Prices, cost drivers and 2026 rules
Cyber Security Act 2024: ransomware payment reporting, the $3m threshold and SOCI Act duties
Who must report a ransomware or cyber extortion payment within 72 hours, how the $3m turnover test works, what the report contains, enforcement in 2026 and SOCI Act incident reporting.
Under Part 3 of the Cyber Security Act 2024, a business carrying on business in Australia with annual turnover above $3 million in the previous financial year, and any responsible entity for a critical infrastructure asset covered by Part 2B of the SOCI Act, must report to the Commonwealth within 72 hours of making a ransomware or cyber extortion payment, or of becoming aware that someone paid on its behalf. The obligation has applied since 30 May 2025. The report goes to the designated Commonwealth body, which in practice means reporting through ASD's Australian Cyber Security Centre at cyber.gov.au. Failing to report attracts a civil penalty of 60 penalty units. The law does not ban paying; it requires reporting if you do.
This guide sits under the pricing overview. The Privacy Act's breach rules are separate: see APP 11 and the NDB scheme. This is general information, not legal advice.
Who is a "reporting business entity"?
Section 26 of the Act and section 6 of the Cyber Security (Ransomware Payment Reporting) Rules 2025 set the test. You must report if, at the time of the payment:
| Test | Detail |
|---|---|
| You carry on a business in Australia | Includes foreign businesses operating here |
| Annual turnover for the previous financial year exceeds the threshold | The threshold is $3 million (Rules, s 6(1)) |
| Part-year businesses | Threshold pro-rated: $3 million × days in business ÷ days in the previous financial year (Rules, s 6(2)) |
| You are not a Commonwealth or State body | Government bodies are excluded |
| Or: you are a responsible entity for a critical infrastructure asset under Part 2B of the SOCI Act | Covered regardless of turnover |
Note the turnover threshold matches the Privacy Act's small business figure, but the two tests are separate. A business with $3.5 million turnover that is otherwise exempt from the Privacy Act can still have to report a ransomware payment.
Worked example (illustrative): a business started on 1 January 2025 and traded for 181 days of the 2024–25 financial year (365 days). Its pro-rated threshold is $3,000,000 × 181 ÷ 365 = $1,487,671. If it turned over $1.6 million in that period, it exceeds the threshold for a payment made in 2025–26.
What triggers the obligation
Section 26(1) describes the situation: a cyber security incident has occurred, is occurring or is imminent; it has had, or could reasonably be expected to have, an impact on the business; someone makes a demand to benefit from it; and the business pays, or knows someone paid on its behalf, a payment or benefit directly related to the demand. "Payment or benefit" is not limited to money; non-monetary benefits count.
What the report must contain
Section 27 and section 7 of the Rules require information you know or can find out by reasonable search or enquiry within the 72 hours, including:
- your contact and business details, including ABN (if any) and address, and those of anyone who paid on your behalf;
- when the incident occurred (or is estimated to have occurred) and when you became aware of it;
- its impact on your infrastructure and on your customers;
- any ransomware or malware variants used and vulnerabilities exploited;
- the demand made: amount or description, and the method of payment demanded;
- the payment made and how it was provided;
- communications with the extorting party about the incident, demand and payment.
Limited use of reports
Sections 29 and 30 limit how the Commonwealth can use and disclose information in a ransomware payment report, and section 32 restricts its admissibility in many proceedings against the reporting business. The protections have conditions and exceptions, so take legal advice before relying on them, but they are designed to encourage reporting.
Enforcement in 2026
The Department of Home Affairs said it would take an education-first approach in an initial phase that ran to the end of 2025, pursuing regulatory action only for egregious non-compliance. From 2026 the Department has said it combines education with compliance and enforcement. As at October 2026, treat the obligation as fully enforceable and check homeaffairs.gov.au for the current compliance approach.
The SOCI Act: if you are, or supply, critical infrastructure
The Security of Critical Infrastructure Act 2018 covers responsible entities for critical infrastructure assets in sectors such as energy, water, communications, transport, health care, food and grocery, financial services and data storage. Where Part 2B applies, the entity must report:
| Incident | Deadline |
|---|---|
| Cyber security incident having a significant impact on the availability of the asset | As soon as practicable and within 12 hours of becoming aware (s 30BC) |
| Cyber security incident having a relevant impact on the asset | As soon as practicable and within 72 hours (s 30BD) |
Most SMBs are not responsible entities, but suppliers to critical infrastructure operators often find SOCI-driven clauses in their contracts: incident notification within hours, security controls, and audit rights. Price those obligations into your managed security scope. The Cyber and Infrastructure Security Centre (cisc.gov.au) administers the SOCI Act.
What this means for your managed security contract
- Incident playbooks should include the 72-hour ransomware clock, alongside the Privacy Act's 30-day assessment and any insurer notification deadline. See the first 72 hours.
- Evidence collection. The report asks for variants, vulnerabilities and communications. Your provider should preserve this evidence.
- Negotiators and payments. If any third party (an insurer's panel firm, for example) pays on your behalf, you still have to report.
- Board awareness. Decide in advance who has authority to approve or refuse a payment.
Frequently asked questions
Is paying a ransom illegal in Australia?
The Cyber Security Act does not prohibit payment. Other laws, such as sanctions laws, may prohibit paying certain people or groups. Get legal advice before any payment.
My turnover is under $3 million. Should I report anyway?
You are not required to report the payment under this Act, but ASD encourages reporting cyber incidents through cyber.gov.au, and other obligations, such as the NDB scheme or contracts, may still apply.
Does the 72 hours run from the attack or the payment?
From making the payment, or from becoming aware that it was made on your behalf.
What is a penalty unit worth?
The Commonwealth penalty unit amount is set in the Crimes Act 1914 and indexed. Check the current value on legislation.gov.au before relying on a dollar figure.
Sources
- Federal Register of Legislation — Cyber Security Act 2024 (Part 3, ss 26–32); Cyber Security (Ransomware Payment Reporting) Rules 2025; SOCI Act 2018 (Part 2B)
- Department of Home Affairs — Cyber Security Act 2024 implementation and compliance approach
- ASD's Australian Cyber Security Centre — ransomware payment reporting and incident reporting
- Cyber and Infrastructure Security Centre — SOCI Act obligations
