Mandatory ransomware payment reporting, smart device security standards and a Cyber Incident Review Board. What Australian businesses need to know.
The Cyber Security Act 2024 is Australia's first standalone cyber security legislation, passed in November 2024. It establishes mandatory obligations for businesses regarding ransomware payments, smart device security, and incident reporting — forming a key pillar of the Australian Government's 2023–2030 Cyber Security Strategy.
The Act introduces several significant reforms including mandatory reporting of ransomware payments, minimum security standards for smart devices sold in Australia, a Cyber Incident Review Board, and a limited-use obligation restricting how government agencies can use voluntarily shared cyber incident information.
The Act applies broadly across the Australian economy. Ransomware reporting obligations apply to organisations meeting the critical infrastructure threshold (annual turnover above $3 million). Smart device security standards affect manufacturers and importers. The limited-use provisions affect any organisation that voluntarily shares incident information with the Australian Signals Directorate.
Organisations that make ransomware payments must report them to the Australian Signals Directorate within 72 hours. Failure to report attracts civil penalties.
Manufacturers and suppliers of internet-connected devices must comply with mandatory security standards, including secure defaults and ongoing vulnerability management.
A new independent board empowered to conduct no-fault reviews of significant cyber incidents, producing recommendations to improve national cyber resilience.
Government agencies receiving voluntarily shared cyber incident information are restricted in how they can use it — encouraging businesses to share threat intelligence without fear of regulatory action.
The Cyber Security Act 2024 sits alongside the Security of Critical Infrastructure Act 2018 (SOCI Act), the Privacy Act 1988 and the Telecommunications Act. Organisations already managing Essential Eight, ISO 27001 or APRA CPS 234 obligations will find that existing incident response and governance capabilities provide a strong foundation — but the ransomware reporting obligation is new and requires specific process updates.
We help organisations understand their obligations under the Cyber Security Act 2024 and integrate compliance into existing security programmes. This includes updating incident response plans for ransomware reporting, assessing smart device supply chains, and ensuring your governance framework accounts for the new legislative requirements.
Discuss Your ObligationsBook a free 30-minute call with Doug. No obligation — just an honest conversation about your compliance posture and what it would take to close the gaps.
Book a Discovery Call