-notification, and risk-management-program overlap checks.

Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022

Supports the template field that checks whether Part 2B of the SOCI Act applies to the relevant critical infrastructure asset.

Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023

Supports risk-management-program fields for hazards, controls, review ownership, and records where a SOCI responsible entity also has Cyber Security Act work.

Recommended next step

Turn Australia Cyber Security Act templates into assigned work

Convert smart-device, ransomware, notice, SOCI overlap, and recordkeeping fields into owners, evidence requests, and review tasks in Sorena.

Assessment workflow

Open Assessment Autopilot for Australia Cyber Security Act templates

Turn template fields into scoped questions, evidence requests, and assigned reviews.

Explore next step

Research workflow

Review Australia Cyber Security Act source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step

Talk to Sorena

Talk through template implementation

Review scope, statement evidence, ransomware reporting records, and SOCI overlap with Sorena.

Explore next step

Primary sources

References and citations

Australian Government ransomware and cyber extortion payment reporting form

cyber.gov.au

Referenced sections

Current official filing route and field sequence. The live form's "equal to or exceeds $3 million" label differs from, and does not alter, the Act's binding "exceeds" test.

"equal to or exceeds $3 million"

Cyber Security (Ransomware Payment Reporting) Rules 2025

legislation.gov.au

Referenced sections

Supports the $3 million turnover threshold and the detailed report fields for incident, demand, payment, and extorting-entity communications.

"the amount of turnover threshold for a business for the previous financial year is $3 million"

Cyber Security (Security Standards for Smart Devices) Rules 2025

legislation.gov.au

Referenced sections

Supports the additional public-notification matters for failure to comply with a recall notice, including recall notice details and recommended consumer actions.

"actions consumers are recommended to consider taking"

Cyber Security Act 2024

legislation.gov.au

Referenced sections

Section 26 links reporting-business-entity status to responsible entities for critical infrastructure assets to which SOCI Part 2B applies. Section 44 separately preserves other Commonwealth reporting requirements for information provided under Part 4.

"Information provided by an entity under this Part does not affect any other requirement of the entity to provide that information"

Department of Home Affairs - mandatory ransomware payment reporting factsheet

homeaffairs.gov.au

Referenced sections

This official guidance describes mandatory ransomware and cyber-extortion payment reporting as active from 30 May 2025, one day after Part 3 commenced under section 2 of the Act.

Explanatory Statement to the Cyber Security (Security Standards for Smart Devices) Rules 2025

legislation.gov.au

Referenced sections

Official explanatory material gives representative consumer-grade smart-device examples; the template still applies the binding Act and Rules tests to each product.

Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022

legislation.gov.au

Referenced sections

Supports the template field that checks whether Part 2B of the SOCI Act applies to the relevant critical infrastructure asset.

"Application of Part 2B of the Act"

Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023

legislation.gov.au

Referenced sections

Supports risk-management-program fields for hazards, controls, review ownership, and records where a SOCI responsible entity also has Cyber Security Act work.