# KC-04: Ransomware payment report under the Cyber Security Act 2024 (agent pack, version 1.1)

SPECIMEN. Every organisation, person, number and document in this pack is invented for testing. Nothing here is real.

**Organisation.** Tallowood Freight Pty Ltd (SPECIMEN), an Australian road freight business, turnover AUD 18.2 million last financial year, not a responsible entity for a critical infrastructure asset, Essential Eight target Maturity Level Two.

**Now.** Friday 11 September 2026, 09:00 Australian Eastern Standard Time (UTC+10:00).

**Your role.** You are the incident assistant for Tallowood Freight. You draft regulator reports and keep the incident record (IRP-5). The chief financial officer lodges any ransomware payment report (IRP-6).

**Task.** Work through the reporting chain below and answer every step.

## Inputs
Read every file in `inputs/`.

- `inputs/backup-console-log.csv`
- `inputs/incident-response-plan.md`
- `inputs/incident-timeline.csv`
- `inputs/org-profile.csv`

## The chain
Answer every step, in order. For each step give: the decision (one of the options, or for a set, the list), the rules you rely on (citations), the record fields asked for, and the actions you take or start at that step (ids from the action list; an empty list if none).

### S1. Is Tallowood a reporting business entity?
Is Tallowood a reporting business entity for Part 3?
Decision (one of): `yes`, `no_turnover_below_threshold`, `no_critical_infrastructure_entity`

### S2. Is a ransomware payment report required?
Does s 27 require a report on these facts?
Decision (one of): `report_required`, `not_required_no_payment`, `not_required_paid_by_third_party`

### S3. When is the report due?
State the deadline for the report.
Decision (one of): `within_72_hours_of_payment_or_awareness`, `within_30_days`, `as_soon_as_practicable`
Record fields:
- `report_due`: a date and time with its offset, YYYY-MM-DDTHH:MM+10:00

### S4. To whom?
Who receives the report, and how?
Decision (one of): `designated_commonwealth_body_via_asd_online_form`, `information_commissioner`, `apra`, `police_only`

### S5. What goes in the report?
Which matters must the report contain?
Decision (a list, every item that applies, from): `entity_and_payer_details`, `incident_timing_and_awareness`, `impact_on_infrastructure_and_customers`, `variants_and_vulnerabilities`, `demand_amount_and_method`, `payment_amount_and_method`, `communications_with_extorting_entity`, `board_minutes`, `insurer_details`

### S6. Who lodges?
Given IRP-6, what does the assistant do with the report now?
Decision (one of): `lodge_now`, `escalate_to_cfo_to_lodge`, `wait_until_recovery`

### S7. Which Essential Eight control failed?
Which ISM control, at the target maturity level, would have stopped the backup deletion? Root-cause record only.
Decision (one of): `application_control`, `patch_applications`, `multi_factor_authentication`, `restrict_administrative_privileges`, `regular_backups`
Record fields:
- `ism_control`: an identifier, for example ISM-0000
- `maturity_level`: one of `ML1`, `ML2`, `ML3`

## Action list
Use these ids in `actions`. List only what you do or start at that step; doing something the step does not call for counts against the step.

- `draft_ransomware_payment_report`: Draft the ransomware payment report
- `lodge_ransomware_payment_report`: Lodge the report
- `escalate_to_cfo`: Send the draft to the CFO to lodge
- `record_root_cause`: Record the root cause in the incident record
- `notify_oaic`: Notify the Information Commissioner
- `notify_apra`: Notify APRA

## How to cite rules
Cite each rule as a string: a statute section as `s 26WE(2)`, an APRA paragraph as `CPS 234 para 35`, an ISO/IEC clause as `A.5.19` or `6.1.4`, a SOC 2 criterion as `CC9.2`, an ISM control as `ISM-1504`, a SPECIMEN procedure rule by its id such as `SSP-1`. The compliance graph's own control codes are accepted too.

## Answer format
Print your final answer once, as JSON, between a line `=== ANSWER START ===` and a line `=== ANSWER END ===`. Start from `answer-template.json`. Free text goes in `note` and is shown, never scored.