Free procedure · Word download · Cyber Security Act 2024
Ransomware Payment
Reporting Procedure
If your business makes a ransomware or cyber extortion payment, or someone makes one on its
behalf, the Cyber Security Act 2024 gives you 72 hours to report it to the Australian Government.
This free procedure, to copy or download as Word with no sign-up, sets out whether you must report,
what to record when a payment is made, who reports, and everything the report must contain. Below
it, a guide with real wording for the 3 clauses that matter most.
Rather not fill it in yourself? Have
your procedure generated in your branding instead - the signup
credits cover the first one. Card required to download that one; no charge today.
Generated from this page's structure, in an example company's branding
Free procedure
Free ransomware payment reporting procedure
The complete ransomware payment reporting procedure, free to copy from this page or download as an editable Word document.
No sign-up. Replace every [bracketed placeholder] with your own details, delete anything that
does not apply, and have it approved before you rely on it. The guide below
explains what each section has to contain and what an auditor checks.
How to report a ransomware or cyber extortion payment to the Australian Government within 72 hours, under Part 3 of the Cyber Security Act 2024. Replace the bracketed placeholders with your own details.
This procedure sets out what [Organisation] does if it makes a ransomware or cyber extortion payment, or learns that someone has made one on its behalf. It covers the report the law requires within 72 hours. It does not decide whether a payment is made.
1. Purpose and scope
Part 3 of the Cyber Security Act 2024 requires a reporting business entity that makes a ransomware payment, or is aware one was made on its behalf, to report it to the Government within 72 hours. This procedure makes sure [Organisation] can meet that deadline in the middle of an incident.
It sits within [our cyber security incident response plan]. The incident response team runs the incident; this procedure covers the payment report.
2. Whether we must report
A business is a reporting business entity if it carries on business in Australia and its annual turnover for the previous financial year exceeds $3 million, or if it is a responsible entity for a critical infrastructure asset covered by Part 2B of the Security of Critical Infrastructure Act 2018. A business that only traded for part of the previous financial year uses a pro rata threshold. Commonwealth and State bodies are not covered.
[Organisation] [is / is not] a reporting business entity. [The Chief Financial Officer] confirms this each year once the financial year's turnover is known. The Government's reporting form describes the test as $3 million or more, so if our turnover is close to $3 million we treat ourselves as covered.
3. When the obligation applies
We must report if all of these are true:
A cyber security incident has happened, is happening or is about to happen
It has had, or could reasonably be expected to have, a direct or indirect impact on [Organisation]
Someone demands something from [Organisation], or from another entity, to benefit from the incident
[Organisation] makes a payment or gives a benefit (money, property or any other advantage) directly related to the demand, or knows someone else did so on its behalf
4. Recording a payment
[The Chief Executive Officer] decides on any payment, with legal advice. That decision is outside this procedure.
The moment a payment is made, or we learn one was made on our behalf, [the incident lead] records the date and time, the amount or what was given, how it was provided, who made it and the demand it answers. The 72 hours start from that moment.
5. Reporting within 72 hours
[The IT Manager] prepares the report using the ransomware payment reporting form on the Australian Signals Directorate's website, cyber.gov.au
[Our legal adviser] checks it. If the check is not finished in time, the report is still submitted within the 72 hours
[The IT Manager] submits it within 72 hours of the payment, or of learning about it. Our internal target is [within 48 hours]
If either of them is away or cannot be reached, [the deputy role] stands in
We include everything we know, or can find out by reasonable search or enquiry, when we report. We do not hold the report back to finish an investigation. Anything we find out later goes in the incident records
6. What the report must contain
We can also include any other information about the incident.
