Aviation Transport Security (Incident Reporting) Instrument 2026
I, Matthew Pedler, Delegate of Secretary of the Department of Home Affairs, make the following instrument.
Dated 26 March 2026
Matthew Pedler
Acting First Assistant Secretary Critical Infrastructure Partnerships and Policy Division Critical Infrastructure and Protective Security Group National Security Group
Department of Home Affairs
Contents
Part 1—Preliminary
1 Name
2 Commencement
3 Authority
4 Definitions
5 Schedules
Part 2—Reporting requirements
6 Information that must be included in a security incident report
7 Way in which a security incident report is to be made
8 Information that must be included in a cyber security incident report
9 Way in which a cyber security incident report is made
Part 3—Transitional and application provisions
10 Reporting requirements—application
Schedule 1—Repeals
Aviation Transport Security (Incident Reporting) Instrument 2018
Part 1—Preliminary
1 Name
This instrument is the Aviation Transport Security (Incident Reporting) Instrument 2026.
2 Commencement
This instrument commences on the later of:
(a) the day after the instrument is registered; and
(b) immediately after the commencement of Part 1 of Schedule 1 to the Transport Security Amendment (Security of Australia’s Transport Sector) Act 2025.
3 Authority
This instrument is made under subsection 107(1) of the Aviation Transport Security Act 2004.
4 Definitions
Note: A number of expressions used in this instrument are defined in the Act, including the following:
(a) aircraft;
(b) aviation industry participant;
(c) aviation security incident;
(d) cyber security incident;
(e) in flight;
(f) relevant impact;
(g) significant impact;
(h) unlawful interference with aviation.
In this instrument:
Act means the Aviation Transport Security Act 2004.
cyber security incident report means a report required to be made to the Secretary under Part 6 of the Act for a cyber security incident.
Department means the Department of Home Affairs.
industry participant means an aviation industry participant.
relevant cyber security incident means a cyber security incident that has a relevant impact.
security incident means an aviation security incident.
security incident report means a report required to be made to the Secretary under Part 6 of the Act in relation to a security incident.
significant cyber security incident means a cyber security incident that has a significant impact.
unlawful interference means unlawful interference with aviation.
5 Schedules
Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.
Part 2—Reporting requirements
6 Information that must be included in a security incident report
(1) For the purposes of paragraph 107(1)(a) of the Act, this section specifies information that a security incident report must include.
General reporting requirements
(2) The following information must be included in a security incident report:
(a) the name, contact number, and email address of the person making the report;
(b) the title or position held by the person making the report;
(c) the name of the employer of the person making the report (where applicable);
(d) the date of the report;
(e) the date and time the security incident commenced;
(f) the date and time the security incident ceased;
(g) the location of the security incident (including, where applicable, the name and address of the location where the security incident occurred);
(h) the industry participant or participants to whom the security incident relates;
(i) the industry participant or participants who are affected as a result of the security incident;
(j) whether the report is a result of a routine security inspection; and
(k) a detailed description of the security incident, including an indication as to whether the incident was or is:
(i) a threat of unlawful interference; or
(ii) an unlawful interference;
(l) the steps the industry participant has taken, or is in the process of taking, to ensure the security incident does not occur again; and
(m) where subsection (3), (4), (5), (6), (7) or (8) applies – information that is specified in that subsection.
Note: If, at the time of reporting, any of the required information under subsection 6(2) is not able to be provided, subsection 7(2) sets out requirements in relation to providing further information.
Incident involving a threat of unlawful interference
(3) If the security incident was or is a threat of unlawful interference, the following information must also be included in the report:
(a) the name and contact details of the person who received the threat;
(b) the details of the threat;
(c) whether the threat is assessed as genuine or as a hoax and how that assessment has been made; and
(d) whether the person who made the threat attempted, is in the process of committing, or completed the act of unlawful interference.
Incident involving an aircraft
(4) If the security incident involved, or involves, an aircraft, the following information must also be included in the report:
(a) the aircraft type;
(b) the flight number;
(c) whether or not the aircraft was in flight at the time of the security incident; and
(d) the type of cargo on board (if applicable).
Incident involving a building or other infrastructure
(5) If the security incident involved, or involves, a building or other infrastructure, information that is sufficient to identify the building or other infrastructure must also be included in the report.
