Federal parliament enacts cyber security legislation

On 25 November 2024, the Australian Parliament passed a suite of legislation, collectively referred to by the Australian Government as the Cyber Security Legislative Package 2024.  The purported impetus for this legislation was a series of high-profile data breaches in 2022 and 2023.^[1]

The Cyber Security Legislative Package 2024 comprised the following Acts:

• Cyber Security Act 2024 (Cth);
• Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024 (Cth); and
• Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (Cth).

Overview of the Cyber Security Act 2024 (Cth)

The Cyber Security Act 2024 (Cth) (CSA) contains the substantive provisions to give effect to the Cyber Security Legislative Package.  It mandates security standards for Internet of Things (IoT) devices, requiring reporting of ransomware payments and coordinating government responses to major cyber incidents.

Part 2 – Security standards for smart devices
This part establishes mandatory security standards for internet-connectable products, called relevant connectable products loT.

Key definitions in the CSA

Section 9: Defines “cyber security incident” as an incident that involves a critical infrastructure asset, activities of a corporation subject to the Constitution’s paragraph 51(xx), or a telegraphic, telephonic, or similar service under paragraph 51(v).

Section 10: Defines “permitted cyber security purpose” for a cyber security incident, including responding to, mitigating, or resolving the incident by Commonwealth and State bodies and intelligence agencies.

Section 15: Outlines compliance with security standards for relevant connectable products.

Section 16: Outlines the obligation to provide products with a statement of compliance.

Part 3 – Ransomware reporting obligations
This part imposes reporting obligations on entities impacted by cybersecurity incidents and who have made, or are aware of, ransomware payments.

Section 27: Requires reporting business entities to report ransomware payments to a designated Commonwealth body within 72 hours of making the payment or becoming aware it was made.

Sections 29 and 30: Limit the use and disclosure of ransomware payment reports to specific permitted purposes, including cybersecurity incident response, and prohibits use for civil or regulatory action against the reporting entity (unless it involves a criminal offense).

Section 32: Makes information provided in ransomware payment reports inadmissible in evidence against the reporting business entity in most legal proceedings.

Part 4 – Coordination of significant cyber security incidents
This part enables entities to voluntarily share information with the National Cyber Security Coordinator about significant cyber security incidents.

Section 21: Defines the National Cyber Security Coordinator as the officer of the Department known as the National Cyber Security Coordinator, along with their staff.

Section 35: Allows impacted entities to voluntarily provide information about potential significant cyber security incidents to the National Cyber Security Coordinator.

Section 37: Outlines the National Cyber Security Coordinator’s role as leading government-wide coordination and response to significant cybersecurity incidents.

Sections 38 and 39: Outline the permitted uses of information voluntarily provided to the National Cyber Security Coordinator, including incident response, and prohibit its use for civil or regulatory action against the impacted entity (unless it involves a criminal offense).

Part 5 – Creation of the Cyber Incident Review Board
This part establishes the Cyber Incident Review Board to conduct reviews of certain cybersecurity incidents and provide recommendations for improvement.

Section 46: Outlines the Board’s function to cause reviews of significant cyber security incidents, potentially at the referral of impacted entities, the Minister, or the National Cyber Security Coordinator.

Section 48: Allows the Chair of the board to request information or documents relevant to an ongoing review.

Section 50: Establishes civil penalties for failing to comply with a notice to produce documents.

Section 53: Outlines the types of information that must be redacted from final review reports, including information that could prejudice an ongoing investigation, is prohibited from disclosure, or is unreasonably commercially sensitive.

To ensure consistency across government agencies, the data use and regulatory restrictions outlined in the CSA are also mirrored in the Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024 (Cth).

This article does not discuss the provisions of the:

• Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024 (Cth), which amends the Intelligence Services Act 2001 (Cth); and
• Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (Cth).

The implementation of the Cyber Security Legislative Package 2024 forms part of the broader cyber security strategy framework outlined in the Australian Government’s 2023-2030 Cyber Security Strategy.

Links and further references

Legislation

Cyber Security Act 2024 (Cth)

Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024 (Cth)

Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (Cth)

Further information about cyber security compliance

If you need advice on cyber security compliance, contact us for a confidential and obligation-free discussion:

Disclaimer

This article contains general commentary only.  You should not rely on the commentary as legal advice.  Specific legal advice should be obtained to ascertain how the law applies to your particular circumstances.

[1]   Parliamentary Business, Bills Digest: 2024-25, 25BD28 (Department of the Parliamentary Library, 2024) https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/bd/bd2425/25bd028 accessed 13 February 2025.

---

Related insights about cyber security law