Towards a Unified Cyber Incident Reporting Mechanism for Australia

Connor Maloney, Y20 2026, Curtin University

Executive Summary

Australia’s cyber incident reporting obligations are fragmented across multiple statutory instruments, each administered by different agencies with misaligned definitions, thresholds, and timeframes. A single cyber incident can trigger separate reporting obligations to six or more agencies. This matters because, as of 2024–25, only 35 per cent of federal government entities reported at least half of the incidents they observed, likely due to the overlapping obligations. This fragmentation delays threat intelligence, increases compliance burden, and weakens Australia’s capacity to respond to large-scale cyber events affecting essential services.

This paper recommends amending the Security of Critical Infrastructure Act 2018 (Cth) to establish a National Unified Cyber Incident Portal: a single digital interface through which organisations submit one structured report, with backend classification logic routing relevant fields to the appropriate regulators. The Department of Home Affairs would lead implementation, with the Australian Signals Directorate (ASD) administering the portal. Total estimated cost is A$55–95 million over five years, funded through the ASD’s existing REDSPICE programme. The most significant barriers are legacy IT infrastructure across federal agencies, the projected cybersecurity workforce shortfall, and institutional resistance from regulators reluctant to cede direct reporting relationships. While these represent significant issues, they can be mitigated. A unified reporting mechanism is critical to giving Australia a consolidated national picture of the cyber threats facing its critical infrastructure.

Problem Identification

In Australia, cyber incident reporting obligations sit across multiple statutory instruments. These include the Security of Critical Infrastructure Act 2018 (Cth) (the SoCI Act), the Privacy Act 1988 (Cth), the Cyber Security Act 2024 (Cth), and the Australian Prudential Regulation Authority (APRA) Prudential Standard CPS 234. Each instrument is administered by a separate agency, with different thresholds, timeframes, and definitions of a reportable incident. Each also captures a different population of obligated entities: critical infrastructure operators across 11 sectors under the SoCI Act, businesses with turnover above A$3 million and certain other Australian Privacy Principles (APP) entities under the Privacy Act, and APRA-regulated financial institutions under CPS 234. A single incident may trigger separate obligations to six or more of these agencies simultaneously (Miralis et al. 2026). This structure creates confusion about compliance, leads to duplication, and creates gaps in national-level threat visibility (Ruj et al. 2024).

The Australian Cyber Security Centre (ACSC) recorded over 1,200 cybersecurity incidents in 2024–25, an 11 per cent increase on the previous year, with critical infrastructure accounting for 13 per cent of these (Ribeiro 2025). As of the 2024–25 financial year, only 35 per cent of federal government entities reported at least half of the cyber incidents affecting their systems to the ASD (Croft 2026). The United States Department of Homeland Security (DHS) Cyber Incident Reporting Council identified a comparable pattern of under-reporting across 45 federal reporting requirements, noting that inconsistencies in definitions, timelines, and reporting mechanisms reduce the quality and timeliness of incident data (DHS 2023).

Without reform, these issues will deepen as incident volumes rise. Fragmented reporting structures slow coordinated responses during large-scale events (Ladewig 2018). Malicious actors routinely attack critical infrastructure. Thus, continued fragmentation may weaken Australia’s capacity to detect cascading incidents across sectors, such as disruptions to energy and telecommunications networks or supply chains affecting multiple critical infrastructure operators (Office of Impact Analysis 2020). Any viable solution will need to overcome regulator reluctance to cede direct reporting relationships, integrate with legacy systems, and operate reliably during peak-demand cyber events

Context

Background

Australia's federal cyber incident reporting regime did not appear as a unified framework. Rather, it has accumulated incrementally over the past decade, with each reform addressing a discrete gap without consolidating pre-existing approaches (Table 1). Each instrument uses different definitions, different thresholds, and different timeframes