Information
What to include
Where we get it
Our details
Contact and business details, including our ABN and address
[Finance]
Who paid, if someone else did
Their contact and business details, including ABN and address
[The entity that paid]
The incident
When it happened or is estimated to have happened; when we became aware of it; the impact on our infrastructure and on our customers; any ransomware or malware variants used; any vulnerabilities exploited; anything that could help the Government respond
[The incident lead and IT]
The demand
The amount or benefit demanded, and how payment was demanded
[The incident lead]
The payment
The amount or benefit given, and how it was provided
[Finance]
Communications
When and how we communicated with the extorting entity, a brief description of those communications, and any negotiations before the payment
[The incident lead or negotiator]
7. Payments made on our behalf
If someone else pays for us, such as [our insurer, an incident response firm or a related company], the 72 hours run from when we become aware of the payment, and the report includes that entity's contact and business details. When we make or renew our arrangements with them, [the incident lead] asks them to tell [the incident lead] straight away if they make or arrange a payment for us, and to give us their contact and business details.
8. Records, protection and review
Keep a record of every report: what we submitted, when, by whom, and any reference number, with the incident records
An entity is not liable to an action for damages for anything done or omitted in good faith in complying with the reporting obligation. Failing to report can attract a civil penalty
Review this procedure [at least once a year], after any ransomware incident, and when the law or the reporting arrangements change. Owner: [role]
This template is a starting point, not legal advice. Replace every bracketed placeholder, delete what does not apply, and have it approved before you rely on it.
Before you start
Who must report a ransomware payment
The obligation applies to a reporting business entity. Under section 26 of the Act that is a
business carrying on business in Australia whose annual turnover for the previous financial year
exceeds $3 million, worked out pro rata if it traded for only part of the year, or any responsible
entity for a critical infrastructure asset covered by Part 2B of the Security of Critical
Infrastructure Act 2018. Commonwealth and State bodies are not covered.
It is triggered by a payment, not a demand. A demand you do not pay is not reportable under this law.
A payment includes any benefit, meaning any advantage and not only money or property, given in answer to the demand, and a payment made on your behalf, by
an insurer, a negotiator or a parent company, is still yours to report.
The Government's reporting form describes the turnover test as $3 million or more, so if your
turnover is close to the line, treat yourself as covered.
The writing guide
How to write the procedure
8
sections
3
with real wording
4
questions you will be asked
4
failure modes
two hours
to write it yourself
1
Purpose and scope
What it must contain
That the procedure covers the report Part 3 of the Cyber Security Act 2024 requires after a ransomware or cyber extortion payment, and that it does not decide whether to pay.
What matters on the day
That it sits inside your incident response, not beside it. The people running the incident are the ones who will know a payment has been made.
2
Whether we must report
What it must contain
The reporting business entity test, your position, and who confirms it each year.
What matters on the day
The exact test. The Act says turnover that exceeds $3 million in the previous financial year, pro rata for a part year, or a responsible entity for a critical infrastructure asset.
Wording that works
A business is a reporting business entity if it carries on business in Australia and its annual turnover for the previous financial year exceeds $3 million, or if it is a responsible entity for a critical infrastructure asset covered by Part 2B of the Security of Critical Infrastructure Act 2018. A business that only traded for part of the previous financial year uses a pro rata threshold. Commonwealth and State bodies are not covered.
It states both routes into the obligation and the part-year rule, which the Rules set as $3 million multiplied by the days traded over the days in the year.
3
When the obligation applies
What it must contain
The four conditions: a cyber security incident, an impact on you, a demand, and a payment or benefit given in answer to it.
What matters on the day
That a benefit counts as well as money. The law covers any payment or benefit given to the extorting entity in answer to the demand.
4
Recording a payment
What it must contain
Who decides on a payment, and what is recorded the moment one is made, since that moment starts the 72 hours.
What matters on the day
That the time is recorded. Every later step is measured from it.
Wording that works
The moment a payment is made, or we learn one was made on our behalf, [the incident lead] records the date and time, the amount or what was given, how it was provided, who made it and the demand it answers. The 72 hours start from that moment.
