Security of Critical Infrastructure Act 2018 (SOCI) s30BD: Report other cyber security incidents with a relevant impact within 72 hours

What does s30BD require?

When the responsible entity becomes aware that a cyber security incident has occurred, is occurring or is imminent and has had, is having or is likely to have a relevant impact (availability, integrity, reliability, or confidentiality of information about or in the asset) on the asset, it must report to ASD as soon as practicable and within 72 hours, with any prescribed information; an oral report needs a written record in the approved form within 48 hours unless exempted.