Table 1: Statutory Instruments

Instrument	Scope	Reporting Trigger	Reporting Deadline	Regulator	Goal
Privacy Amendment (Notifiable Data Breaches) Act 2017 (Cth) (NDB Scheme)	Australian privacy principles (APP) entities and certain other organisations	Eligible data breach that is likely to result in “serious harm”	Assessment within 30 days; notification required as soon as practicable	Office of the Australian Information Commissioner (OAIC)	To establish a mandatory reporting system, replacing a voluntary system
APRA Prudential Standard CPS 234 (2019)	APRA-regulated financial entities	Material information security incidents	Notify APRA “as soon as possible,” and within 72 hours for material incidents	Australian Prudential Regulation Authority (APRA)	To improve the cyber resilience and information security of financial institutions
Security Legislation Amendment (Critical Infrastructure) Act 2021 (Cth), inserting Part 2B into the Security of Critical Infrastructure Act 2018 (Cth)	Critical infrastructure entities	Cybersecurity incidents affecting critical infrastructure assets, such as communications  facilities	12 hours for critical incidents; 72 hours for other incidents	Australian Cyber Security Centre (ACSC)	To address critical visibility gaps during escalating cyber threats
Cyber Security Act 2024 (Cth)	Entities with annual turnover exceeding $3 million	Ransomware or cyber extortion payment made by reporting business entities	Within 72 hours of making the payment	Australian Signals Directorate (ASD)	To address critical legislative gaps and strengthen national cyber resilience.

 This structural incoherence has been widely recognised but remains unresolved . KPMG (2023) recommended that the government conduct and publicly release a systematic audit of all existing cyber incident reporting legislation, mapping where obligations across agencies overlap, conflict, or leave gaps, as a necessary first step toward consolidation. The University of Queensland Cyber Research Centre and AUSCERT (2023) called for harmonisation across government cybersecurity agencies at both state and federal levels. This position was supported by researchers at the University of New South Wales, who argued that the proliferation of separate, inconsistent reporting obligations imposes a disproportionate compliance burden and reduces the quality of national threat data (Ruj et al. 2024). However, individual regulators, while broadly supportive of harmonisation in principle, have resisted reforms that could dilute their direct oversight. The OAIC (2023) has insisted that any reform must preserve the NDB scheme and its enforcement powers under the Privacy Act. This institutional position illustrates the core tension: the same regulators whose cooperation is necessary for reform have the strongest institutional incentive to resist it.

The practical consequences of this fragmentation became visible in 2022. The Optus and Medibank data breaches, which collectively compromised the personal information of nearly 20 million Australians, triggered parallel investigations by the OAIC, the Australian Communications and Media Authority (ACMA), and APRA, with each regulator pursuing separate enforcement actions under different statutory instruments (ACS Information Age 2025). This resulted in a duplication of effort and reporting.

Case Studies

A single-entry point (SEP) is an online portal through which organisations submit a single incident report, which is automatically shared with all relevant regulators. This "report once, share many" model is being adopted by the European Union and the United States (Table 2). The European Commission's Digital Omnibus package (November 2025) proposes a SEP, operated by the European Union Agency for Cybersecurity (ENISA), that covers multiple reporting obligations. With the following provisional agreement between the Council and Parliament in May 2026, formal adoption is expected in 2026, with the SEP applying 18 months after entry into force. However, the Commission will not change the underlying legal requirements for incident reporting, meaning organisations will continue to navigate differing timeframes and thresholds through a single interface (Houston et al. 2025).

In the United States, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) directed the Cybersecurity and Infrastructure Security Agency (CISA) to develop unified reporting rules for cyber incidents (CISA 2024). The CIRCIA final rule was delayed from October 2025 to May 2026, following industry submissions that argued the proposed rule was overly broad and failed to harmonise with existing federal requirements (Davis Wright Tremaine 2025). As of mid-2026, the final rule is expected in late 2026 after repeated delays, and the Government Accountability Office (2026) has recommended combining standardised terminology, deconflicted reporting, centralised channels, and clearer legal protections into a package.

