Framework guide

FEHA and the Cyber Security Act 2024

What it takes, and how FEHA handles it

The Cyber Security Act 2024 became law on 29 November 2024 and implements four initiatives of the 2023–2030 Australian Cyber Security Strategy. Since 30 May 2025, businesses with annual turnover above A$3 million, and responsible entities for critical infrastructure assets, must report ransomware or cyber extortion payments within 72 hours through ASD's ReportCyber.

The Act also sets minimum security standards for consumer smart devices, creates a Cyber Incident Review Board to review significant incidents, and adds a limited use obligation that restricts how the National Cyber Security Coordinator can use information shared after a cyber incident.

Book a demo See every framework FEHA covers

Framework recordau-cyber-security-act

Category Resilience

ObligationMandatory

RegionAustralia

Applies toBusinesses with A$3M+ turnover and smart device suppliers

Evidence overlap2 frameworks

The playbook

How FEHA handles it

The same 4-step path every Cyber Security Act 2024 engagement runs, start to finish.

STEP 01

Confirm which parts of the Act apply to your business

STEP 02

Build a ransomware payment reporting process that meets the 72-hour deadline

STEP 03

Connect it to your incident response plan and your Privacy Act breach obligations

STEP 04

Map the overlap with the Essential Eight so one control set covers both

Evidence overlap

Related frameworks

Evidence you build for Cyber Security Act 2024 carries over to these too.

ResilienceConditional

Essential 8

ASD's eight prioritized mitigation strategies, assessed across maturity levels 0–3.

For: Australian organizations and government suppliers

Australia↔ 3 overlaps

PrivacyMandatory

Privacy Act 1988

Australia's privacy law: 13 Australian Privacy Principles and the Notifiable Data Breaches scheme.

For: Australian government agencies and businesses with A$3M+ turnover

Australia↔ 3 overlaps

FAQ

Frequently asked questions

Still have questions? Talk to us

No. It does not ban payments, but you must report within 72 hours of making a payment, or of becoming aware that one was made on your behalf.

Talk to a team that handles Cyber Security Act 2024 every day.

Named compliance experts run this framework end to end, from first gap assessment to a passed audit.

Explore every framework FEHA covers

Cyber Security Act 2024

ResilienceMandatory

ISO 27001 Lead Auditors, CISSPs, and CISMs — the people who would actually work your Australia file.