Twelve hours, written by the people currently containing the intrusion
A critical cyber security incident must be reported within 12 hours of the entity becoming aware. At twelve hours an organisation usually does not know what happened, and the people who could find out are the people writing the report.
Steps this would change
Rationale
Filed as an idea, and written mostly against itself, because the obvious criticism here is probably wrong.
The obvious criticism: twelve hours is unreasonable. A serious intrusion at hour twelve is a set of alerts, a partial picture, and a small team doing triage. The staff capable of writing an accurate report are the same staff containing the breach. Every hour spent on a regulatory narrative is an hour not spent on containment, and the report produced will be wrong in ways that have to be corrected later anyway.
The answer to that criticism is good, and this entry accepts it. ASD is not reading these reports to assess the entity. It is looking for the pattern across entities — the same actor, the same vulnerability, the same infrastructure — so it can warn the next twenty organisations before they are hit. For that purpose an early, vague, partially wrong report has substantial value, and a complete accurate report at day five has almost none. The twelve hours is not about this incident. It is about the next one.
That reframing changes what the reform should be. Not a longer clock — a smaller first report.
What should change:
- Make the 12-hour obligation explicitly minimal in the rules. What was observed, what system, what indicators, who to contact. A structured handful of fields, expressly not requiring assessment, causation, scope or impact. Anything an entity cannot know at hour twelve should not be a field at hour twelve.
- Put the substantive account on the 72-hour report, which already exists as a separate obligation and is currently a different report about different incidents rather than a later stage of the same one.
- Say plainly that a first report may be wrong. The single largest deterrent to fast reporting is the fear that an early, incorrect statement becomes an enforcement exhibit. The limited use obligation addresses part of this for the National Cyber Security Coordinator; the 12-hour SOCI report needs the same comfort, and limited use is not immunity and does not switch off other obligations — which entities' lawyers know.
None of this is a deregulation argument. It keeps the clock, keeps the obligation and keeps the penalty. It changes what is owed at hour twelve so that the obligation matches what an organisation can truthfully produce while the incident is still running.
Days saved: zero. As with everything in the reporting stack, the cost here is not elapsed time. It is the attention of the few people who can actually fix the problem.
What is being traded away
A minimal first report may be minimal in the wrong direction. If the rules say only a handful of fields are required at twelve hours, some entities will supply only those fields at seventy-two hours too, and at day ten. The current open-ended obligation at least creates pressure to say what is known. Reducing the ask is not free.
"It's about the next one" is an argument for more early reporting, not less. Taken seriously, the pattern-detection rationale suggests the threshold should be lower and the population broader — every entity, not only responsible entities for critical infrastructure assets. This entry proposes making the first report easier to file; a consistent application of its own reasoning might well propose making more people file it.
This entry has no evidence about what entities actually experience at hour twelve. It reasons from the structure of incident response and from the timeframes in the instruments. No Australian data on 12-hour report quality, volume, correction rates or compliance cost is published — which is a gap worth naming, and it means the argument here is analytical rather than empirical.
And the regulator has just moved into enforcement. Ransomware payment reporting moved from education to compliance and enforcement on 1 January 2026, and the CIRMP annual report carries a civil penalty of 150 penalty units. Proposing to soften what is owed in the first twelve hours, in the year enforcement begins, is an argument that will be read as industry lobbying whether or not it is right — which is a reason to make it carefully, not a reason not to make it.
Precedent
The Cyber Security Act 2024's limited use obligation is the same insight applied to a different problem: it lowers the cost of talking to government during an incident. A staged report does the same thing for the clock.
Sources
- Security of Critical Infrastructure Act 2018 (Cth): a responsible entity must report a critical cyber security incident within 12 hours of becoming aware, and other cyber security incidents within 72 hours
- Cyber Security Act 2024 (Cth), Part 4 Division 3: the limited use obligation applies to the National Cyber Security Coordinator; limited use is not immunity and does not switch off other obligations
- Phase 2 compliance and enforcement of ransomware payment reporting begins from 1 January 2026
- CIRMP annual report: civil penalty of 150 penalty units for failure to lodge by the deadline