Who must report cyber security incidents to ASD (SOCI)?

Critical infrastructure asset operators must report critical incidents within 12 hours and other incidents within 72 hours.

Under the Security of Critical Infrastructure Act 2018, responsible entities for critical infrastructure assets must report cyber security incidents that have a 'significant impact' on the availability of the asset within 12 hours; other reportable cyber incidents within 72 hours. Reports go to ASD's ACSC.

Applies when the business has a critical infrastructure asset.

How the regulator frames it: Responsible entities for the 11 critical infrastructure sectors covered by SOCI.

What triggers it: A cyber security incident with significant impact (12h) or other reportable impact (72h).

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires a critical infrastructure asset.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business operates a critical infrastructure asset: it then applies (operates a critical infrastructure asset (SOCI Act)).

When due

12 hours (significant) / 72 hours (other) of becoming aware.

Frequency

When a triggering event occurs

Evidence to keep

Incident report to ASD, internal IR playbook records, log evidence.

Status

Current

Priority

Critical

Maximum penalty: Civil penalties up to $91,000 (250 penalty units, body corporate) per contravention, plus mandatory direction risks.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• Home Affairs SOCI directions 2024 (2024): SOCI direction powers actively used; critical infrastructure must have robust CIRMP + cyber posture.
• Home Affairs SOCI mandatory cyber direction (illustrative) (2024): Critical infrastructure entities should expect ministerial direction powers to be exercised. CIRMP documentation must support rapid compliance responses.

If this obligation applies to you, so do these 5: the engine uses the same rule for each.

• Adopt and maintain a Critical Infrastructure Risk Management Program (CIRMP)
• Register as a responsible entity / direct interest holder under SOCI
• Comply with SOCI Positive Security Obligation (PSO) per sector
• Government cyber incident reporting via ASD ACSC
• SoNS — Systems of National Significance (SOCI)

• Adopt Essential Eight Maturity Level 2 (federal subcontractors): Federal government contractors handling OFFICIAL: Sensitive must meet Right Fit For Risk (RFFR) including E8 ML2.
• Comply with APRA CPS 234 (Information Security): APRA-regulated entities must maintain information security capability commensurate with the size and extent of threats.
• ISO/IEC 27001 ISMS certification — increasingly customer-mandated: Information Security Management System per ISO 27001 increasingly required by customers + government.
• Report ransomware and cyber extortion payments within 72 hours: Businesses with turnover over $3M, and critical infrastructure responsible entities, must report any ransomware payment to the Government within 72 hours.

Rules Mate tracks 9 published obligations tagged "cyber", 4 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated critical priority, and is triggered by events.

Regulated by Australian Signals Directorate (Australian Cyber Security Centre) and Cyber and Infrastructure Security Centre — Department of Home Affairs.

ASD: Cyber security guidance and incident response. Publishes the Information Security Manual (ISM), Essential Eight, and Right Fit For Risk requirements for federal subcontractors.

Home Affairs (SOCI): Administers the Security of Critical Infrastructure Act 2018 — registration, risk management programs, and mandatory cyber incident reporting for critical infrastructure assets.

• Australian Signals Directorate (Australian Cyber Security Centre)
• Cyber and Infrastructure Security Centre — Department of Home Affairs

SOCI Act: Federal critical infrastructure protection regime.

• Security of Critical Infrastructure Act 2018

Free tools that help with this obligation:

• Essential Eight maturity check
• Cyber incident notifications
• Ransomware payment reporting