Cyber Security (Ransomware Payment Reporting) Rules 2025 (Cth)

Cyber Security (Ransomware Payment Reporting) Rules 2025 I, Tony Burke, Minister for Home Affairs, make the following rules.

Dated 27 February 2025

Tony Burke Minister for Home Affairs

Contents Part 1—Preliminary 1 Name 2 Commencement 3 Authority 4 Definitions Part 2—Ransomware payment reporting obligations 5 Simplified outline of this Part 6 Turnover threshold 7 Requirements for information that ransomware payment report must contain

Part 1—Preliminary

1 Name This instrument is the Cyber Security (Ransomware Payment Reporting) Rules 2025.

2 Commencement (1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Commencement information Column 1 Column 2 Column 3 Provisions Commencement Date/Details 1. The whole of this instrument The later of: (a) at the start of the day after this instrument is registered; and (b) at the same time as Part 3 of the Cyber Security Act 2024 commences.

Note: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument. (2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.

3 Authority This instrument is made under the Cyber Security Act 2024.

4 Definitions Note: A number of expressions used in this instrument are defined in the Act, including the following: (a) cyber security incident; (b) ransomware payment; (c) reporting business entity. In this instrument: Act means the Cyber Security Act 2024.