Table 2: Comparison of jurisdiction

Jurisdiction	How an organisation reports today	Moving to a single-entry point?
Australia	Separate reports to up to six or more bodies (ASD, OAIC, APRA, AFP, state agencies) under different laws	Committed to the 2023–30 Strategy; so far, only a directory page exists on cyber.gov.au
European Union	Historically separate reports under NIS2, GDPR, and DORA	Yes: the Digital Omnibus (Nov 2025) proposes one EU SEP run by ENISA; not yet operational
United States	Separate reports to 22+ agencies	No unified portal; the final rule (CIRCIA) only takes effect from late 2026

Policy Options

Evaluating reform to Australia's cyber incident reporting framework requires clear metrics tied directly to the core problem of fragmentation. Success can be measured along two dimensions: the volume of incident reports submitted and the speed with which incidents are reported after detection. An increase in report volume would indicate that underreporting has been addressed. At the same time, a reduction in detection-to-report time would signal that compliance has become easier to navigate across agencies. 

Option 1: Upgrade the ACSC Single Reporting Portal into a Guided Tool (Non-Legislative)

This option would upgrade the existing cyber.gov.au ‘Single Reporting Portal’, currently a static directory of links to separate agency channels, into an interactive triage tool. An organisation would answer a short series of questions (incident type, sector, whether personal information is involved, annual turnover) and be told exactly which agencies it must report to, with direct links and pre-filled reference details for each. This requires no legislative change and leaves every underlying obligation untouched: organisations would still lodge separate reports with each relevant agency, but with less confusion about which channels apply.

This is the cheapest option, estimated at approximately A$2–4 million over twelve months for development and integration with existing agency intake pages, plus minor ongoing maintenance.  The ASD/ACSC would build and host the tool within its existing infrastructure. It is a genuine improvement on the status quo because it reduces navigational burden. It does not, however, reduce duplication, eliminate inconsistent reporting across agencies, or create a single national data source. It does not, however, reduce duplication, create a single national data source, or shorten detection-to-report times, and would likely yield only marginal gains against the success metrics. 

Option 2: Amend the Security of Critical Infrastructure Act 2018 to Introduce a National Unified Cyber Incident Portal.

This option would amend the SoCI Act to create a single mandatory reporting obligation, fulfilled through a unified digital portal that automatically routes incident information to relevant agencies, such as the OAIC, the Australian Federal Police (AFP), ScamWatch, eSafety, and state-based bodies, based on incident classification. The amending legislation would simultaneously harmonise the definitions, thresholds and timeframes across the four instruments, incorporating the standardisation element of Option Three as a necessary component. In practice, this could look like an organisation experiencing a ransomware attack that affects personal data, submitting a single report, with the system handling agency notification on the backend. This directly meets the critical success measure by eliminating duplication, reducing the compliance burden, and enabling faster, more complete national threat visibility from a single data source.

This is the most expensive option, with an estimated cost of A$55–95 million over five years, due to portal development, legislative reform, and agency integration. The ASD/ACSC would administer the portal, with the Department of Home Affairs retaining policy oversight. It offers the advantage of reduced compliance burden, improved reporting completeness, and faster whole-of-nation threat intelligence. Drawbacks include the complexity of integrating existing agency systems and the need to maintain legacy reporting pathways during the transition period.

Option 3: Amend the Security of Critical Infrastructure Act 2018 to Establish Standardised Reporting Obligations Across Agencies 

This option would pursue harmonisation without channel unification: amending the SoCI Act to require all relevant agencies to adopt standardised reporting templates, common terminology, and aligned timeframes. At the same time, organisations continue submitting reports through existing agency channels. In practice, a cyber incident affecting both critical infrastructure and personal data would still require separate submissions to the ACSC and the OAIC, but with consistent fields and formats. 

