One incident, five reports, four regulators, and the law says none of them counts for the others
A regulated Australian entity suffering one intrusion owes a 12-hour report to ASD, a 72-hour report to ASD, a 72-hour report to APRA, a 72-hour ransomware payment report to ASD again, and a Privacy Act assessment and notification. The guidance states explicitly that these do not satisfy each other.
Steps this would change
- An entity reports one cyber incident — Other cyber security incident report
- An entity reports one cyber incident — APRA material incident notification
- An entity reports one cyber incident — Ransomware or extortion payment report
- An entity reports one cyber incident — Assess whether it is an eligible data breach
Rationale
This is the cleanest duplication finding in the database, and it is clean because the duplication is documented rather than inferred.
One intrusion, at a bank that operates a critical infrastructure asset and holds personal information:
| Report | To | Clock |
|---|---|---|
| Critical cyber security incident (SOCI) | ASD/ACSC | 12 hours |
| Other cyber security incident (SOCI) | ASD/ACSC | 72 hours |
| Material information security incident (CPS 234) | APRA | 72 hours |
| Ransomware or extortion payment (Cyber Security Act 2024) | ASD/ACSC | 72 hours |
| Eligible data breach assessment and notification | OAIC and individuals | 30 days, then as soon as practicable |
| CIRMP annual report and board attestation | Cyber and Infrastructure Security Centre | 90 days after year end |
And the position is stated, not accidental. The OAIC's 30-day rule does not replace SOCI incident reporting; the regimes run in parallel and do not satisfy each other. Notifications to the ACSC are in addition to any other notification required at law. Nobody is confused about this. It is the design.
The defence of the design is real and should be stated first. The regulators are asking genuinely different questions. SOCI asks whether an asset that matters to the nation was affected. The Privacy Act asks whether individuals face a risk of serious harm. CPS 234 asks whether depositors and policyholders were exposed. Three questions, three mandates, three sets of expertise — and a single merged question would answer none of them properly.
But that is an argument against one question, not against one lodgement.
What should change:
- One lodgement, distributed by the receiver. A single structured report, submitted once to one Commonwealth endpoint, with the fields each regulator needs, routed automatically. The entity files once; the regulators each get what their mandate requires. This is a plumbing problem, and every one of these bodies is a Commonwealth body except the state privacy regulators.
- A deeming provision. Lodgement through the common channel satisfies the obligation to each regulator whose fields were completed — so an entity is not compliant-in-spirit and in breach in fact.
- Align the 72-hour clocks. Three separate 72-hour obligations, running from three different definitions of awareness, is a compliance trap and not a safeguard. One trigger definition for the three-day reports would cost nothing in regulatory reach.
The 30-day Privacy Act assessment should stay where it is, because it is doing something different — determining whether individuals are at risk of serious harm is not an incident report, and rushing it produces worse notifications to the people who actually need them.
Who acts: the Commonwealth, across Home Affairs, the Treasury portfolio and the Attorney-General's portfolio. No state legislation is required for the Commonwealth reports.
Days saved: zero, and deliberately so. Nothing here shortens a statutory clock. The cost being removed is not elapsed time; it is the diversion of the small number of people who understand the incident, during the hours they are containing it, into writing four documents for four audiences.
What is being traded away
A single front door creates a single point of failure at exactly the wrong moment. If the common channel is unavailable — including because the reporting entity's own connectivity is compromised, which is the whole scenario — four obligations fail together rather than one. Any such system needs fallbacks that are themselves compliant, which is most of the engineering.
Regulators will not accept fields they did not design. The reason these regimes diverge is that each was built by a body with its own statutory purpose, and each will reasonably insist on asking its own question in its own words. A merged form tends toward the union of all requirements rather than the intersection — which would make the single report longer than any current one, and this proposal worse than the status quo.
Information routed automatically is information shared automatically. An entity currently makes deliberate decisions about what goes to which regulator, partly because a report to one can become evidence for another's enforcement action. The limited use obligation exists precisely because that chilling effect is real — and a distribution hub would need equivalent walls, or it will reduce candour rather than burden.
And this database should be honest that the burden here is not measured. The process models at 127 days with zero addressable time — every day is a statutory clock, and the critical path is entirely the Privacy Act assessment followed by the annual CIRMP report. The cost of multiple reporting is real, it is concentrated in the first 72 hours, and it is not elapsed time. No number on this page quantifies it, and none is published.
Precedent
The limited use obligation in the Cyber Security Act 2024 already establishes that information can flow into one Commonwealth channel under defined handling rules. The architecture for a single front door exists; it is being used for one regulator rather than for the reporting entity.
Sources
- Security of Critical Infrastructure Act 2018 (Cth): critical cyber security incidents reportable within 12 hours, other cyber security incidents within 72 hours
- APRA Prudential Standard CPS 234: notify APRA no later than 72 hours after becoming aware of a material information security incident
- Cyber Security Act 2024 (Cth) and Cyber Security (Ransomware Payment Reporting) Rules 2025: ransomware payment reportable within 72 hours; commenced 30 May 2025; enforcement from 1 January 2026
- Privacy Act 1988 (Cth): assess and notify as soon as practicable and within 30 days of becoming aware of an actual or suspected eligible data breach
- The OAIC 30-day rule does not replace SOCI incident reporting; the regimes run in parallel and do not satisfy each other
- Notifications to the ACSC are in addition to any other notifications the entity may be required to make at law
- Cyber Security Act 2024 (Cth), Part 4 Division 3: the limited use obligation; limited use is not immunity and does not switch off other obligations
- CIRMP annual report due within 90 days of financial year end; civil penalty of 150 penalty units for failure to lodge