Incidents previously reported to the Secretary
(6) If the person making the report is aware that the security incident has previously been reported to the Secretary, the following information must also be included in the report:
(a) the approximate time and date on which the security incident was reported; and
(b) the name or position of the person to whom, or the name of the area in the Department to which, the incident was reported.
Incidents previously reported to the police, an industry participant, or any other body
(7) If the security incident has been reported to the police, an industry participant, or any other body, the following information must also be included in the report:
(a) the approximate time and date on which the security incident was reported; and
(b) the name and contact information of the person to whom the incident was reported, or a relevant engagement identifier such as a case number, incident report number or other relevant identifier.
Incident brought to the attention of an industry participant by a third party
(8) If the report is a result of a security incident that has been brought to the attention of the person making the report by a third party, the following information must also be included in the report:
(a) a statement that the report is a result of notification from a third party; and
(b) the name, and where applicable, name of the employer, of the third party.
7 Way in which a security incident report is to be made
(1) Once an industry participant becomes aware that a security incident has occurred, or is occurring, the industry participant must make the security incident report to the Secretary as soon as possible, but no later than 24 hours after they first become aware of the incident.
(2) If at the time of making the security incident report, the industry participant does not have any or part of the information that is required under section 6, but subsequently obtains that information, the industry participant must provide that information to the Secretary in a report by one of the ways specified in (3) as soon as possible, but not later than 24 hours after obtaining the information.
(3) A security incident report must be made in one of the following ways:
(4) If a security incident report is first made in the way specified in paragraph (3)(a), the industry participant must, within 24 hours of making that report, also provide the information required under section 6 in a way specified in either paragraph (3)(b) or (c).
8 Information that must be included in a cyber security incident report
(1) For the purposes of paragraph 107(1)(a) of the Act, this section specifies information that a cyber security incident report must include.
(2) The following information must be included in a cyber security incident report:
(a) the name, contact number, and email address of the person making the report;
(b) the name of the employer of the person making the report (if applicable);
(c) the state or territory and postcode of the employer of the person making the report;
(d) the date and time the incident was identified;
(e) whether the incident is ongoing at the time the report is made;
(f) the nature or type of cyber security incident that is occurring or has occurred; and
(g) a detailed description of the cyber security incident that is occurring or has occurred.
Note: If, at the time of reporting, any of the required information specified in subsection 8(2) is not able to be provided, subsection 9(4) sets out requirements in relation to providing further information in the specified way.
9 Way in which a cyber security incident report is made
(1) A cyber security incident report must be made online via the Australian Cyber Security Centre’s reporting portal.
Note: The Australian Cyber Security Centre’s reporting portal can be accessed via Report | Cyber.gov.au as on the commencement day of this instrument.
(2) If a cyber security incident report is made in accordance with subsection (1) and the industry participant has not given consent to share the cyber security incident report with the Secretary, the information must also be submitted to the Secretary online via the Department’s form:
(3) If a report is made to the Secretary in the way specified in subsection (2), this is to be done as soon as possible after the incident is identified, and in any event within:
(a) 12 hours of the industry participant becoming aware of the incident, if it is a significant cyber security incident; or
(b) 72 hours of an industry participant becoming aware of the incident, if it is a relevant cyber security incident.
(4) If at the time of making a cyber security incident report, the industry participant does not have any, or part, of the information required under section 8, but subsequently obtains that information, the industry participant must provide that information in a report by the way specified in subsection (1) as soon as possible, but not later than 24 hours after obtaining the information.
(5) If information is provided in accordance with subsection (4), and consent is not given to share the information with the Secretary, the information must be provided to the Secretary in the way specified in subsection (2) as soon as possible, but not later than 24 hours after the industry participant obtains the information.
Part 3—Transitional and application provisions
10 Reporting requirements—application
This instrument applies in relation to:
(a) a report made in accordance with Division 4 of Part 6 of the Act (a Division 4 report) on or after the day this instrument commences; and
(b) if additional information is to be provided to the Secretary in connection with a Division 4 report made before this instrument commences—that additional information.
Schedule 1—Repeals
Aviation Transport Security (Incident Reporting) Instrument 2018