Cyber Security

Current status

This bill became law on Nov 29th, 2024.

Policy area

Immigration, border & security

What does this bill do?

Australia can now require makers and sellers of internet-connected and network-connected smart devices to meet cyber security standards before those products are sold here.

Why was it introduced?

More frequent, sophisticated cyber attacks and Australia’s fragmented, voluntary smart-device security rules left gaps in protection and poor visibility of ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payments and major incidents. The bill lets the government set mandatory security standards for connected devices, requires ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payment reporting, protects incident-sharing, and creates a review board.

Broader context

Australia had a voluntary 2020 code for consumer smart devices, but a 2021 government study found low uptake, while major breaches including Optus and Medibank in 2022 and MediSecure in 2024 exposed how weak device safeguards, underreported ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payments and hesitant incident reporting were leaving government with poor visibility of cyber threats. After releasing a legislative reforms consultation paper in December 2023 and an exposure draftA draft version of proposed law released for public feedback before the bill was finalised. in September 2024, the government passed the Cyber Security Bill in November 2024 to make smart-device standards mandatory, require ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payment reporting, protect information shared during major incidents and set up post-incident reviews.

Key criticism

The main criticism was that the bill was pushed through too quickly and still left unresolved drafting and safeguard issues, especially around international standards, safe-harbour protections and how independent the cyber incident review boardThe independent body created by the act to review serious cyber attacks after they happen and publish recommendations. would be. Those concerns were raised mainly by the Greens and Coalition speakers, but no party represented in the debate opposed the bill's overall passage.

Who supported it?

Hon Tony Burke MP introduced this bill. It passed on the voices.

Introduced in House 09 Oct 2024
Passed House 20 Nov 2024
Passed Senate 25 Nov 2024
Became law 29 Nov 2024

Did it become law?

Yes

Became law 29 Nov 2024

Final passage

Passed without a counted vote

Members called out ‘aye’ or ‘no’ — no individual votes were recorded.

Passage speed

51 days

From introduction to the latest recorded parliamentary step

Official record

View on APH

Parliament of Australia bill page

What does this bill do?

  1. Australia can now require makers and sellers of internet-connected and network-connected smart devices to meet cyber security standards before those products are sold here.

  2. Manufacturers and suppliers must give a compliance statementA document manufacturers or suppliers must provide to show a covered device is claimed to meet the required security standard. with covered smart devices, so buyers and regulators can see the product is claimed to meet the required security standard.

  3. The government can require businesses to report ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. or cyber extortionA payment demand made by criminals who threaten to release or misuse stolen data or otherwise harm the victim if they are not paid. payments within 72 hours, giving Australia better visibility of who is paying and how attacks are happening.

  4. Businesses hit by major cyber incidents can share information with the National Cyber Security CoordinatorThe official who receives incident information from businesses and helps coordinate the government's response during major cyber incidents., and that information is meant to be used only for responding to the incident, not routine regulatory action.

  5. The Act sets up an independent Cyber Incident Review BoardThe independent body created by the act to review serious cyber attacks after they happen and publish recommendations. to examine major cyber attacks after they happen and publish recommendations to help government and industry prevent similar failures.

Show source excerpts
  1. This Act provides for mandatory security standards for certain products that can directly or indirectly connect to the internet (called relevant connectable products).
    Cyber Security as-passed bill text
  2. (d) those suppliers must supply the product in Australia accompanied by a statement of compliance.
    Cyber Security as-passed bill text
  3. Reports will be made to the Department of Home Affairs through a portal available on cyber.gov.au, which is administered by ASD's Australian Cyber Security Centre (ACSC). These reports are required to be made within 72 hours of the payment being made, or the reporting entity becoming aware of the payment being made. Critical infrastructure asset owners and operators with mandatory cyber security incident reporting obligations under Part 2B of the SOCI Act already have reporting obligations to the ASD’s ACSC through the Report Cyber portal and will be familiar with this type of process.
    Cyber Security explanatory memorandum
  4. This subsection reinforces that the intention of this Part is to encourage entities to engage with the National Cyber Security Coordinator during a cyber incident, whilst being assured that the information provided cannot be recorded, used or disclosed for law enforcement or regulatory purposes. This does not prevent disclosure for the purpose of imposing a penalty or sanction for a criminal offence as it is not the intention of the regime to protect against breaches of criminal law.
    Cyber Security explanatory memorandum
  5. In response, this Bill establishes the Board as an independent, advisory body with a clear remit to conduct no-fault, post-incident reviews of significant cyber security incidents in Australia. Following such a review, the Board will also disseminate recommendations to both Government and industry to strengthen Australia’s collective cyber resilience. This is particularly important for driving constant improvement within both the public and private sectors as cyber-enabled interference grows.
    Cyber Security explanatory memorandum