The cost would be moderate (approximately A$10–20 million) over two to three years and largely one-off, comprising legislative drafting, interagency coordination, and system updates to existing portals. This partially addresses the critical success measure by reducing confusion about which information to report and improving data quality. The Department of Home Affairs would lead the implementation in coordination with the OAIC, the AFP, and ASD/ACSC. This approach offers low disruption to existing agency structures and faster implementation than a full portal build. However, it does not meaningfully reduce the compliance burden; organisations will still navigate multiple systems from different agencies, and compliance rates are unlikely to improve significantly without eliminating the fragmentation altogether.

Policy Recommendation

Option Two, to amend the Security of Critical Infrastructure Act 2018 to establish an NUCIP, is recommended as the most viable path forward to reduce reporting fragmentation, increase compliance rates, and strengthen Australia’s cybersecurity. Options One and Three each address symptoms such as navigational confusion and inconsistency, but neither eliminates duplication nor produces a single national data source (Ruj et al. 2024).  Only a unified submission mechanism, modelled on the European Union’s ‘report once, share many’ principle (European Commission 2025), would reduce the compliance burden while consolidating national-level threat intelligence into a single data source. Unlike the EU proposal, the underlying obligations would be harmonised simultaneously.

Implementation

The Department of Home Affairs should lead implementation in coordination with ASD/ACSC, which would administer the portal's day-to-day operations. Legislative reform would require amending Part 2B of the SoCI Act to insert a new section establishing the NUCIP as the single mandatory reporting channel for cyber incidents that trigger obligations under the SoCI Act, the Privacy Act 1988 (Part IIIC), the Cyber Security Act 2024, and APRA Prudential Standard CPS 234. Consequential amendments to each of these instruments would be required to recognise a NUCIP submission as satisfying existing reporting obligations, and to align the definitions, thresholds and timeframes each instrument applies, preserving each regulator's statutory functions without requiring separate submissions. This approach adapts the EU's Digital Omnibus architecture (Bird & Bird 2025) while correcting its principal weakness: where the EU proposal leaves differing thresholds and timeframes intact behind a single interface, the NUCIP's consequential amendments would harmonise them.

The portal would serve as a single digital interface through which an organisation submits one structured report. Backend classification logic would automatically route relevant fields to OAIC, AFP, APRA, ACMA, state-based bodies, and sector regulators based on incident type, affected data, and sector. This preserves each agency’s regulatory independence while eliminating the compliance burden of duplicate submissions. Development should follow a phased approach (Table 3).

Table 3: Implementation timeline

Phase	Duration	Key activities
1. Legislation	9–12 months	Draft SoCI Act amendments and consequential amendments; consult regulators and industry; passage through Parliament (runs partly in parallel with Phase 2)
2. Design and procurement	6 months	Requirements gathering, ASD's C1–C6 incident categorisation matrix , vendor procurement
3. Build and integration	12 months	Core portal build; APIs to OAIC, APRA, AFP, and state bodies; reuse of CTIS and ReportCyber components
4. Security and pilot	6 months	ISM/PSPF accreditation; pilot with volunteer critical infrastructure entities
5. Phased rollout	12–18 months	Mandatory use is brought in sector by sector as each agency integration is certified; legacy channels are retired on a legislated sunset.

The phased rollout would begin with SoCI critical infrastructure entities (the smallest, best-resourced group), then extend to APP entities and APRA-regulated entities as each agency’s integration is certified, avoiding a single high-risk switch-on.

Funding

These estimates are informed by comparable Australian government digital platforms: the myGov portal was originally budgeted at A$29.7 million but ultimately cost A$86.7 million (ANAO 2023), while the My Health Record system consumed A$1.15 billion between 2012 and 2016 (ANAO 2019); both were far larger in scope and user base than a NUCIP. Funding should be drawn from ASD’s existing REDSPICE programme (A$9.9 billion over ten years), within which the portal represents less than one per cent of total allocation (iTnews 2022). Additional staffing of approximately 25–40 FTE within ASD/ACSC would be required for portal operations, triage, and routing functions, with costs absorbed within REDSPICE’s target of 1,900 additional ASD personnel. 

