General information, not legal advice. The official place to check is the Cyber and Infrastructure Security Centre, whose notification guidance (March 2026) this page draws on.
01 · which assetsWho carries the duty
Both reports bind “the responsible entity for a critical infrastructure asset”, and only for assets Part 2B applies to. Section 30BB(1) says Part 2B applies to a critical infrastructure asset if “the asset is specified in the rules”, or if “the asset is the subject of a declaration under section 51” and “the declaration determines that this Part applies to the asset”. The rules may also hold Part 2B back for a period after an asset first becomes a critical infrastructure asset (s 30BB(3)).
The Centre’s page puts the rest plainly: “The type of obligations that apply to you will depend on the role you have in relation to the CI asset, and the type of CI asset.” Which entity is responsible varies by asset class, and section 12L of the Act defines it for each.
02 · two clocksCritical and other incidents
| Question | Critical (s 30BC) | Other (s 30BD) |
|---|---|---|
| The incident | Has occurred or is occurring | Has occurred, is occurring or is imminent |
| The impact | “has had, or is having, a significant impact (whether direct or indirect) on the availability of the asset” | “has had, is having, or is likely to have, a relevant impact on the asset” |
| Report | As soon as practicable, within 12 hours | As soon as practicable, within 72 hours |
| After an oral report | A written record in the approved form, with a copy to the relevant Commonwealth body, within 84 hours | The same, within 48 hours |
| Civil penalty | 50 penalty units | 50 penalty units |
Each penalty can be enforced by a court order under Part 4 of the Regulatory Powers (Standard Provisions) Act 2014 (s 49(1)), which this guide does not set out. A written report must itself be in the approved form. The head of the relevant Commonwealth body can exempt an entity, by written notice, from the written-record step for a specified incident (ss 30BC(5), 30BD(5)). The guidance says reports go to the Australian Signals Directorate’s Australian Cyber Security Centre, with written records made through cyber.gov.au.
03 · the testSignificant or relevant
The guidance summarises section 30BEA: “A cyber security incident has a significant impact on the availability of an asset where both the critical infrastructure asset is used in connection with the provision of essential goods and services, and the incident has materially disrupted the availability of the essential goods or services delivered by a critical infrastructure asset.” Section 30BEA itself has a second limb: an incident also has a significant impact if “any of the circumstances specified in the rules exist in relation to the incident”. The guidance adds that “The incident does not have to have a direct significant impact on the asset for it to be reportable”, and lists indicators that “may include”:
- “You lose control of your operating technology”
- “Your asset is unable to function as intended and you are unable to deliver services”
- “You shut down essential services to contain the impacts of the incident.”
A relevant impact is defined in section 8G(2): the impact, “whether direct or indirect”, of the incident on the asset’s availability, its integrity or its reliability, or on the confidentiality of “information about the asset”, of the information stored in it, or, where the asset is computer data, of “the computer data”.
04 · the startWhen the clock starts
“‘Becoming aware’ is a matter of fact and relates to whether the responsible entity of an asset has knowledge of that incident.” An alert alone is not enough: the guidance says an entity “is not considered to become aware merely because an automated system has detected an incident”, and becomes aware on confirmation, or when it should have if it had followed its own monitoring and escalation processes.
The guidance also says an accident counts: “For an action to be unauthorised it does not need to be intentional.” Nor does anyone need to be identified as the person behind it.
05 · the runEscalation, lateness and the form
- A second report. If an incident reported as “other” later has a significant impact, the guidance says a second report is due within 12 hours of becoming aware of that, with a written record within 84 hours if the second report is oral.
- Late. “If you have missed the timeframe for reporting, you should still make a report. Late reports will be considered less egregious and are less likely to result in punitive action than not reporting at all.”
- The network. “Do not complete this form on any network you believe has been compromised.” The guidance suggests a separate system and contact details.
06 · a second clockIf a ransom is paid
For a ransomware incident, the guidance adds: “You may need to consider whether you have ransomware payment reporting obligations under the Cyber Security Act 2024.” That Act names a responsible entity for an asset to which Part 2B applies as a reporting business entity, so a payment can start its own 72-hour report, set out in the ransomware payments guide.