Cyber security

Death, serious injury, abuse, neglect, unauthorised restrictive practices, and sexual misconduct must be notified.

Critical infrastructure asset operators must report critical incidents within 12 hours and other incidents within 72 hours.

Federal government contractors handling OFFICIAL: Sensitive must meet Right Fit For Risk (RFFR) including E8 ML2.

APRA-regulated entities must have a comprehensive risk management framework.

Sector-specific cyber + risk obligations under SOCI Part 2.

Registered aged care providers must maintain an incident management system and notify Priority 1 reportable incidents within 24 hours and Priority 2 within 30 days.

APRA-regulated entities must maintain information security capability commensurate with the size and extent of threats.

Covered critical infrastructure entities must adopt a CIRMP addressing cyber, physical, personnel, and supply-chain hazards.

Federal entities + critical infrastructure report cyber incidents to ASD ACSC.

Information Security Management System per ISO 27001 increasingly required by customers + government.

Captured critical-infrastructure assets must be registered with Home Affairs.

Businesses with turnover over $3M, and critical infrastructure responsible entities, must report any ransomware payment to the Government within 72 hours.

Merchants that accept card payments must protect cardholder data to PCI DSS — a requirement of the card schemes, enforced through your merchant agreement, not an Australian statute.

Australian fixed-income specialist, FIIG Securities Limited ( FIIG ), has been ordered to pay $2.5 million in pecuniary penalties after ASIC brought a case against the firm for failures to protect thousands of clients from cyber security threats for more than four years.

First major SOCI CIRMP attestation cycle by 28 September 2024; Home Affairs audited + identified gaps in 2024-2025.

Multiple SOCI Part 3A directions issued to responsible entities for critical infrastructure assets following cyber incidents + risk assessments.

Following a significant cyber incident, the Minister exercised SOCI Part 3A direction powers to require a responsible entity to comply with specific mitigation actions.

FIRB national security review of the 99-year Port of Darwin lease held by Landbridge Group (China). Government concluded no divestment required.

APRA imposed an additional $250 million capital adjustment on Medibank following the 2022 cyber incident.

RI Advice failed to have adequate cyber security risk management systems across its authorised representative network despite multiple incidents.