The short version: If a client pays a ransom, a 72-hour reporting clock can start. Many Australian businesses with turnover of $3 million or more must tell the Australian Signals Directorate (ASD) within 72 hours of paying. The clock runs even when the client's insurer or incident responder makes the payment. Agree now who collects the facts, who signs off and who files, because nobody thinks clearly on day three of an outage.
This is general information, not legal advice. Your client's lawyer and insurer should confirm the details for their case.
Who has to report?
A "reporting business entity" does. Under Part 3 of the Cyber Security Act 2024, that means a business with annual turnover of $3 million or more, or one responsible for a critical infrastructure asset, whatever its turnover. The turnover figure comes from the Cyber Security (Ransomware Payment Reporting) Rules 2025.
The duty has applied since 30 May 2025. Home Affairs said the first six months would lean on education. From 1 January 2026 it moved to more active oversight.
Two limits matter. A business that gets a demand and does not pay has nothing to report. And Home Affairs says scam-related incidents and physical extortion threats fall outside the duty.
What starts the clock?
Making the payment, or learning that someone made it for you. The 72 hours do not wait for the investigation to finish.
This catches MSPs out. Cyber insurance policies often let the insurer's response team negotiate and pay. The payment still counts as the client's. If nobody tells the client's owner that the money moved, the deadline can pass unseen.
What does the report contain?
The Rules list what to include where it is reasonably known. In plain English:
- Who the business is: contact details and ABN.
- What happened: when the incident occurred, when it was found, and its impact.
- How it happened: the type of ransomware and any weakness that was used.
- The demand: what the attacker asked for.
- The payment: amount, method and date.
- What was said: a short summary of the communication with the attacker.
You file through the ASD form on cyber.gov.au. Check the live form before you rely on this list, because ASD can change it.
Notice what most of that list needs: logs, dates and a record of who did what. That is an evidence problem, and you solve it before the incident, not during it. We cover the same habit in the evidence problem.
If you're a small business
Ask your IT provider and your insurer three questions today:
- Does our turnover put us over the reporting line?
- If we paid, who in the business would file the report, and who approves it?
- Does our insurer pay on our behalf, and how fast would we be told?
Write the answers on one page. Keep a printed copy, because email may be down.
If you're an MSP
Sell this as a fixed-price incident plan, not a scare. The client gets a one-page response plan, a named owner for the report, and a contact sheet. You get a recurring review and a clear role.
Be careful with scope. Your agreement should say that the client is the reporting entity, that you prepare facts and support filing, and that you do not decide whether to pay. That decision belongs to the client's directors, with legal and insurer advice. For how to package work like this, see the MSP compliance pricing guide.
A worked example
A 25-person logistics company has $9 million in turnover. Ransomware locks its file server on a Friday. The insurer's response team negotiates and pays on Sunday afternoon. The MSP learns about it Monday morning.
Because the plan exists, the office manager already knows the 72 hours began on Sunday. The MSP pulls the timeline from its ticket history and backup logs, writes down the entry point it found, and has the director review a draft by Tuesday. The director files on Tuesday evening, with a day to spare. The MSP separately asks the client's lawyer whether the Office of the Australian Information Commissioner also needs notice, because customer data was on that server.
What can you prepare now?
The best defence is not paying. That means working backups the client has tested, multi-factor authentication on every admin account, and patches applied on time. These controls sit in the Essential 8 and in SMB1001.
CYBERWHITE helps with that side. It scans a Microsoft 365 tenant and shows, control by control, which settings meet the Essential 8 and SMB1001 requirements, which do not, and which need review, with exportable evidence. It does not stop ransomware, run incident response or file reports for you. It gives you the dated proof that the basics were in place, which insurers and assessors ask for after an incident.
To see what a client's tenant would show, book a free proof check. We scan one tenant with you. You can also read the Essential 8 compliance guide, try the cyber insurance calculator or see how SMB1001 works for MSPs.
Your checklist
- Confirm whether each client is over the $3 million turnover line or runs critical infrastructure.
- Name one person at the client who approves a report, and one deputy.
- Write down who files: the client, with your help, in your agreement.
- Ask each insurer whether it pays on the client's behalf and how it will tell the client.
- Save the ASD reporting page and the insurer's claim line on a printed contact sheet.
- Keep a timeline template: discovery, containment, demand, payment, recovery.
- Test one backup restore per client each quarter and record the result.
- Book a yearly review of the plan.
Sources
- Department of Home Affairs: Ransomware payment reporting factsheet
- Cyber Security Act 2024 (Cth), Part 3
- Cyber Security (Ransomware Payment Reporting) Rules 2025
- Australian Signals Directorate, cyber.gov.au: ransomware guidance and payment reporting
Keep reading: The evidence problem and Cyber insurance questionnaire: an MSP walkthrough and Essential 8 MFA Requirements