How Australian CISOs Can Turn Ransomware Reporting Laws into a Board-Backed Cyber Strategy

Introduction

In an era where cyber threats are escalating, the Australian Government has introduced the Cyber Security Act 2024, mandating the reporting of ransomware and cyber extortion payments. This legislation aims to enhance the nation’s cyber resilience by providing a clearer picture of the threat landscape and disrupting the ransomware business model.Piper Alderman+7Department of Home Affairs Website+7Keypoint Law+7

Key Questions for CISOs to Build a Business Case

  1. Is Our Organization Classified as a Reporting Business Entity?
    • Does our organization operate in Australia with an annual turnover exceeding the threshold specified in the Rules (proposed at AU$3 million)?
    • Are we a responsible entity for a critical infrastructure asset under Part 2B of the Security of Critical Infrastructure Act 2018?
  2. Are We Prepared to Comply with the 72-Hour Reporting Requirement?
  3. Do We Understand the Scope of Reportable Incidents?
    • Are we aware that the obligation extends beyond traditional ransomware to include other forms of cyber extortion, such as data exfiltration accompanied by a demand?
  4. Are Our Third-Party Arrangements Aligned with Reporting Obligations?
    • Have we assessed whether third-party service providers (e.g., insurers, incident response firms) are aware of and prepared to comply with reporting requirements on our behalf?superiorit.com.au
  5. Have We Evaluated the Legal and Financial Risks Associated with Non-Compliance?
    • Are we informed about potential penalties for failing to report, including fines and reputational damage?
    • Do we understand the risks of making payments to entities subject to sanctions, which could constitute a serious criminal offence?The Australian+3DFAT+3GOV.UK+3

Ransomware payment and cyber extortion payment reporting commenced today, Friday 30 May 2025.

Thank you for your engagement and for attending the Town Hall hosted last week on the ransomware payment and cyber extortion payment reporting obligation, under Part 3 of the Cyber Security Act 2024 and the Cyber Security (Ransomware Payment Reporting) Rules 2025.

If you missed the Town Hall, or would like to watch the recording, see the following link to the CISC’s website: Town halls and awareness sessions.

For further information on the ransomware reporting obligation, see Cyber Security Act. On that webpage, you will be able to see the following:

·         A factsheet which outlines what your obligations are, a case study using the formula prescribed under the rules, information on the Department’s two-stage implementation approach and other useful information: see factsheet-ransomware-payment-reporting;

·         A document answering frequently asked questions, including two scenarios to determine who needs to make a report with entities outside of Australia, and a process map on how information may be disclosed under the Act: see FAQs-ransomware-payment-reporting; and

You will be able to access the new reporting form at: Report | Cyber.gov.au.

Thank you again for your constructive engagement to date on the cyber security legislative reforms, the Act and the Rules. Please do not hesitate to reach out to the team at cyber.legislation@homeaffairs.gov.au about the Act or Rules, or ransomware.reporting@homeaffairs.gov.au for any queries specific to ransomware payment reporting.

Kind regards,

Cyber Security Frameworks & Reviews Section

Department of Home Affairs

cyber.legislation@homeaffairs.gov.au

ransomware.reporting@homeaffairs.gov.au

Conclusion

The mandatory reporting of ransomware payments represents a significant shift in Australia’s cyber security landscape. CISOs must proactively assess their organization’s readiness to comply with these obligations, ensuring that appropriate policies, procedures, and training are in place. By doing so, organizations not only adhere to legal requirements but also contribute to a more secure and resilient digital environment.MinterEllison+10Keypoint Law+10Gallagher+10

References