Cyber Security Act 2024 s 27(2) and Rules s 7 (report contents)

The report must contain, to the extent the reporting business entity knows or can find out by reasonable search or enquiry within the 72-hour period, the information the rules require (Rules s 7): its contact and business details including its ABN (if any) and address, and those of any other entity that made the payment on its behalf; for the incident, when it occurred or is estimated to have occurred, when the entity became aware of it, its impact on the entity's infrastructure and on its customers, any ransomware or other malware variants used, any vulnerabilities in the entity's systems that were exploited, and information that could help a Commonwealth or State body respond to, mitigate or resolve it; for the demand, the amount or quantum demanded (or a description where a non-monetary benefit is demanded) and the method of provision demanded; for the payment, its amount or quantum (or description) and the method of provision; and for communications with the extorting entity, their nature and timing, a brief description of them and a brief description of any pre-payment negotiations. The report is given in the form the Secretary approves (ASD's online form) and may add other incident information.