Table 4: Funding

Component	Estimate
Portal development (2–3 years)	A$30–50 million
API integration with agencies	A$5–10 million
ISM/PSPF security accreditation	A$2–5 million
Legislative drafting and consultation	A$2–5 million
Annual operations (ongoing)	A$8–15 million per year
Indicative five-year total	A$55–95 million

Measuring Success

Success should be evaluated against four specific metrics, assessed annually by the Cyber and Infrastructure Security Centre and reported to the Parliamentary Joint Committee on Intelligence and Security (PJCIS):

• The percentage of federal entities reporting at least half of observed cyber incidents to ASD should increase from the current 35 per cent baseline (Croft 2026) to above 70 per cent within three years of full rollout. 

• The median time between incident detection and report submission should decrease by at least 40 per cent within three years of full rollout 

• The total number of cyber incident reports received nationally should increase year-on-year as the compliance burden decreases, given that ASD recorded over 1,200 incidents in FY2024–25 despite widespread under-reporting (Ribeiro 2025).

• The proportion of ransomware incidents reported should rise from the current estimated 20 per cent to above 50 per cent within three years, given that the Cyber Security Act 2024’s ransomware payment reporting obligation would be integrated into the portal’s submission workflow (MinterEllison 2024). 

A formal review of the portal after two years of full operation should be incorporated into the PJCIS’s scheduled review of the SoCI Act.

Barriers and Risks

• Legacy IT systems. Commonwealth Cyber Security Posture 2025 mentions that 59% of agencies view legacy systems as preventing necessary security controls implementation. Creating an integrated portal using ageing OAIC, AFP, APRA, and state systems will require dedicated API development by each agency. It can be done; however, it will take time and requires prioritization from each agency. The phased approach, starting with the agencies that share their information with ASD via CTIS, should help to bridge the interoperability gap.

• Workforce shortage. There is a cyber security workforce shortage in Australia. Up to 30,000 vacant posts might emerge within four years, and 54% of teams are understaffed. The separation rate at ASD (around 9.2%) is approximately twice as high as the average one in public services. As a result, 25–40 new FTEs must be hired to staff the portal and remain competitive in the market. The pipeline of REDSPICE and plans for ASD cyber hubs would be helpful, but reaching the full capacity right from the start is unrealistic.

• Risk of regulatory resistance. Regulators might object to giving up their ability to receive direct reporting from agencies. OAIC (2023) stated that the reforms have to preserve the NDB scheme and powers of OAIC under the Privacy Act. Likewise, direct reporting is an essential part of the supervision conducted by APRA. If the regulators, such as OAIC or APRA, are reluctant to integrate API, then the entities supervised by them will have to report separately from the portal again, causing the problem of fragmentation that the portal was designed to address. A partial integration of the portal will cause unnecessary steps, increase burden, and undermine the reform itself – thus creating the political risk, which should be managed through Home Affairs ministerial direction and even legislation.

• Data security. A unified portal becomes a single point of failure and a single target for attacks. Centralized storage of sensitive vulnerability and breach data across critical infrastructure brings about the risk of breaches. This can be mitigated through the appropriate ISM, classification and data minimisation (storing routing metadata instead of full incidents reports) in NUCIP, but cannot be removed completely.

References

ACS Information Age. 2025. "Information Commissioner Sues Optus over 2022 Data Breach." August 11, 2025. https://ia.acs.org.au/article/2025/information-commissioner-sues-optus-over-2022-data-breach.html.

ACSC (Australian Cyber Security Centre). 2025. Annual Cyber Threat Report 2024–2025. Canberra: Australian Signals Directorate. https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025.

