Australian Signals Directorate — Australian Cyber Security Centre (ASD/ACSC)
Receives three separate mandatory reports on three clocks — 12 hours, 72 hours, and 72 hours again for a ransomware payment — and by law none of them satisfies an entity's obligations to any other regulator.
Responsibilities
- Receive critical cyber security incident reports within 12 hours under the SOCI Act
- Receive other cyber security incident reports within 72 hours under the SOCI Act
- Receive ransomware and cyber extortion payment reports within 72 hours under the Cyber Security Act 2024
- Provide incident response assistance
Three clocks into one body, and a fourth regime beside it.
Under the Security of Critical Infrastructure Act 2018, a responsible entity must report a critical cyber security incident within 12 hours of becoming aware, and other cyber security incidents within 72 hours. Under the Cyber Security Act 2024 and the Cyber Security (Ransomware Payment Reporting) Rules 2025, an entity that makes a ransomware or extortion payment must report it within 72 hours — a regime that commenced 30 May 2025, applies to businesses carrying on business in Australia with annual turnover above $3 million and to critical infrastructure entities regardless of turnover, and moved into compliance and enforcement from 1 January 2026.
And none of it discharges anything else. Notifications to the ACSC are in addition to any other notification an entity must make at law. The Privacy Act scheme runs in parallel and the two do not satisfy each other. See One incident, five reports, four regulators, and the law says none of them counts for the others.
The limited use obligation is a genuine reform and it is narrower than it sounds. The Cyber Security Act 2024 restricts how the National Cyber Security Coordinator may use information an entity provides, to encourage organisations to engage during an incident rather than lawyer up. It is not immunity, and it does not switch off any other obligation — which is the right design and is routinely over-read.
Where this body appears in a process
Every point at which Australian Signals Directorate — Australian Cyber Security Centre can hold something up, and why.
| Process | Step | Why it waits | Clock | Typical |
|---|---|---|---|---|
| An entity reports one cyber incident | Critical cyber security incident report notification | statutory | 1 | 1 |
| An entity reports one cyber incident | Other cyber security incident report notification | statutory | 3 | 3 |
| An entity reports one cyber incident | Ransomware or extortion payment report notification | statutory | 3 | 3 |
| An entity reports one cyber incident | Annual CIRMP report and board attestation certification | statutory | 90 | 90 |