For years, Australian organisations operated within a principles-based compliance model built largely on implied trust. Producing policies, naming a responsible officer, and attesting to controls in place was often enough to satisfy regulators. That era is over.
A confluence of high-profile breaches — Optus, Medibank, Latitude Financial — combined with a rapidly maturing threat environment has prompted Australia’s federal government to move decisively. The result is a legislative and regulatory shift that GRC professionals, boards, and CISOs must now contend with across nearly every sector.
The central shift: Regulators including APRA, ASIC, AUSTRAC, and the OAIC are increasingly aligned on one expectation — it is no longer sufficient for controls to exist. Organisations must now be able to validate, at any point in time, that those controls are operating effectively.
The Cyber Security Act 2024: Australia’s First Standalone Legislation
The passage of the Cyber Security Act 2024 marks a pivotal moment in Australia’s regulatory history. Introduced to parliament in October 2024 as part of a broader Cyber Security Legislative Package, it is the country’s first dedicated cybersecurity statute — bringing together obligations that were previously scattered across sectoral laws and frameworks.
The Act contains four key components that GRC teams must understand and operationalise.
Ransomware Payment Reporting
From 30 May 2025, mandatory ransomware reporting obligations commenced under Part 3 of the Act. Any business with an annual turnover of AUD 3 million or more, as well as all entities responsible for critical infrastructure, must report a cybersecurity incident to the Department of Home Affairs and the Australian Signals Directorate within 72 hours of making a ransomware payment — or becoming aware that one has been made. This is a significant compliance burden for many mid-market organisations previously outside the critical infrastructure perimeter.
Smart Device Security Standards
On 4 March 2026, the Cyber Security (Security Standards for Smart Devices) Rules 2025 came into force following a 12-month transition period. The rules apply to manufacturers and suppliers of “relevant connectable products” — broadly, any consumer-grade device capable of connecting to the internet or to other devices over a network. Smart TVs, IP cameras, routers, and smart home devices are squarely in scope.
Obligations centre on three areas: elimination of default universal passwords, a mandated vulnerability reporting channel, and defined minimum security update support periods — with industry guidance recommending no less than five years post-discontinuation. Enforcement is light-touch by design, using a tiered notice framework rather than civil penalties, but the compliance self-declaration obligations are real.
Key Regulatory Timeline
- May 2025 — Ransomware payment reporting obligations commence under Cyber Security Act 2024. 72-hour reporting window for entities above AUD $3M turnover.
- July 2025 — APRA CPS 230 takes effect — unified framework for operational risk, business continuity, and third-party risk management across regulated entities.
- March 2026 — Smart device security standards enforced. Manufacturers and suppliers of connectable products must comply with password, support, and vulnerability rules.
- December 2026 — Automated decision-making (ADM) transparency requirements under the reformed Privacy Act take effect.
- From July 2027 — Group 3 climate reporting begins. Expanded assurance requirements continue rolling out through 2030 under AASB S2 climate disclosure rules.”
Strengthening Your Cybersecurity with Intrix
Understanding the risks is only the first step. Acting on them is what makes the difference.
At Intrix, we help organisations stay ahead of AI-driven threats through penetration testing, continuous security validation, and expert advisory. Our approach focuses on identifying real-world risks, prioritising what matters, and helping your team respond faster.
If you want to understand your current exposure and how to improve your cybersecurity posture, contact us and let’s start a conversation.
