Paid a Ransom? You Have 72 Hours to Tell ASD. What the Cyber Security Act Requires, and the Decision Your Board Must Make Before the Clock Starts

A ransomware demand puts a board in the worst possible position to make a good decision: incomplete facts, a countdown from the attacker, and a legal obligation that starts the moment money moves. Since 30 May 2025 that obligation has been law. Under the Cyber Security Act 2024, an Australian business with annual turnover above $3 million, or any responsible entity for a critical infrastructure asset, must report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours, or face a civil penalty. The organisations that handle this well are the ones that decided how they would handle it before the demand arrived. CISO Advisory helps boards make those decisions in advance, and sits in the room when the clock is running; talk to us or call 07 2112 8502 any time.

What the law says

MinterEllison’s summary of the obligations now in force sets out the mechanics. From 30 May 2025, “reporting business entities” must report ransomware and cyber extortion payments. The obligation applies to entities carrying on business in Australia with annual turnover exceeding the threshold set by the rules, $3 million, and to responsible entities for critical infrastructure assets under the SOCI Act. Commonwealth and state bodies are excluded, and small businesses under the threshold are exempt.

The report must be made “within 72 hours of making the payment (or becoming aware of a ransomware payment having been made)”. That second limb matters: if an insurer, a negotiator or a parent company pays on your behalf, your 72 hours start when you become aware of it.

There is no minimum amount. Every payment or benefit provided in response to a ransomware or cyber extortion demand is reportable.

The penalty for failing to report is a civil penalty of up to 60 penalty units, currently $19,800, per contravention. MinterEllison notes there are no grace periods for compliance.

What the report has to contain

The report goes to ASD through the Australian Cyber Security Centre’s online portal. Keypoint Law’s analysis of the reporting rules describes the content as extensive: details of the incident and its impact on your infrastructure and customers, the demand made by the extorting party, the quantum and method of payment, and the communications with the extortionist. MinterEllison adds the standard you are held to: you must share what you “know or are able, by reasonable search or enquiry, to find out”.

That is a lot to assemble in 72 hours while your systems are down and your executives are exhausted. It is only achievable if the information was being captured from the first hour of the incident, which is an incident-response design question, not a compliance one.

The protections, and their limits

The Act attaches limited-use protections to what you report. Both firms describe them the same way: designated Commonwealth bodies may use the information only for permitted purposes such as responding to the incident, exercising powers under the Act, or intelligence functions; use in civil or regulatory proceedings against you is prohibited with narrow exceptions, and legal professional privilege is preserved. Keypoint Law also notes qualified inadmissibility in legal proceedings.

Those protections make reporting safer than many boards assume. They do not make paying safe. The report does not shield the payment decision itself from scrutiny by shareholders, insurers, regulators under other laws, or the public.

The obligation nobody mentions in the same breath

A ransomware event is almost always also a data breach. If personal information was accessed or taken, the Notifiable Data Breaches scheme under the Privacy Act requires you to assess quickly whether the breach is likely to result in serious harm, and to notify the OAIC and affected individuals if it is. That runs on its own clock, to a different regulator, with its own statement requirements. APRA-regulated entities have CPS 234 notification duties on top. A board that treats the 72-hour ransomware report as the only deadline will miss the others.

The decisions to make before the demand arrives

Every one of these is harder under attack and straightforward in a boardroom on a normal Tuesday.

1. Whether you would ever pay, and who decides. Some organisations decide in advance that they will not pay; others reserve the decision for the board with defined criteria (life safety, business survival, legal advice). Either is defensible. Deciding it live, with an attacker’s timer on screen, is not.

2. Who owns the 72-hour report. Name the person, name the deputy, and confirm they know where the portal is and what it asks for. Then confirm someone is capturing the facts the report needs from hour one.

3. Who is allowed to pay on your behalf. Insurers and negotiators can trigger your obligation without your active involvement. Your policy and your negotiator’s engagement terms should require immediate notice to you of any payment.

4. How the ransomware, privacy and prudential clocks are coordinated. One incident lead, one timeline, three regulators.

5. Whether you are in scope at all, and whether that will change. Turnover above $3 million captures most mid-sized Australian businesses. If you are near the line, or a critical infrastructure supplier, assume you are in.

6. Whether your controls make the question less likely to arise. Offline, tested backups; multi-factor authentication on every remote and privileged access; patched internet-facing systems; restricted admin rights. The Essential Eight exists because these are the controls that stop most ransomware from getting far enough to matter.

A tabletop, not a policy

The fastest way to find the gaps is a two-hour tabletop exercise with the executive team and the board’s risk chair: a realistic ransomware scenario, the demand, the insurer on the phone, the 72-hour report to draft, the OAIC assessment to run. Organisations that do this discover, in a safe room, which decisions they cannot currently make and which information they cannot currently produce. That is the whole point.

How CISO Advisory helps

CISO Advisory Australia is independent and senior-led, with no products to sell. We help boards and executives set the ransomware payment position in advance, design the incident-response process so the 72-hour report can actually be produced, coordinate the ransomware, privacy and CPS 234 obligations into one plan, and run the tabletop that proves it works. Our virtual CISO retainers include incident-response leadership on call at the Enterprise tier, and an Essential Eight assessment is the fastest way to reduce the odds you ever need the report; fixed fees are on the pricing page.

If you cannot say today who in your organisation would file the ransomware report and what they would put in it, talk to an independent CISO this week. We are available 24/7 on 07 2112 8502.