Broader context for this bill

Australia had a voluntary 2020 code for consumer smart devices, but a 2021 government study found low uptake, while major breaches including Optus and Medibank in 2022 and MediSecure in 2024 exposed how weak device safeguards, underreported ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payments and hesitant incident reporting were leaving government with poor visibility of cyber threats. After releasing a legislative reforms consultation paper in December 2023 and an exposure draftA draft version of proposed law released for public feedback before the bill was finalised. in September 2024, the government passed the Cyber Security Bill in November 2024 to make smart-device standards mandatory, require ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payment reporting, protect information shared during major incidents and set up post-incident reviews.

  1. 2020

    Government introduces a voluntary smart-device security code

    Australia adopted the voluntary Code of Practice, Securing the Internet of ThingsConnected devices that link to the internet or a network, such as smart TVs, watches, home assistants and baby monitors, which this bill brings under mandatory security rules. for Consumers, but it did not impose mandatory cyber security requirements on connected products sold here.

    Cyber Security explanatory memorandum ↗
  2. 2021

    Government study finds low uptake of the voluntary code

    A government study found manufacturers had adopted the voluntary code at low levels, reinforcing that the existing approach was fragmented and insufficient as connected devices became more common.

    Cyber Security explanatory memorandum ↗
  3. 2022 to 2024

    Optus, Medibank and MediSecure breaches expose the impact of major cyber attacks

    The explanatory memorandum cites the Optus breaches in 2022 and 2023, the Medibank breach in 2022 and the MediSecure breach in 2024 as evidence that government and industry needed stronger ways to learn from serious incidents and prepare for future attacks.

    Cyber Security explanatory memorandum ↗
  4. 19 Dec 2023

    Government releases its cyber security legislative reforms consultation paper

    The consultation paper opened work on a legislative package aimed at mandatory device standards, ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payment reporting and clearer arrangements for handling major cyber incidents.

    Cyber Security explanatory memorandum ↗
  5. 04 Sept 2024

    Department releases an exposure draftA draft version of proposed law released for public feedback before the bill was finalised. of the cyber reforms

    Home Affairs published a targeted exposure draftA draft version of proposed law released for public feedback before the bill was finalised. and received submissions focused on making the proposed incident-information protections work as intended.

    Cyber Security explanatory memorandum ↗
  6. 25 Nov 2024

    Parliament passes the bill

    Both houses passed the bill in the same form, clearing the way for a national scheme covering connected-device standards, ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payment reporting and cyber incident review arrangements.

    Parliamentary timeline ↗
  7. 29 Nov 2024

    Royal AssentThe formal step that turns a passed bill into an act of Parliament law. turns the bill into law

    Royal AssentThe formal step that turns a passed bill into an act of Parliament law. made the package law so the government could begin establishing the new reporting, information-sharing and review framework set out in the Act.

    Parliamentary timeline ↗

How did it move through Parliament?

House Senate
Introduced 09 Oct 2024

The bill was formally presented to the chamber and read a first time, which starts its parliamentary journey.

Introduced and read a first time

Second reading opened 09 Oct 2024

A minister or sponsoring member moved the second reading, opening the main debate on the bill's purpose and principles.