ANAO (Australian National Audit Office). 2019. Implementation of the My Health Record System. Auditor-General Report No. 23, 2019–20. Canberra: ANAO. https://www.anao.gov.au/work/performance-audit/implementation-the-my-health-record-system.

ANAO. 2023. myGov Digital Services. Auditor-General Report. Canberra: ANAO. https://www.anao.gov.au/work/performance-audit/mygov-digital-services.

APRA (Australian Prudential Regulation Authority). 2019. Prudential Standard CPS 234: Information Security. July 2019. https://www.apra.gov.au/sites/default/files/cps_234_july_2019_for_publication.pdf.

BCA (Business Council of Australia). 2024. "Australian Cyber Security Strategy: Legislative Reforms — Submission." March 2024. https://www.homeaffairs.gov.au/reports-and-pubs/files/cyber-security-legislative-reforms/bca-submission.PDF.

Bird & Bird. 2025. "Digital Omnibus Package: Single EU Harmonised Incident Reporting Regime across Cyber and Data Protection." December 15, 2025. https://www.twobirds.com/en/insights/2025/digital-omnibus-package-single-eu-harmonised-incident-reporting-regime-across-cyber-and-data-protect.

CISA (Cybersecurity and Infrastructure Security Agency). 2024. "Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Final Rule." Federal Register, October 2024.

Clayton Utz. 2024. "Navigating Australia’s First Standalone Cyber Security Act 2024 (Cth)." December 2024. https://www.claytonutz.com/insights/2024/december/navigating-australia-s-first-standalone-cyber-security-act-2024-cth.

Croft, Daniel. 2026. "Government Agencies Simply Aren’t Reporting Cyber Incidents to the ASD." Cyber Daily, February 13, 2026. https://www.cyberdaily.au/security/13207-government-agencies-simply-arent-reporting-cyber-incidents-to-the-asd.

Cyber and Infrastructure Security Centre. 2022. Security of Critical Infrastructure Act 2018: CISC Factsheet. https://www.cisc.gov.au/resources-subsite/Documents/cisc-factsheet-soci-obligations.pdf.

CyberCX. 2024. "Cyber Skills Shortage Approaches Crisis: New Research." CyberCX. https://cybercx.com.au/news/cyber-skills-shortage-approaches-crisis/.

Davis Wright Tremaine. 2025. "CISA Delays Cyber Incident Reporting Rules Until May 2026." September 17, 2025. https://www.dwt.com/blogs/privacy--security-law-blog/2025/09/cisa-delays-cyber-incident-reporting-rules-2026.

Department of Homeland Security. 2023. Harmonization of Cyber Incident Reporting to the Federal Government. Washington, DC: DHS Office of Strategy, Policy, and Plans. https://www.dhs.gov/sites/default/files/2023-09/DHS%20Congressional%20Report%20-%20Harmonization%20of%20Cyber%20Incident%20Reporting%20to%20the%20Federal%20Government.pdf.

Department of Home Affairs. 2025. "Consultation on Developing Horizon 2 of the 2023–2030 Australian Cyber Security Strategy." https://www.homeaffairs.gov.au/help-and-support/how-to-engage-us/consultations/consultation-horizon-2-of-2023-2030-australian-cyber-security-strategy.

Department of Home Affairs. 2026. "Horizon 2: Expanding Our Reach (2026–2028)." Australian Government. https://www.homeaffairs.gov.au/about-us/our-portfolios/cyber-security/strategy/horizon-2. 

Gadens. 2025. "New Mandatory Ransomware Payment Reporting Obligations Now in Force." June 16, 2025. https://www.gadens.com/legal-insights/new-mandatory-ransomware-payment-reporting-obligations-now-in-force/.

Government Accountability Office. 2026. Cybersecurity Regulations: Additional Industry Perspectives on the Impact, Progress, Challenges, and Opportunities of Harmonization. Washington, DC: GAO. March 2026.

