Document ID: chunk:federal_register_of_legislation:F2025L00278:reg:5
Version: federal_register_of_legislation:F2025L00278
Segment Type: reg
Provision Reference: reg 5
Character Range: 2095–3331

5  Simplified outline of this Part

      Part 3 of the Act imposes an obligation to provide a ransomware payment report if an entity:
             (a) is a reporting business entity; and
             (b) is impacted by a cyber security incident; and
             (c) has provided, or is aware that another entity has provided on their behalf, a ransomware payment to an entity that is seeking to benefit from the impact or the cyber security incident.
      Generally an entity will only be a reporting business entity if it:
             (a) is a responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies; or
             (b) is carrying on a business in Australia with an annual turnover for the previous financial year that exceeds the turnover threshold (see section 6 of this instrument) for that year.
      Particular information must be included in a ransomware payment report, including information relating to the cyber security incident, the demand made by the extorting entity and the ransomware payment. The information contained in the report must be in accordance with the requirements provided by the rules (see section 7 of this instrument).