An entity reports one cyber incident

Five reports, four bodies, four clocks — 12 hours, 72 hours, 72 hours, 72 hours and 30 days — and the guidance says explicitly that none of them satisfies any of the others. The elapsed time is short and the concurrency is the point.

businessOne serious intrusion at a regulated Australian entity that holds personal information and operates a critical infrastructure asset draft compare across jurisdictions

127 days elapsed
longest dependent chain

8 discrete steps
across 3 bodies

0% waiting on availability
scheduling or queue, not assessment

4 days saved by concurrency
vs. 131 if run end-to-end

Where the time goes

Critical-path days only. Steps that run alongside others are real work but do not lengthen the process, so counting them here would overstate the prize.

statutory		127d	A legislated period that must elapse regardless of readiness.

The process, step by step

Applies when: An entity becomes aware of a cyber security incident affecting a critical infrastructure asset or personal information.

#	Step	Who	Why it waits	Clock	Typical	Basis
1	The entity becomes aware of an incident assessment Every clock in this process starts here, and they run at different speeds.	—	assessment	—	0 legislated	—
2	Critical cyber security incident report notification Twelve hours from becoming aware, for an incident having a significant impact on a critical infrastructure asset. after The entity becomes aware of an incident 126d slack	Australian Signals Directorate — Australian Cyber Security Centre	statutory	1	1 legislated	Security of Critical Infrastructure Act 2018 (Cth)
3	Other cyber security incident report notification Seventy-two hours, for incidents with a relevant impact that are not critical. after The entity becomes aware of an incident 124d slack	Australian Signals Directorate — Australian Cyber Security Centre	statutory	3	3 legislated	Security of Critical Infrastructure Act 2018 (Cth)
4	APRA material incident notification notification only if triggered Seventy-two hours, on a materiality test defined by depositor, policyholder and beneficiary interests. Triggered when: The entity is APRA-regulated — a bank, insurer or superannuation fund. after The entity becomes aware of an incident 124d slack	Australian Prudential Regulation Authority	statutory	3	3 legislated	APRA Prudential Standard CPS 234
5	Ransomware or extortion payment report notification only if triggered Seventy-two hours after a payment is made, for entities above $3 million turnover and all critical infrastructure entities. Triggered when: A ransomware or cyber extortion payment is made, and the entity has annual turnover above $3 million or is responsible for a critical infrastructure asset. after The entity becomes aware of an incident 124d slack	Australian Signals Directorate — Australian Cyber Security Centre	statutory	3	3 legislated	Cyber Security Act 2024 (Cth)
6	Assess whether it is an eligible data breach assessment Thirty days to assess a suspected breach — the longest clock, and the only one asking about harm to individuals. after The entity becomes aware of an incident 97d slack	Office of the Australian Information Commissioner	statutory	30	30 legislated	Privacy Act 1988 (Cth)
7	Notify the OAIC and affected individuals notification As soon as practicable once the breach is assessed as eligible. after Assess whether it is an eligible data breach 90d slack	Office of the Australian Information Commissioner	statutory	—	7 legislated	Privacy Act 1988 (Cth)
8	Annual CIRMP report and board attestation certification Ninety days after financial year end — 28 September for a 30 June year end. after Notify the OAIC and affected individuals	Australian Signals Directorate — Australian Cyber Security Centre	statutory	90	90 legislated	Security of Critical Infrastructure Act 2018 (Cth)

on the critical path scheduling/queue = delay not caused by the assessment itself

Proposed changes

One incident, five reports, four regulators, and the law says none of them counts for the others merge
A regulated Australian entity suffering one intrusion owes a 12-hour report to ASD, a 72-hour report to ASD, a 72-hour report to APRA, a 72-hour ransomware payment report to ASD again, and a Privacy Act assessment and notification. The guidance states explicitly that these do not satisfy each other.
Twelve hours, written by the people currently containing the intrusion resequence
A critical cyber security incident must be reported within 12 hours of the entity becoming aware. At twelve hours an organisation usually does not know what happened, and the people who could find out are the people writing the report.

Sources

Security of Critical Infrastructure Act 2018 (Cth): critical cyber security incidents reportable within 12 hours of becoming aware; other cyber security incidents within 72 hours
Privacy Act 1988 (Cth), Notifiable Data Breaches scheme: assess and notify as soon as practicable and within 30 days of becoming aware
Cyber Security Act 2024 (Cth) and Cyber Security (Ransomware Payment Reporting) Rules 2025: ransomware payment reportable within 72 hours; commenced 30 May 2025; enforcement from 1 January 2026
APRA Prudential Standard CPS 234: notify APRA as soon as possible and no later than 72 hours after becoming aware of a material information security incident
The OAIC 30-day rule does not replace SOCI incident reporting; the regimes run in parallel and do not satisfy each other
Notifications to the ACSC are in addition to any other notifications the entity may be required to make at law

Something wrong here?

This page is wrong in some way -- every page like it is. If you have run this process, the most useful thing you can do is tell us which step took longer than we say and why. Edit data/processes/au-cyber-incident-reporting.toml and open a pull request, or send us the correction.