Houston, Laura, Richard Jeens, Christopher Burns, and Natalie Donovan. 2025. "EU Proposes Single-Entry Point for Cyber Incident Reporting, but Is It Really ‘Report Once, Share Many’?" Slaughter and May — The Lens. https://thelens.slaughterandmay.com/post/102lxgd/eu-proposes-single-entry-point-for-cyber-incident-reporting-but-is-it-really-re.

iTnews. 2022. "ASD to Double in Size after $10bn Cyber Security Funding Boost." March 2022. https://www.itnews.com.au/news/asd-to-double-in-size-after-10bn-cyber-security-funding-boost-578035.

KPMG. 2023. 2023–2030 Australian Cyber Security Strategy Discussion Paper: KPMG Submission. https://assets.kpmg.com/content/dam/kpmgsites/au/pdf/2023/2023-2030-australian-cyber-security-strategy-discussion-paper-kpmg-submission.pdf.

Ladewig, Jonathon. 2018. "Australia’s Readiness for a Complex Cyber-Catastrophe." Australian Army Journal 14 (2). https://researchcentre.army.gov.au/library/australian-army-journal-aaj/volume-14-number-2-cyber-warfare-edition/australias-readiness-complex-cyber-catastrophe.

MinterEllison. 2024. "Building Cyber Resilience: Cyber Security Bill 2024 Insights." October 2024. https://www.minterellison.com/articles/building-a-cyber-resilience-cyber-security-bill-2024-insights.

Miralis, Dennis, Kayleen Manwaring, and Monica Whitty. 2026. "A Tangled Web: Mapping Australia’s Overlapping Cyber Incident Reporting Obligations." Journal of Law, Information and Science 27 (1).

Mondaq. 2024. "Proposed Federal Cyber Security Act: A Necessity or an Unjustified Intrusion?" Mondaq, 2024. https://www.mondaq.com/australia/privacy-protection/1533038/proposed-federal-cyber-security-act-a-necessity-or-an-unjustified-intrusion.

OAIC (Office of the Australian Information Commissioner). 2023. "Submission to 2023–2030 Cyber Security Strategy Discussion Paper." April 2023. https://www.oaic.gov.au/engage-with-us/submissions/submission-to-2023-2030-cyber-security-strategy-discussion-paper.

OAIC. 2025. "About the Notifiable Data Breaches Scheme." February 7, 2025. https://www.oaic.gov.au/privacy/notifiable-data-breaches/about-the-notifiable-data-breaches-scheme.

Office of Impact Analysis. 2020. "Protecting Critical Infrastructure and Systems of National Significance Regulatory Reforms." Department of Prime Minister & Cabinet. https://oia.pmc.gov.au/published-impact-analyses-and-reports/protecting-critical-infrastructure-and-systems-national.

Ribeiro, Anna. 2025. "ACSC Reports Surge in Cyberattacks Targeting Australia’s Critical Infrastructure, Focus Shifts to Building Resilience." Industrial Cyber, October 15, 2025. https://industrialcyber.co/reports/acsc-reports-surge-in-cyberattacks-targeting-australias-critical-infrastructure-focus-shifts-to-building-resilience/.

Ruj, Sushmita, Susanne Lloyd-Jones, Sanjay Jha, Gernot Heiser, Praveen Gauravaram, and Lyria Bennett Moses. 2024. "Submission to Department of Home Affairs on the Consultation Paper 2023–2030 Australian Cyber Security Strategy: Legislative Reforms." UNSW Sydney Library. https://unsworks.unsw.edu.au/entities/publication/cbf71827-8c53-4b8e-b2f1-85daf0f58097.

UQ Cyber and AUSCERT. 2023. "Discussion Paper 2023–2030 Australian Cyber Security Strategy: Joint Submission." University of Queensland. May 2023. https://www.cyber.uq.edu.au/article/2023/05/discussion-paper-2023-2030-australian-cyber-security-strategy.

The views and opinions expressed by Global Voices Fellows do not necessarily reflect those of the organisation or its staff.