New Cyber Security Laws – What do they mean for you?

At the end of 2024, the Government passed a number of new cyber security legislation as part of its Cyber Security Legislative Package 2024, in accordance with its cybersecurity strategy for 2023-2030.  This legislative package is comprised of the following:

1. Cyber Security Act 2024 (Cth);
2. Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024 (Cth); and
3. Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (Cth).

This legislative package may impact you and your business, particularly if you carry on a business with an annual turnover above AUD $3 million or if your business deals with critical infrastructure assets, and penalties may apply if you fail to comply with any applicable obligations.

We have summarised some of the new measures introduced by this legislative package in more detail below.

Cyber Security Act 2024

The Cyber Security Act 2024 (Cth) sets out a range of new measures to strengthen cyber security infrastructure, as well as providing guidance and protection to people and businesses who report cyber security attacks.

The key measures introduced by the Cyber Security Act 2024 (Cth) are:

• mandating minimum cyber security standards for smart devices;
• introducing mandatory ransomware reporting requirements if a ransomware payment is made to an extorting entity;
• implementing “limited use” measures to prevent information voluntarily provided to the National Cyber Security Coordinator from being used for enforcement purposes (in order to encourage engagement and cooperation between industry and the government following cyber incidents); and
• establishing a Cyber Incident Review Board to conduct reviews of significant cyber incidents and share lessons learned.

Significantly, entities which:

1. carry on business in Australia with an annual turnover that exceeds the prescribed threshold (currently AUD $3 million) which is not a Commonwealth or State body; or
2. are a responsible entity for a critical infrastructure asset as defined by the Security of Critical Infrastructure Act 2018 (Cth);

are bound by the new mandatory ransomware payment reporting obligations, which will be in effect from May 2025. Such entities will be required to make a report to the Australian Signals Directorate (ASD) within 72 hours of making or becoming aware that a ransomware payment has been made. If an entity which is required to make a report under the Cyber Security Act 2024 does not do so within 72 hours of becoming aware that such a report is required, a civil penalty of up to 60 penalty units may apply.

Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024

In addition to the above, the Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024 (Cth) introduces a ‘limited use’ obligation (parallel to the obligation introduced under the Cyber Security Act), which limits how the ASD can use and disclose any information that an entity has voluntary disclosed to them pursuant to the mandatory reporting obligations set out above. It also serves to exempt information voluntarily provided to the National Cyber Security Coordinator under the Cyber Security Act from the operation of the Freedom of Information Act 1982 (Cth).

The intention of this limited use obligation is to provide reporting entities with greater confidence that any information provided as part of their mandatory reporting obligations will be protected and will not be used for enforcement purposes. However, it is important to note that the limited use obligation is not intended to shield the entity from all legal liability provisions, and entities are still required to comply with their existing legal and reporting obligations. Accordingly, businesses should still take measures to ensure such information is protected and handled in accordance with relevant legislation and that they have appropriate cyber security policies in place.

Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 

Lastly, the Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (Cth) was introduced to amend the Security of Critical Infrastructure Act 2018 (Cth). These amendments aim to further protect critical infrastructure assets and address gaps identified in the current legislation, with the intent of strengthening the security and resilience of critical infrastructure, and the cooperation of government and infrastructure operators. The key amendments implemented by this Act are:

• an expanded definition of critical infrastructure assets;
• providing clarification regarding the obligations relating to certain data storage systems that store or process business critical data and protected information;
• expanding Government powers to facilitate management of the consequences of incidents on critical infrastructure assets; and
• providing the regulator with the ability to direct entities to remedy a seriously deficient risk management program.

The Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (Cth) is intended to operate in conjunction with the Cyber Security Act 2024 (Cth) and the Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024 (Cth), and may carry certain additional implications for the purposes of these other legislation – for example, if an entity is now classified as a critical infrastructure asset due to the expanded definition, it is likely to be bound by the mandatory ransomware payment obligations under the Cyber Security Act 2024 (Cth).

Businesses which deal with critical infrastructure assets are required to comply with these additional obligations along with their existing obligations under the Security of Critical Infrastructure Act 2018 (Cth). If you would like further advice as to whether your business may fall under the scope of this legislation, please reach out to our team for a free consultation to discuss further.

*****

The Cyber Security Legislative Package 2024 implement a range of new measures and obligations which entities should be aware of if they have an annual turnover that exceeds $3 million or if it holds critical infrastructure assets.

We can help you

If you would like to learn more about updates in cyber security legislation and how it may affect you or your business, please call 1800 867 113, or to organise a confidential discussion at a time that suits you, please click here