Who must comply with Government cyber incident reporting via ASD ACSC?

Federal entities + critical infrastructure report cyber incidents to ASD ACSC.

Federal agencies + Commonwealth-funded entities report cyber incidents to ASD's Australian Cyber Security Centre (ACSC). Mandatory for critical infrastructure under SOCI; voluntary but expected for others. Information sharing supports national threat intelligence.

Applies when the business has a critical infrastructure asset.

How the regulator frames it: Federal agencies + critical infrastructure entities.

What triggers it: Cyber incident with potential impact.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires a critical infrastructure asset.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business operates a critical infrastructure asset: it then applies (operates a critical infrastructure asset (SOCI Act)).

When due

ASAP; statutory 12-72h for SOCI.

Frequency

When a triggering event occurs

Evidence to keep

ASD ACSC incident report; internal investigation record.

Status

Current

Priority

High

Maximum penalty: Statutory requirement under SOCI for CI; PSPF compliance for agencies.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

If this obligation applies to you, so do these 5: the engine uses the same rule for each.

• Report cyber security incidents to ASD (SOCI)
• Adopt and maintain a Critical Infrastructure Risk Management Program (CIRMP)
• Register as a responsible entity / direct interest holder under SOCI
• Comply with SOCI Positive Security Obligation (PSO) per sector
• SoNS — Systems of National Significance (SOCI)

• Adopt Essential Eight Maturity Level 2 (federal subcontractors): Federal government contractors handling OFFICIAL: Sensitive must meet Right Fit For Risk (RFFR) including E8 ML2.
• Comply with APRA CPS 234 (Information Security): APRA-regulated entities must maintain information security capability commensurate with the size and extent of threats.
• ISO/IEC 27001 ISMS certification — increasingly customer-mandated: Information Security Management System per ISO 27001 increasingly required by customers + government.
• Report ransomware and cyber extortion payments within 72 hours: Businesses with turnover over $3M, and critical infrastructure responsible entities, must report any ransomware payment to the Government within 72 hours.

Rules Mate tracks 9 published obligations tagged "cyber", 4 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated high priority, and is triggered by events.

Regulated by Australian Signals Directorate (Australian Cyber Security Centre).

ASD: Cyber security guidance and incident response. Publishes the Information Security Manual (ISM), Essential Eight, and Right Fit For Risk requirements for federal subcontractors.

• Australian Signals Directorate (Australian Cyber Security Centre)

SOCI Act: Federal critical infrastructure protection regime.

• Security of Critical Infrastructure Act 2018

Free tools that help with this obligation:

• Essential Eight maturity check
• Cyber incident notifications
• Ransomware payment reporting