Document ID: chunk:federal_register_of_legislation:C2024A00098:front:0:p1
Version: federal_register_of_legislation:C2024A00098
Segment Type: other
Provision Reference: 
Character Range: 0–3202

Cyber Security Act 2024

No. 98, 2024

An Act relating to cyber security for Australians, and for other purposes

Contents
Part 1—Preliminary
1 Short title
2 Commencement
3 Objects
4 Simplified outline of this Act
5 Extraterritoriality
6 Act binds the Crown
7 Concurrent operation of State and Territory laws
8 Definitions
9 Meaning of cyber security incident
10 Meaning of permitted cyber security purpose
11 Disclosure to State body
Part 2—Security standards for smart devices
Division 1—Preliminary
12 Simplified outline of this Part
13 Application of this Part
Division 2—Security standards for relevant connectable products
14 Security standards for relevant connectable products
15 Compliance with security standard for a relevant connectable product
16 Obligation to provide and supply products with a statement of compliance with security standard
Division 3—Enforcement
17 Compliance notice
18 Stop notice
19 Recall notice
20 Public notification of failure to comply with recall notice
Division 4—Miscellaneous
21 Revocation and variation of notices given under this Part
22 Internal review of decision to give compliance, stop or recall notice
23 Examination to assess compliance with security standard and statement of compliance
24 Acquisition of property
Part 3—Ransomware reporting obligations
Division 1—Preliminary
25 Simplified outline of this Part
Division 2—Reporting obligations
26 Application of this Part
27 Obligation to report following a ransomware payment
28 Liability
Division 3—Protection of information
29 Ransomware payment reports may only be used or disclosed for permitted purposes
30 Limitations on secondary use and disclosure of information in ransomware payment reports
31 Legal professional privilege
32 Admissibility of information in ransomware payment report against reporting business entity
Part 4—Coordination of significant cyber security incidents
Division 1—Preliminary
33 Simplified outline of this Part
34 Meaning of significant cyber security incident
Division 2—Voluntary information sharing with the National Cyber Security Coordinator
35 Impacted entity may voluntarily provide information to National Cyber Security Coordinator in relation to a significant cyber security incident
36 Voluntary provision of information in relation to other incidents or cyber security incidents
37 Role of the National Cyber Security Coordinator
Division 3—Protection of information
38 Information provided in relation to a significant cyber security incident—use and disclosure by National Cyber Security Coordinator
39 Information provided in relation to other incidents—use and disclosure by National Cyber Security Coordinator
40 Limitations on secondary use and disclosure
41 Legal professional privilege
42 Admissibility of information voluntarily given by impacted entity
43 National Cyber Security Coordinator not compellable as witness
Division 4—Miscellaneous
44 Interaction with other requirements to provide information in relation to a cyber security incident
Part 5—Cyber Incident Review Board
Division 1—Preliminary
45 Simplified outline of this Part
Division 2—Reviews
46 Board must cause reviews to be conducted
47 Board may discontinue a