Ransomware Payment Reporting: The 72-Hour Rule Explained

A new clock in your incident response plan

Most Australian incident response plans track two deadlines: the Notifiable Data Breaches scheme under the Privacy Act, and any critical infrastructure reporting that applies. Since 30 May 2025, there's a third.

Part 3 of the Cyber Security Act 2024 requires in-scope businesses to report ransomware and cyber extortion payments to the Australian Signals Directorate (ASD) within 72 hours. The first phase of the rollout focused on education. From 2026, regulators have made clear they expect full compliance.

If your business relies on an MSP for security, this deadline will often pass while your provider is still in the middle of the incident. Here's what you need to know.

Who is caught

You must report if your organisation:

• carries on business in Australia with annual turnover above A$3 million, or
• is a responsible entity for a critical infrastructure asset under the SOCI Act,

and a ransomware or extortion payment is made by you or on your behalf, whether in cash, cryptocurrency or any other form of value.

Note what triggers the obligation: the payment, not the attack. If you're hit, refuse to pay and restore from backup, this particular report doesn't apply (though other obligations, such as notifiable data breach reporting, still might).

The 72-hour window

The clock starts when the payment is made, or when you become aware it was made. That second trigger matters. If an insurer, negotiator or your MSP pays on your behalf without telling you straight away, your 72 hours start when you find out.

What goes in the report

Reports go to ASD through the cyber.gov.au portal. Expect to provide:

• your organisation's details, and the details of anyone who paid on your behalf
• when and how the incident happened, and its impact
• the amount and form of the demand and of the payment
• what you know about the attacker and any communications with them
• vulnerabilities exploited and indicators of compromise, if known

The law limits how the information can be used. Reported information can't generally be used against you for most other regulatory purposes. That's meant to encourage honest reporting instead of quiet payments.

Failure to report is a civil penalty provision, with a maximum of 60 penalty units.

Where your MSP fits

This is where most contracts fall short. In a typical managed security arrangement:

• the MSP or MSSP holds the technical evidence (timelines, IOCs, attack vector)
• the insurer's incident response panel often runs negotiation and payment
• your organisation carries the legal reporting obligation

Unless your contract allocates those tasks, everyone assumes someone else will handle it. Look at your MSA and incident response schedule for:

1. A named owner for preparing the ransomware payment report
2. A commitment to hand over evidence (timeline, IOCs, vulnerability details) within a set time, say 24 hours
3. Notification duties. The MSP must tell you immediately if it learns of a payment made on your behalf
4. Cost allocation. Is incident support inside the managed fee or billed hourly? Our MSP contract red flags guide covers the "incident response is out of scope" trap.

If none of this is written down, add it at your next contract renewal.

Updating your incident response plan

Add a ransomware payment branch to your playbook:

• Decision gate: who authorises a payment? Board, CEO, insurer? Write it down before you need it.
• Sanctions check: paying a sanctioned group can breach Australian sanctions law. Your insurer and legal adviser need to clear this first.
• 72-hour timer: starts at payment or awareness. Assign a single owner.
• Parallel obligations: NDB assessment (30 days to assess a suspected eligible breach), SOCI reporting if relevant, and your cyber insurer's own notification terms.

Our incident response plan guide, data breach response plan and cybersecurity incident response guide give you templates to build on.

Insurance is shifting too

Australian cyber insurers are tightening ransom cover, raising premiums and requiring stronger controls. Our look at the MSP insurance crisis explains why. Mandatory reporting gives the government and insurers far better data on how often Australian businesses pay. Expect underwriting questions about your ransomware response process, including who reports.

The best report is the one you never file

Reporting rules don't stop attacks. Controls do. Tested, offline backups mean you're never forced to pay. Our backup and disaster recovery guide and disaster recovery testing guide are a good place to check whether your MSP's restore claims hold up. Then ask your MSP for their last restore test date. If they can't answer quickly, that's your real risk.

This article is general information, not legal advice. Check the current guidance on cyber.gov.au and get legal advice for specific incidents.