Second reading moved

Intelligence and Security review 10 Oct 2024

Referred to Committee (10/10/2024): Parliamentary Joint Committee on Intelligence and SecurityThe parliamentary committee that the government amendment would require to review the scheme after 1 December 2027.; Committee Report (18/11/2024)

Referred to committee

APH bill page notes
Second reading debate 18 Nov 2024

The bill reached this recorded parliamentary step.

Sent to Federation Chamber for debate 19 Nov 2024

The bill reached this recorded parliamentary step.

Referred to Federation Chamber

Federation Chamber debate 19 Nov 2024

The bill reached this recorded parliamentary step.

Second reading debate

House second reading agreed 19 Nov 2024

The chamber agreed to the bill at second reading, meaning it accepted the bill in principle and allowed it to continue.

Second reading agreed to

House agreed to amendment packages 19 Nov 2024

The chamber considered amendments before the bill moved to the next stage.

Consideration in detail debate

Returned from Federation Chamber 20 Nov 2024

The bill reached this recorded parliamentary step.

Reported from Federation Chamber

House third reading agreed 20 Nov 2024

The chamber agreed to the bill at third reading, which completed passage through that chamber.

Third reading agreed to

Introduced 25 Nov 2024

The bill was formally presented to the chamber and read a first time, which starts its parliamentary journey.

Introduced and read a first time

Second reading opened 25 Nov 2024

A minister or sponsoring member moved the second reading, opening the main debate on the bill's purpose and principles.

Second reading moved

Second reading debate 25 Nov 2024

The bill reached this recorded parliamentary step.

Senate second reading agreed 25 Nov 2024

The chamber agreed to the bill at second reading, meaning it accepted the bill in principle and allowed it to continue.

Second reading agreed to

Committee of the Whole debate 25 Nov 2024

The bill reached this recorded parliamentary step.

Senate third reading agreed 25 Nov 2024

The chamber agreed to the bill at third reading, which completed passage through that chamber.

Third reading agreed to

Passed both houses 25 Nov 2024

Both houses passed the bill in the same form, completing parliamentary passage.

Finally passed both Houses

Assent 29 Nov 2024

The Governor-General gave Royal AssentThe formal step that turns a passed bill into an act of Parliament law., turning the bill into an Act.

The main case against this bill

The main criticism was that the bill was pushed through too quickly and still left unresolved drafting and safeguard issues, especially around international standards, safe-harbour protections and how independent the cyber incident review boardThe independent body created by the act to review serious cyber attacks after they happen and publish recommendations. would be. Those concerns were raised mainly by the Greens and Coalition speakers, but no party represented in the debate opposed the bill's overall passage.

Criticism focused on scrutiny and safeguards, not on rejecting the bill's core cyber security goals.

Rushed scrutiny

Critics said the government moved the bill through Parliament too fast, limiting proper scrutiny of a complex cyber security package and increasing the risk of avoidable flaws.

Raised by Coalition speakers including Michelle Landry and James Paterson, and Greens senator David Shoebridge Source ↗

Safeguards and board independence

The strongest policy reservations were that the bill still needed changes to make it coherent and effective, including stronger safe-harbour protections, clearer use of international standards, and more independent oversight arrangements for the review board and information sharing.

Raised by David Shoebridge and Greens amendments in the Senate Source ↗

Recorded votes

How the bill itself passed

The bill passed both chambers on the voices, so there is no list of individual Aye and No votes for final passage.

Passed

House passed the bill

House agreed to the bill's third reading on the voices, so there is no list of individual Aye and No votes for final passage in that chamber.

20 Nov 2024

Passed on the voices

In a voice vote, members call out Aye or No and the presiding officer judges which side has it. Individual names are only recorded if a formal division is called.

Passed

Senate passed the bill

Senate agreed to the bill's third reading on the voices, so there is no list of individual Aye and No votes for final passage in that chamber.

25 Nov 2024

Passed on the voices

In a voice vote, members call out Aye or No and the presiding officer judges which side has it. Individual names are only recorded if a formal division is called.

Amendments at a glance

Amendments grouped by chamber. Where APH reports aggregate counts, the package card summarizes the matching public amendment sheets by source theme.

