General information, not legal advice. The official places to check are the Australian Signals Directorate’s ransomware payment reporting page and the Cyber Security Act 2024 on the Federal Register of Legislation.
01 · since whenIn force since 29 May 2025
The reporting duty sits in Part 3 of the Act. The Act left Part 3’s start to a Proclamation, with a fallback start on the day after a six-month period from Royal Assent ended, and the Register’s commencement table records the date as 29 May 2025. That column is the Register’s information: the Act says it “is not part of this Act”. The Cyber Security (Ransomware Payment Reporting) Rules 2025, which set the turnover figure, start at the later of the start of the day after they were registered and the moment Part 3 commenced.
02 · the triggerA payment starts this clock, not an attack
Section 26(1) says Part 3 applies if all of these are true:
- “an incident has occurred, is occurring or is imminent”
- “the incident is a cyber security incident”
- “the incident has had, is having, or could reasonably be expected to have, a direct or indirect impact on a reporting business entity”
- “an entity (the extorting entity) makes a demand of the reporting business entity, or any other entity, in order to benefit from the incident or the impact on the reporting business entity”
- “the reporting business entity provides, or is aware that another entity has provided on their behalf, a payment or benefit (a ransomware payment) to the extorting entity that is directly related to the demand.”
The last condition is the payment, and it can be a benefit rather than money. Without one there is no report to make under section 27, however serious the attack; the attack can still start other clocks, such as the reports for critical infrastructure assets.
03 · whoThe reporting business entity
Section 26(2) decides who reports. “An entity is a reporting business entity if, at the time the ransomware payment is made”:
Section 26(2)
- “the entity:”
- “is carrying on a business in Australia with an annual turnover for the previous financial year that exceeds the turnover threshold for that year”; and
- “is not a Commonwealth body or a State body”; and
- “is not a responsible entity for a critical infrastructure asset”; or
- “the entity is a responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies.”
The Rules set the turnover threshold for a business for the previous financial year at $3 million (s 6(1)), so the test is turnover that exceeds $3 million. A business carried on for only part of the previous financial year has its threshold worked out by a formula in section 6(2) of the Rules. “Business” has the meaning it has in the Income Tax Assessment Act 1997, and an entity can be an individual, a body corporate, a partnership, an unincorporated association that has a governing body, a trust, or a responsible entity for a critical infrastructure asset (s 8).
04 · how fastThe 72 hours
The entity “must give the designated Commonwealth body a report (a ransomware payment report) that complies with the requirements of this section within 72 hours of making the ransomware payment or becoming aware that the ransomware payment has been made (whichever is applicable)” (s 27(1)). The designated Commonwealth body is “a Department, or a body established by a law of the Commonwealth, specified in the rules” or, if no rules are made for that purpose, “the Department and ASD” (s 8). The report is given in the form the Secretary approves, if any, and in any manner the rules prescribe (s 27(4)). ASD’s reporting page carries the form, which it says a reporting business entity uses “to report to the Government”. A missed report carries a civil penalty of 60 penalty units (s 27(5)). The penalty can be enforced by a court order under Part 4 of the Regulatory Powers (Standard Provisions) Act 2014 (s 79(1)), which this guide does not set out.
05 · whatWhat the report holds
Section 27(2) lists six matters, and section 7 of the Rules says what each must include. Only what the entity knows, or can find out by reasonable search or enquiry, is required; the Rules’ note ties that to the 72 hours. Other information about the incident may be added (s 27(3)).
| The Act asks about | The Rules require |
|---|---|
| If the entity paid: its own contact and business details | Its ABN (if any) and address |
| If another entity paid: that entity’s contact and business details | That entity’s ABN (if any) and address |
| The cyber security incident, including its impact on the entity | When it occurred or is estimated to have occurred; when the entity became aware of it; its impact on the entity’s infrastructure; its impact on the entity’s customers; any ransomware or other malware variants used; any vulnerabilities in the entity’s system that were exploited; and information that could help a Commonwealth or State body respond to, mitigate or resolve it |
| The demand made by the extorting entity | The amount or quantum demanded, or a description of a non-monetary benefit demanded, and the method of provision demanded |
| The ransomware payment | The amount or quantum paid, or a description of a non-monetary benefit, and the method of provision |
| Communications with the extorting entity about the incident, the demand and the payment | The nature and timing of any communications, a brief description of them (if any), and a brief description of any pre-payment negotiations |
06 · afterwardsWhere the report can go
The Rules carry a note on use: “Ransomware payment reports may only be used or disclosed for permitted purposes which include purposes relating to the response to, mitigation or resolution of the cyber security incident. The information must not be disclosed to a State body unless a Minister of the State or Territory has consented: see section 11 of the Act.”