{"id":"F2025L00278","name":"Cyber Security (Ransomware Payment Reporting) Rules 2025","slug":"cyber-security-ransomware-payment-reporting-rules-2025","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":442770,"registerId":"F2025L00278-fast-fetch-1775957710693","compilationNumber":null,"startDate":"2026-04-12","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Cyber Security (Ransomware Payment Reporting) Rules 2025","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\n---\n\n?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"no\"?>\n\n![Commonwealth Coat of Arms of Australia](image.001.jpeg)\n\nCyber Security (Ransomware Payment Reporting) Rules 2025\n\nI, Tony Burke, Minister for Home Affairs, make the following rules.\n\nDated 27 February 2025   \n\nTony Burke\n\nMinister for Home Affairs\n\n \n\n \n\n \n\n \n\nContents\n\nPart 1—Preliminary\n\n1 Name\n\n2 Commencement\n\n3 Authority\n\n4 Definitions\n\nPart 2—Ransomware payment reporting obligations\n\n5 Simplified outline of this Part\n\n6 Turnover threshold\n\n7 Requirements for information that ransomware payment report must contain\n\n \n\nPart 1—Preliminary\n\n \n\n1  Name\n\n  This instrument is the Cyber Security (Ransomware Payment Reporting) Rules 2025.\n\n2  Commencement\n\n (1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n \n\n- Commencement information\n- Column 1 Column 2 Column 3\n- Provisions Commencement Date/Details\n- 1. The whole of this instrument The later of:(a) at the start of the day after this instrument is registered; and(b) at the same time as Part 3 of the Cyber Security Act 2024 commences.\n\n\nNote: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.\n\n (2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.\n\n3  Authority\n\n  This instrument is made under the Cyber Security Act 2024.\n\n4  Definitions\n\nNote: A number of expressions used in this instrument are defined in the Act, including the following:\n\n(a) cyber security incident;\n\n(b) ransomware payment;\n\n(c) reporting business entity.\n\n  In this instrument:\n\nAct means the Cyber Security Act 2024.\n\nPart 2—Ransomware payment reporting obligations\n\n \n\n5  Simplified outline of this Part\n\nPart 3 of the Act imposes an obligation to provide a ransomware payment report if an entity:\n\n (a) is a reporting business entity; and\n\n (b) is impacted by a cyber security incident; and\n\n (c) has provided, or is aware that another entity has provided on their behalf, a ransomware payment to an entity that is seeking to benefit from the impact or the cyber security incident.\n\nGenerally an entity will only be a reporting business entity if it:\n\n (a) is a responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies; or\n\n (b) is carrying on a business in Australia with an annual turnover for the previous financial year that exceeds the turnover threshold (see section 6 of this instrument) for that year.\n\nParticular information must be included in a ransomware payment report, including information relating to the cyber security incident, the demand made by the extorting entity and the ransomware payment. The information contained in the report must be in accordance with the requirements provided by the rules (see section 7 of this instrument).\n\n6  Turnover threshold\n\n (1) For the purposes of paragraph 26(3)(b) of the Act, the amount of turnover threshold for a business for the previous financial year is $3 million.\n\n (2) For the purposes of paragraph 26(3)(a) of the Act, if a business has been carried on for only part of the previous financial year, the turnover threshold for the business for the previous financial year is worked out using the formula:\n\n![Start formula $3 million times start fraction Number of days in the part over Number of days in the previous financial year end fraction end formula](image.002.png)\n\n7  Requirements for information that ransomware payment report must contain\n\n (1) For the purposes of subsection 27(2) of the Act, this section prescribes requirements for information that a ransomware payment report given by a reporting business entity in relation to a ransomware payment must contain.\n\nNote: Information is only required to be given to the extent that the reporting business entity knows or is able, by reasonable search or enquiry, to find out within the 72 hour time period for giving the report.\n\n (2) The reporting business entity’s contact and business details given for the purposes of paragraph 27(2)(a) of the Act must include the entity’s ABN (if any) and address.\n\n (3) The other entity’s contact and business details given for the purposes of paragraph 27(2)(b) of the Act must include the entity’s ABN (if any) and address.\n\n (4) The information about the cyber security incident, including its impact on the reporting business entity, given for the purposes of paragraph 27(2)(c) of the Act must include the following:\n\n (a) when the incident occurred or is estimated to have occurred;\n\n (b) when the reporting business entity became aware of the incident;\n\n (c) the impact of the incident on the reporting business entity’s infrastructure;\n\n (d) the impact of the incident on the reporting business entity’s customers;\n\n (e) what variants (if any) of ransomware or other malware were used;\n\n (f) what vulnerabilities (if any) in the reporting business entity’s system were exploited;\n\n (g) information that could assist the response to, mitigation or resolution of the cyber security incident by a Commonwealth body or State body.