It captures the facts the report needs while they are fresh, and makes the start of the deadline a recorded fact rather than a memory.
5
Reporting within 72 hours
What it must contain
Who prepares, checks and submits the report, using the ASD's reporting form, and an internal target inside the 72 hours.
What matters on the day
That the report is not held back. It must contain what you know, or can find out by reasonable search or enquiry, when you report.
6
What the report must contain
What it must contain
Every item section 27(2) of the Act and section 7 of the Rules list, and where each comes from in your organisation.
What matters on the day
Completeness: contact details with ABN and address, the incident's timing and impact, the demand, the payment, and communications with the extorting entity, including any negotiation.
7
Payments made on our behalf
What it must contain
That a payment made by an insurer, incident response firm or related company must still be reported, from when you learn of it.
What matters on the day
How you make sure you are told straight away. Without that, you may not learn of a payment made for you until long after it was made.
Wording that works
If someone else pays for us, such as [our insurer, an incident response firm or a related company], the 72 hours run from when we become aware of the payment, and the report includes that entity's contact and business details. When we make or renew our arrangements with them, [the incident lead] asks them to tell [the incident lead] straight away if they make or arrange a payment for us, and to give us their contact and business details.
It closes the gap the Act leaves to you: the law starts the clock when you become aware, so the people who could pay for you need to know to tell you at once.
8
Records, protection and review
What it must contain
A record of every report, the good-faith protection the Act gives, the civil penalty for not reporting, and when the procedure is reviewed.
What matters on the day
That the record exists. It is your evidence that the report was made, and on time.
What your board, insurer and the Government will ask
?
Are we a reporting business entity?
Satisfies
A yearly check of the previous financial year's turnover against the $3 million threshold, or the critical infrastructure test, with who confirmed it.
Fails
Nobody has checked since the business grew.
?
When was the payment made, and when did we report?
Satisfies
The recorded time of the payment, or of learning about it, and the time the report was submitted, inside 72 hours.
Fails
The report went in once the investigation finished, a week later.
?
Who paid, and how did we find out?
Satisfies
The paying entity's details in the report, and the arrangement that required it to tell us.
Fails
The insurer's negotiator paid and nobody told the business for days.
?
What did the report say?
Satisfies
A record of what was submitted, covering every item the Act and the Rules list.
Fails
No copy of what was sent.
What goes wrong
Where ransomware reporting goes wrong
!
Waiting for the investigation to finish
The report must hold what you know, or can find out by reasonable search or enquiry, at the time you report. Holding it back to complete the picture is how a 72-hour deadline is missed.
!
Assuming the insurer will report
If your insurer, an incident response firm or a parent company pays on your behalf, the obligation is still yours, from the moment you become aware of the payment. Make sure your arrangements require them to tell you at once.
!
Using the wrong turnover test
The Act's test is turnover that exceeds $3 million in the previous financial year, worked out pro rata if you traded for only part of it. The Government's form describes it as $3 million or more, so a business near the line should treat itself as covered.
!
Mixing it up with the data breach rules
Seventy-two hours is this report's deadline. The Privacy Act's Notifiable Data Breaches scheme has a different clock, 30 days to assess and then as soon as practicable, and a ransomware attack can trigger both.
The rest of your response
Where the procedure fits
The procedure covers one report. The incident itself is run under your
incident response plan, and if personal
information was taken or exposed, your
data breach response plan applies as
well: the Privacy Act's Notifiable Data Breaches scheme has its own assessment and notification rules.
If your AI or software suppliers are involved, their contract terms decide how fast they tell you; see
the AI vendor security addendum.
The guide's statements of the law come from Part 3 of the Cyber Security Act 2024 and the Cyber
Security (Ransomware Payment Reporting) Rules 2025, published on the Federal Register of Legislation
for reuse. PolicyMint's procedure is grounded in the same text.
