Document ID: chunk:federal_register_of_legislation:F2025L00278:reg:7:p1
Version: federal_register_of_legislation:F2025L00278
Segment Type: reg
Provision Reference: reg 7 (pt 1/2)
Character Range: 3746–6575

7  Requirements for information that ransomware payment report must contain
 (1) For the purposes of subsection 27(2) of the Act, this section prescribes requirements for information that a ransomware payment report given by a reporting business entity in relation to a ransomware payment must contain.
Note: Information is only required to be given to the extent that the reporting business entity knows or is able, by reasonable search or enquiry, to find out within the 72 hour time period for giving the report.
 (2) The reporting business entity's contact and business details given for the purposes of paragraph 27(2)(a) of the Act must include the entity's ABN (if any) and address.
 (3) The other entity's contact and business details given for the purposes of paragraph 27(2)(b) of the Act must include the entity's ABN (if any) and address.
 (4) The information about the cyber security incident, including its impact on the reporting business entity, given for the purposes of paragraph 27(2)(c) of the Act must include the following:
 (a) when the incident occurred or is estimated to have occurred;
 (b) when the reporting business entity became aware of the incident;
 (c) the impact of the incident on the reporting business entity's infrastructure;
 (d) the impact of the incident on the reporting business entity's customers;
 (e) what variants (if any) of ransomware or other malware were used;
 (f) what vulnerabilities (if any) in the reporting business entity's system were exploited;
 (g) information that could assist the response to, mitigation or resolution of the cyber security incident by a Commonwealth body or State body.
Note: Ransomware payment reports may only be used or disclosed for permitted purposes which include purposes relating to the response to, mitigation or resolution of the cyber security incident. The information must not be disclosed to a State body unless a Minister of the State or Territory has consented: see section 11 of the Act.
 (5) The information about the demand made by the extorting entity given for the purposes of paragraph 27(2)(d) of the Act must include:
 (a) the amount or quantum of the ransomware payment demanded, or if the ransomware payment demanded is a non‑monetary benefit, a description of the ransomware payment demanded; and
 (b) the method of provision demanded.
 (6) The information about the ransomware payment given for the purposes of paragraph 27(2)(e) of the Act must include:
 (a) the amount or quantum of the ransomware payment, or if the ransomware payment is a non‑monetary benefit, a description of the ransomware payment; and
 (b) the method of provision.
 (7) The information about communications with the extorting entity relating to the incident, the demand and the ransomware payment given for the purposes of paragraph 27(2)(f) of