\n\nNote: Ransomware payment reports may only be used or disclosed for permitted purposes which include purposes relating to the response to, mitigation or resolution of the cyber security incident. The information must not be disclosed to a State body unless a Minister of the State or Territory has consented: see section 11 of the Act.\n\n (5) The information about the demand made by the extorting entity given for the purposes of paragraph 27(2)(d) of the Act must include:\n\n (a) the amount or quantum of the ransomware payment demanded, or if the ransomware payment demanded is a non‑monetary benefit, a description of the ransomware payment demanded; and\n\n (b) the method of provision demanded.\n\n (6) The information about the ransomware payment given for the purposes of paragraph 27(2)(e) of the Act must include:\n\n (a) the amount or quantum of the ransomware payment, or if the ransomware payment is a non‑monetary benefit, a description of the ransomware payment; and\n\n (b) the method of provision.\n\n (7) The information about communications with the extorting entity relating to the incident, the demand and the ransomware payment given for the purposes of paragraph 27(2)(f) of the Act must include:\n\n (a) the nature and timing of any communications between the entity and the extorting entity; and\n\n (b) a brief description of those communications (if any); and\n\n (c) a brief description of any pre‑payment negotiations undertaken in relation to the demand or the ransomware payment.\n","sortOrder":0}],"analysis":{"flash_summary":{"complexity_score":4,"scope_assessment":{"changed":false,"description":"These Rules operationalise Part 3 of the Cyber Security Act 2024 by specifying the $3 million turnover threshold (and prorating), the 72‑hour reporting timeframe, and the precise report content (see ss5–7). They provide procedural and evidentiary detail for reporting obligations without expanding or narrowing the classes of entities subject to reporting under the Act."},"complexity_factors":["Reliance on definitions and thresholds in the Cyber Security Act 2024 and other statutes (reporting business entity, ransomware payment) (see s4 and s5).","Turnover threshold with prorating formula for part‑year businesses requires arithmetic and record verification ($3 million; s6(1)–(2)).","Short, fixed reporting window and knowledge standard (72 hours; s7(1) note) imposes time pressure and evidentiary burdens.","Detailed and technical content requirements (timing, impact, malware variants, exploited vulnerabilities, communications and negotiations) increase compliance and forensic data‑gathering needs (s7(4)–(7)).","Obligation to supply ABNs and addresses for both reporting and other entities requires cross‑checking external records (s7(2)–(3)).","Disclosure limits and inter‑jurisdictional consent (Commonwealth/State sharing; s7(4) note referring to s11 of the Act) add procedural constraints.","Commencement is linked to registration and the start of Part 3 of the Act, creating sequencing dependency (s2)."],"plain_english_summary":"These Rules set out who must report ransomware payments, fix a $3 million annual turnover test (with a prorated formula for part‑year businesses), and require specified information to be supplied within 72 hours after a qualifying cyber security incident. \n\nThey implement Part 3 of the Cyber Security Act 2024 to enable Commonwealth bodies to respond; affected critical‑infrastructure operators and businesses above the threshold must collect and disclose named incident, demand and payment details, creating immediate search and reporting obligations."},"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":3,"scope_assessment":{"changed":false,"description":"This instrument appears to be operating within its intended scope as delegated legislation under the Cyber Security Act 2024. It sets the operational details (turnover threshold and reporting requirements) that the parent Act contemplated would be prescribed by rules. There is no evidence of scope creep beyond the ransomware payment reporting scheme established by the primary legislation."},"complexity_factors":["Short instrument: only 7 sections across 2 Parts","Minimal defined terms: only 1 explicit definition ('Act'), with others incorporated by reference from the parent Cyber Security Act 2024","Simple conditional structure: single turnover threshold ($3 million) with straightforward pro-rata calculation for partial financial years","No nested exceptions or complex cross-referencing beyond basic references to parent Act provisions","Prescriptive but clear information requirements in section 7 (bullet-point lists of specific data fields)","Straightforward scope: applies to reporting business entities as defined in the Act, with threshold determined by simple formula"],"plain_english_summary":"These rules make ransomware payments in Australia reportable: critical infrastructure operators and businesses with turnover over $3 million must notify the National Cyber Security Coordinator within 72 hours of a ransom payment (including payments made by others). The aim is to give government visibility into attacks, help responses and warnings, and strengthen defences — with reported data subject to strict sharing controls."}},"importantCases":[],"_links":{"self":"/api/acts/cyber-security-ransomware-payment-reporting-rules-2025","history":"/api/acts/cyber-security-ransomware-payment-reporting-rules-2025/history","analysis":"/api/acts/cyber-security-ransomware-payment-reporting-rules-2025/analysis","conflicts":"/api/acts/cyber-security-ransomware-payment-reporting-rules-2025/conflicts","importantCases":"/api/acts/cyber-security-ransomware-payment-reporting-rules-2025/important-cases","documents":"/api/acts/cyber-security-ransomware-payment-reporting-rules-2025/documents"}}