Cyber Security Act 2024 (Australia)
Australia's Cyber Security Act 2024 (No. 98 of 2024) with its three 2025 rules: mandatory security standards for consumer smart devices (no universal default passwords, a published security-issue reporting channel, a published defined support period for security updates, statements of compliance kept five years, compliance, stop and recall notices), 72-hour ransomware payment reporting for businesses above AUD 3 million turnover and SOCI Part 2B entities, voluntary provision of significant-incident information to the National Cyber Security Coordinator under limited-use protection, and the Cyber Incident Review Board's no-fault reviews with document production powers. 31 leaves at 90 on the authorised Act and the registered rules.
Cyber Security Act 2024 (Australia) is a compliance framework from Australia (Commonwealth) with 4 domains and 31 controls that map to 2 other frameworks. The largest domains are Part 2: Security standards for smart devices (relevant connectable products) – Cyber Security Act 2024 (Australia) (14 controls), Part 5: Cyber Incident Review Board – Cyber Security Act 2024 (Australia) (9 controls), Part 3: Ransomware payment reporting – Cyber Security Act 2024 (Australia) (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
Part 2: Security standards for smart devices (relevant connectable products) – Cyber Security Act 2024 (Australia)
| Code | Title |
|---|---|
| cyber-security-act-2024-australia::13 | s 13 Application: relevant connectable products manufactured or supplied new after commencement |
| cyber-security-act-2024-australia::15(1)-(2) | s 15(1)-(2) Manufacturer must manufacture to the security standard and meet its other obligations |
| cyber-security-act-2024-australia::15(3)-(4) | s 15(3)-(4) Supplier must not supply a non-compliant product and must meet the standard's supplier obligations |
| cyber-security-act-2024-australia::16(1)-(2) | s 16(1)-(2) Manufacturer must provide a statement of compliance and retain it |
| cyber-security-act-2024-australia::16(3)-(4) | s 16(3)-(4) Supplier must supply the product with a statement of compliance and retain it |
| cyber-security-act-2024-australia::16(5) | s 16(5) Statement of compliance contents: product, manufacturer and representatives, declarations, support period, signatory |
| cyber-security-act-2024-australia::17 | s 17 Comply with a compliance notice within the specified period |
| cyber-security-act-2024-australia::18 | s 18 Comply with a stop notice after a failed compliance notice |
| cyber-security-act-2024-australia::19 | s 19 Comply with a recall notice: stop acquisition and supply, arrange return |
| cyber-security-act-2024-australia::22 | s 22 Right to internal review of a compliance, stop, recall or variation notice within 30 days |
| cyber-security-act-2024-australia::23 | s 23 Provide the product and statement of compliance for independent examination on request |
| cyber-security-act-2024-australia::Sch1-2 | s Sch1-2 Security standard: no universal default passwords |
| cyber-security-act-2024-australia::Sch1-3 | s Sch1-3 Security standard: publish how to report security issues, with acknowledgement and status updates |
| cyber-security-act-2024-australia::Sch1-4 | s Sch1-4 Security standard: publish the defined support period for security updates and never shorten it |
Part 3: Ransomware payment reporting – Cyber Security Act 2024 (Australia)
| Code | Title |
|---|---|
| cyber-security-act-2024-australia::26 | s 26 Determine whether the entity is a reporting business entity: AUD 3 million turnover or a SOCI Part 2B responsible entity |
| cyber-security-act-2024-australia::27(1) | s 27(1) Report a ransomware payment to the designated Commonwealth body within 72 hours |
| cyber-security-act-2024-australia::27(2) | s 27(2) Ransomware payment report contents: entity details, the incident and its impact, the demand, the payment, the communications |
| cyber-security-act-2024-australia::29 | s 29 Designated Commonwealth body may use a ransomware payment report only for permitted purposes and not to enforce other laws against the reporter |
| cyber-security-act-2024-australia::30 | s 30 Secondary recipients of report information: permitted purposes only, civil penalty of 60 penalty units |
Part 4: Coordination of significant cyber security incidents (National Cyber Security Coordinator) – Cyber Security Act 2024 (Australia)
