Cyber Security Legislative Package – Consultation on Subordinate Legislation

On 29 November, the Cyber Security Legislative Package received Royal Assent, which means parts of the Cyber Security Act 2024, Intelligence Services and Other Legislation Amendment (Cyber Security) Act 2024, and the Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024 (ERP Act) are now law.  

To give effect to some of the measures under the Cyber Security Act 2024 and ERP Act, subordinate legislation in the form of Rules will be required. The Department is committed to working closely with industry to develop these Rules and we invite you to participate in industry consultation.

Please join us for our virtual Town Hall where we will provide an overview of the Rules to be developed, which consist of:

• Cyber Security (Security Standards for Smart Devices) Rules 2024
• Cyber Security (Ransomware Payment Reporting) Rules 2024
• Cyber Security (Cyber Incident Review Board) Rules 2024
• Security of Critical Infrastructure (Critical infrastructure risk management program) Amendment (Data Storage Systems) Rules 2024 (Data Storage Systems Rules)
• Security of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules 2024 (TSRMP Rules)

The Department will also host a series of Deep Dives sessions on each of the Rules throughout January and February 2025. Stay tuned for more information on these sessions and how to register.