Major Changes to Australia's Cyber Security Landscape

In the wake of increasing data breaches,¹ on 29 November 2024, the Government passed its new tranche of legislative measures under its 2023-2030 Australian Cyber Security Strategy seeking to address legislative gaps, and bring Australia in line with international standards.²

The Cyber Security Act 2024 ("Act") introduces several key measures aimed at strengthening Australia's cyber security space.³ These changes include:

• Mandatory Ransomware Reporting Mechanism - Entities carrying on business in Australia, with an annual turnover that exceeds the turnover threshold⁴ for the previous financial year, or who are a reporting entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies ,⁵ and affected by a "cyber-security incident" (as defined under the Act)⁶ and have provided, or are aware that another entity has provided on their behalf, a ransomware payment to an entity that is seeking to benefit from