· By Nicholas “Nick” O'Sullivan, Townsville
The Department of Home Affairs, the Cyber Security Act 2024, and what it actually means for a small organisation
The Department of Home Affairs holds Australia’s cyber security policy portfolio at a federal level. Where ASD and the ACSC (see our earlier explainer) are the operational and technical agencies, Home Affairs is where the actual law and national strategy get written — including the Cyber Security Act 2024, Australia’s first standalone cyber security legislation.
The Act introduced a handful of genuinely new obligations, most of which are aimed at larger organisations rather than a five-person office or a volunteer-run charity:
Mandatory ransomware payment reporting. Businesses over a set annual turnover threshold that make a ransomware payment are required to report that payment to the government within a defined timeframe, regardless of whether they also report the underlying incident through ReportCyber. The threshold has historically been pitched at larger businesses rather than small operators — but thresholds and detail can change, so if this is genuinely relevant to your organisation, confirm the current figure directly with Home Affairs or your legal adviser rather than relying on any single article, including this one.
Mandatory security standards for smart devices. The Act introduced minimum cyber security standards for smart devices sold in Australia — relevant to anyone buying connected cameras, sensors or IoT hardware for an office, church hall or venue, since it should mean baseline security expectations are now enforceable rather than purely voluntary.
The Cyber Incident Review Board (CIRB). A no-fault board that reviews significant cyber incidents after the fact to share lessons learned, similar in spirit to how transport safety investigations work — the goal is organisational learning, not punishment.
A “limited use” obligation. Information organisations share with ASD and the National Cyber Security Coordinator during an incident response is restricted from being used against them for unrelated regulatory action. This is specifically designed to encourage businesses to ask for help during an incident without fearing it will be used to penalise them later.
If none of the mandatory reporting obligations technically apply to your organisation, the practical takeaway isn’t “this doesn’t matter.” It’s that the direction of travel is toward more structure, not less — clearer incident reporting expectations, device security baselines, and a more active government role generally. Voluntary good practice today (tested backups, MFA, a documented incident response plan, knowing who your break-glass admin is) is the same practice that keeps you ahead of wherever the regulatory bar eventually lands, rather than scrambling to catch up to it.
This sits alongside Australia’s broader Cyber Security Strategy 2023–2030, which the Cyber Security Act is one piece of. If your organisation is a charity or not-for-profit, it’s also worth reading how the strategy’s Horizon 2 action plan specifically names the NFP sector.
None of this replaces a practical review of your own environment. A Leadership Technology Review looks at what’s actually fragile in your organisation today — MFA, backups, admin access, incident readiness — regardless of which legislative threshold you do or don’t meet.
