30 May 2025. From this date, Part 3 of the Cyber Security Act 2024 requires eligible entities to lodge a ransomware or cyber extortion payment report within 72 hours.

Any “reporting business entity”: a business carrying on business in Australia with annual turnover of AU$3 million or more, or a responsible entity for a critical infrastructure asset. If a third party pays on your behalf, the obligation still applies to you.

Within 72 hours of making the payment, or within 72 hours of becoming aware that a payment was made on your behalf.

Agencies may use it only for permitted purposes set out in the Act, such as assisting incident response. Legal professional privilege is preserved, and information is generally not admissible against your business in most proceedings. Voluntary briefings to the National Cyber Security Coordinator are subject to Limited Use protections.

No. Continue your incident plan for containment, recovery, notifications and any other legal or contractual duties. The template simply helps you prepare a complete ASD lodgement on time.