See the real output
What PolicyMint generates
The same eight sections, written for your business: your turnover position, who decides and who
reports, where each item of the report comes from in your organisation, and the parties who could
pay on your behalf. It carries your branding and exports to Word, PDF or Excel. The cover in the
hero and the page below are that output, generated for an example company.
One page of the generated document, for an example company. The trial produces the whole
document, not a sample.
Where the guide says [role] or [system], the document says yours; where PolicyMint
cannot know a fact, it asks rather than guesses.
Guided reviewActual product
The one fact this document could not know stays highlighted in the document and the
export. The review explains what is needed and writes your answer in. Nothing is
invented. Fictional demo data.
Side by side
Writing it yourself vs generating it
Scroll the table sideways to compare both routes.
Dimension
Writing it yourself
Generating it with PolicyMint
The structure
This page: eight sections, free.
The same eight sections, filled in from your business profile and answers.
The law
You check the test, the deadline and every report item against the Act and the Rules.
Grounded in Part 3 of the Act and the Rules, entry by entry, and checked before you see it.
Your people
You fill in who decides, who reports and who checks.
Your real roles and the parties who could pay for you, from your answers; anything missing is marked for you to confirm.
Checking it
Nobody, until the day you need it.
Three independent verifiers check every section against the requirements before you see it.
The rest
Your incident response plan and data breach response plan are separate jobs, and they have to agree.
They come from the same profile, so they agree. Your first document is free.
Ransomware payment reporting FAQ
The questions people ask
Including who must report, and whether an unpaid demand counts.
What is ransomware payment reporting?
Since 30 May 2025, Part 3 of the Cyber Security Act 2024 requires a reporting business entity that makes a ransomware or cyber extortion payment, or becomes aware that one was made on its behalf, to report it to the Australian Government within 72 hours. The report goes in through the Australian Signals Directorate's reporting form.
Who has to report a ransomware payment?
A business carrying on business in Australia whose annual turnover for the previous financial year exceeded $3 million (pro rata if it traded for only part of the year), and any responsible entity for a critical infrastructure asset covered by Part 2B of the Security of Critical Infrastructure Act 2018. Commonwealth and State bodies are not covered.
How long do we have to report?
72 hours from making the payment, or from becoming aware that someone made it on your behalf. Report what you know, or can find out by reasonable search or enquiry, at the time; do not hold the report back to finish an investigation.
What does the report have to contain?
Your contact and business details, including ABN and address (and those of anyone who paid on your behalf); the incident, including when it happened, when you became aware, its impact on your infrastructure and customers, any ransomware or malware variants and any vulnerabilities exploited; the demand; the payment; and your communications with the extorting entity, including any negotiation before paying.
Do we have to report a ransom demand we did not pay?
Not under this law. The obligation applies when a payment or benefit is given in answer to the demand. You can still report the incident to the Australian Signals Directorate, and other obligations, such as the Notifiable Data Breaches scheme, may apply to the incident itself.
What happens if we do not report?
Failing to report as required can attract a civil penalty. Section 27(5) of the Act sets it at 60 penalty units, and under the Regulatory Powers Act a court can order a company to pay up to five times that. An entity is not liable to an action for damages for anything done or omitted in good faith in complying with the reporting obligation.
Is this ransomware payment reporting procedure free?
Yes. The complete procedure is on this page and as an editable Word document, with no sign-up and no card. Fill in the bracketed placeholders and have it approved before you rely on it. If you would rather have it written for your business, with your roles and the parties who could pay for you named, PolicyMint generates it and your first document is free.
How much does PolicyMint charge to write the procedure?
The procedure is one full-length document: A$10.00US$6.50£5.00€6.00 at the list rate, or 25 credits. Signing up grants 25 credits, so your first one is free, card required, with no charge today.
Ready when you are
Know who reports
before the 72 hours start
Answer a few questions about your business and who could pay on your behalf. Get a ransomware payment reporting procedure written for you, in your branding, checked against the Cyber Security Act before you see it.
