Cyber Security Act 2024 (Cth)

Cyber Security Act 2024

No. 98, 2024

An Act relating to cyber security for Australians, and for other purposes

Contents Part 1—Preliminary 1 Short title 2 Commencement 3 Objects 4 Simplified outline of this Act 5 Extraterritoriality 6 Act binds the Crown 7 Concurrent operation of State and Territory laws 8 Definitions 9 Meaning of cyber security incident 10 Meaning of permitted cyber security purpose 11 Disclosure to State body Part 2—Security standards for smart devices Division 1—Preliminary 12 Simplified outline of this Part 13 Application of this Part Division 2—Security standards for relevant connectable products 14 Security standards for relevant connectable products 15 Compliance with security standard for a relevant connectable product 16 Obligation to provide and supply products with a statement of compliance with security standard Division 3—Enforcement 17 Compliance notice 18 Stop notice 19 Recall notice 20 Public notification of failure to comply with recall notice Division 4—Miscellaneous 21 Revocation and variation of notices given under this Part 22 Internal review of decision to give compliance, stop or recall notice 23 Examination to assess compliance with security standard and statement of compliance 24 Acquisition of property Part 3—Ransomware reporting obligations Division 1—Preliminary 25 Simplified outline of this Part Division 2—Reporting obligations 26 Application of this Part 27 Obligation to report following a ransomware payment 28 Liability Division 3—Protection of information 29 Ransomware payment reports may only be used or disclosed for permitted purposes 30 Limitations on secondary use and disclosure of information in ransomware payment reports 31 Legal professional privilege 32 Admissibility of information in ransomware payment report against reporting business entity Part 4—Coordination of significant cyber security incidents Division 1—Preliminary 33 Simplified outline of this Part 34 Meaning of significant cyber security incident Division 2—Voluntary information sharing with the National Cyber Security Coordinator 35 Impacted entity may voluntarily provide information to National Cyber Security Coordinator in relation to a significant cyber security incident 36 Voluntary provision of information in relation to other incidents or cyber security incidents 37 Role of the National Cyber Security Coordinator Division 3—Protection of information 38 Information provided in relation to a significant cyber security incident—use and disclosure by National Cyber Security Coordinator 39 Information provided in relation to other incidents—use and disclosure by National Cyber Security Coordinator 40 Limitations on secondary use and disclosure 41 Legal professional privilege 42 Admissibility of information voluntarily given by impacted entity 43 National Cyber Security Coordinator not compellable as witness Division 4—Miscellaneous 44 Interaction with other requirements to provide information in relation to a cyber security incident Part 5—Cyber Incident Review Board Division 1—Preliminary 45 Simplified outline of this Part Division 2—Reviews 46 Board must cause reviews to be conducted 47 Board may discontinue a review 48 Chair may request information or documents 49 Chair may require certain entities to produce documents 50 Civil penalty—failing to comply with a notice to produce documents 51 Draft review reports 52 Final review reports 53 Certain information must be redacted from final review reports 54 Protected review reports Division 3—Protection of information relating to reviews 55 Limitations on use and disclosure by the Board 56 Limitations on secondary use and disclosure 57 Legal professional privilege 58 Admissibility of information given by an entity that has been requested or required by the Board 59 Disclosure of draft review reports prohibited Division 4—Establishment, functions and powers of the Board 60 Cyber Incident Review Board 61 Constitution of the Board 62 Functions of the Board 63 Independence Division 5—Terms and conditions of appointment of the Chair and members of the Board 64 Appointment of Chair 65 Remuneration of the Chair 66 Appointment of standing members of the Board 67 Remuneration of standing members of the Board 68 Acting Chair 69 Terms and conditions etc. for standing members Division 6—Expert Panel, staff assisting and consultants 70 Expert Panel 71 Arrangements relating to staff of the Department 72 Consultants Division 7—Other matters relating to the Board 73 Board procedures 74 Liability 75 Certification of involvement in review 76 Annual report 77 Rules may prescribe reporting requirements etc. Part 6—Regulatory powers Division 1—Preliminary 78 Simplified outline of this Part Division 2—Civil penalty provisions, enforceable undertakings and injunctions 79 Civil penalty provisions, enforceable undertakings and injunctions Division 3—Monitoring and investigation powers 80 Monitoring powers 81 Investigation powers Division 4—Infringement notices 82 Infringement notices Division 5—Other matters 83 Contravening a civil penalty provision Part 7—Miscellaneous 84 Simplified outline of this Part 85 How this Act applies in relation to non‑legal persons 86 Delegation by Secretary 87 Rules 88 Review of this Act