News: Australian Government introduces Cyber Security Legislative Package to Parliament with associated call for submissions now open

On 9 October 2024, the Australian Government tabled a new Cyber Security Legislative Package in the Australian Parliament. The package contains a standalone Cyber Act and updates to the Security of Critical Infrastructure Act 2018 (SOCI Act) that that will implement initiatives under the 2023-2030 Australian Cyber Security Strategy.

if passed, these measures will:

🔸 mandate minimum cyber security standards for smart devices;
🔸 introduce mandatory ransomware reporting for certain businesses to report ransom payments;
🔸 introduce a ‘limited use’ obligation for the National Cyber Security Coordinator and the Australian Signals Directorate; and
🔸 establish a new Cyber Incident Review Board.

These reforms will also reform the SOCI Act in the following ways:

🔸 clarify existing obligations in relation to systems holding business critical data;
🔸 enhance government assistance measures to better manage the impacts of all hazards incidents on critical infrastructure;
🔸 simplify information sharing across industry and Government;
🔸 introduce a power for the Government to direct entities to address serious deficiencies within their risk management programs; and
🔸 align regulation for the security of telecommunications into the SOCI Act.

At the same time as it was tabled in Parliament the Minister for Home Affairs and Cybersecurity, Tony Burke referred the legislation to Parliamentary Joint Committee on Intelligence and Security (PJCIS) for review.

The committee has put out a call for submissions to inform their review of the legislation. Information on providing a submission to its inquiry can be found here: Cyber Security Legislative Package 2024 – Parliament of Australia (aph.gov.au) with submissions closing on 25 October (Australian EDT).