| Code | Title |
|---|---|
| cyber-security-act-2024-australia::35 | s 35 Impacted entity may voluntarily provide information about a significant incident to the Coordinator |
| cyber-security-act-2024-australia::38 | s 38 Coordinator may use information about a significant incident only to assist the entity or for a permitted cyber security purpose |
| cyber-security-act-2024-australia::40 | s 40 Secondary recipients of Coordinator information: permitted purposes only, civil penalty of 60 penalty units |
Part 5: Cyber Incident Review Board – Cyber Security Act 2024 (Australia)
| Code | Title |
|---|---|
| cyber-security-act-2024-australia::46 | s 46 Reviews only on written referral, against the criteria, after the incident and immediate response have ended, under Minister-approved terms of reference |
| cyber-security-act-2024-australia::49 | s 49 Produce documents to the Board within at least 14 days of a notice, civil penalty of 60 penalty units |
| cyber-security-act-2024-australia::51 | s 51 Prepare a draft review report, give it to the Minister and invite submissions within a reasonable period |
| cyber-security-act-2024-australia::52 | s 52 Final review report: findings, evidence summary, recommendations with reasons, no blame, liability or identification, published |
| cyber-security-act-2024-australia::53 | s 53 Redact sensitive review information and prepare a protected review report for the Minister and Prime Minister |
| cyber-security-act-2024-australia::55 | s 55 Board may use information it receives only for review functions and permitted purposes, not to enforce other laws against the provider |
| cyber-security-act-2024-australia::56 | s 56 Secondary recipients of review information: permitted purposes only, civil penalty of 60 penalty units |
| cyber-security-act-2024-australia::59 | s 59 Do not disclose or use a draft review report, civil penalty of 60 penalty units |
| cyber-security-act-2024-australia::76 | s 76 Annual report to include the Board's reviews, discontinuances, refused terms of reference and Expert Panel numbers |
Maps to 2 other frameworks
Coverage is not the same as your position
This page shows what Cyber Security Act 2024 (Australia) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Cyber Security Act 2024 (Australia) and who does it apply to?
Cyber Security Act 2024 (Australia) is a compliance framework from Australia (Commonwealth) with 4 domains and 31 controls. Australia's Cyber Security Act 2024 (No. 98 of 2024) with its three 2025 rules: mandatory security standards for consumer smart devices (no universal default passwords, a published security-issue reporting channel, a published defined support period for security updates, statements of compliance kept five years, compliance, stop and recall notices), 72-hour ransomware payment reporting for businesses above AUD 3 million turnover and SOCI Part 2B entities, voluntary provision of significant-incident information to the National Cyber Security Coordinator under limited-use protection, and the Cyber Incident Review Board's no-fault reviews with document production powers. 31 leaves at 90 on the authorised Act and the registered rules. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Cyber Security Act 2024 (Australia) actually require?
Cyber Security Act 2024 (Australia) has 31 controls organised across 4 domains. The largest domains are Part 2: Security standards for smart devices (relevant connectable products) – Cyber Security Act 2024 (Australia) (14 controls), Part 5: Cyber Incident Review Board – Cyber Security Act 2024 (Australia) (9 controls), Part 3: Ransomware payment reporting – Cyber Security Act 2024 (Australia) (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Cyber Security Act 2024 (Australia) do I already cover?
Cyber Security Act 2024 (Australia) maps to 2 other compliance frameworks. The top mapping partners are Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 (4% coverage), NIST Cybersecurity Framework 2.0 (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Cyber Security Act 2024 (Australia)?
Start your Cyber Security Act 2024 (Australia) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Cyber Security Act 2024 (Australia) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 31 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required