Ransomware-Payment Report Template for Startups

Any “reporting business entity”: a business carrying on business in Australia with annual turnover of AU$3 million or more, or a responsible entity for a critical infrastructure asset. If a third party pays on your behalf, the obligation still applies to you.

Within 72 hours of making the payment, or within 72 hours of becoming aware that a payment was made on your behalf.

Through the Australian Signals Directorate portal on cyber.gov.au. The template on this page helps you collect the required details in the right order before lodgement.

Agencies may use it only for permitted purposes set out in the Act, such as assisting incident response. Legal professional privilege is preserved, and information is generally not admissible against your business in most proceedings. Voluntary briefings to the National Cyber Security Coordinator are subject to Limited Use protections.

No. Continue your incident plan for containment, recovery, notifications and any other legal or contractual duties. The template simply helps you prepare a complete ASD lodgement on time.