House

Carried

Government package: 4 amendments

Government amendments extend the bill’s intelligence and security review timetable to start after 1 December 2027, broaden the review’s reach across key powers and reporting triggers, and require a Parliamentary Joint Committee assessment of the Act’s operation, effectiveness and implications.

19 Nov 2024

Passed on the voices

The chamber agreed to this amendment package without a counted vote. APH records the agreed count by amendment, while the source documents are grouped into amendment sheets.

Themes in the public amendment sheets

Senate

Defeated

Senate amendment defeated

The Senate Journal records this outcome as defeated on voices.

Defeated on voices

The chamber decided this amendment without a counted division, so there is no list of individual Aye and No votes.

Defeated

Move board oversight to the Prime Minister

Senator Shoebridge's proposal, decided on voices and defeated, would have replaced references to the Minister and Department with the Prime Minister and the Prime Minister's Department for the board's oversight arrangements.

Defeated on voices

The chamber decided this amendment without a counted division, so there is no list of individual Aye and No votes.

Defeated

Require consent before sharing information with ASDThe national signals intelligence and cyber agency that administers the reporting portal used for ransomware payment reports.

Senator Shoebridge's proposal, decided on voices and defeated, would have stopped the National Cyber Security CoordinatorThe official who receives incident information from businesses and helps coordinate the government's response during major cyber incidents. sharing certain information with ASDThe national signals intelligence and cyber agency that administers the reporting portal used for ransomware payment reports. unless the entity consented or urgent steps had been taken to seek consent.

Defeated on voices

The chamber decided this amendment without a counted division, so there is no list of individual Aye and No votes.

Defeated

Consent before coordinator sharing defeated

The Senate Journal records a Shoebridge amendment outcome defeated on voices; the proposal concerned consent before sharing certain cyber information with the National Cyber Security CoordinatorThe official who receives incident information from businesses and helps coordinate the government's response during major cyber incidents..

Defeated on voices

The chamber decided this amendment without a counted division, so there is no list of individual Aye and No votes.

Who spoke, and what they said

Start here — lead voices

Sponsor speech Supports

Tony Burke

Australian Labor Party • MP 09 Oct 2024

Mr Burke supports the Cyber Security Bill and says it will give Australia a single legislative framework to strengthen cyber defences, improve ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. reporting, and support incident response.

Read in Hansard ↗
Lead supporting voice Supports

James Paterson

Liberal Party • Senator 25 Nov 2024

James Paterson says the coalition will support the Cyber Security Bill 2024, because it strengthens Australia's ability to respond to cyberthreats and includes sensible measures such as limited-use protections, smart device standards and a cyber incident review boardThe independent body created by the act to review serious cyber attacks after they happen and publish recommendations..

Read in Hansard ↗
Lead voice Supports

Tim Ayres

Australian Labor Party • Senator 25 Nov 2024

Ayres supports the Cyber Security Bill 2024 and says it provides a holistic framework to strengthen national cyber defences and resilience.

Read in Hansard ↗
Lead voice Supports

Michelle Landry

National Party • MP 18 Nov 2024

Landry says the coalition will support the Cyber Security Bill 2024 without amendment because the measures strengthen Australia’s cyber resilience and improve cooperation between industry and government.

Read in Hansard ↗

All speeches by bloc

Labor

7 speakers · 7 support

  1. Andrew Charlton Charlton supports the bill and says it is a necessary package of reforms to strengthen Australia’s cybersecurity, including standards for smart devices, ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. reporting, limited-use protections and a cyber incident review boardThe independent body created by the act to review serious cyber attacks after they happen and publish recommendations..
    “This is a package of key reforms necessary to support the continued uplift of Australia's collective cybersecurity. I want Australian citizens and businesses to be best placed to take every opportunity in the digital economy, something that cannot occur without being safe and secure online. I commend these bills to the Chamber.”

    Australian Labor Party • MP • 19 Nov 2024

    Read the full speech in Hansard ↗
  2. Tim Watts Watts supports the bill and says it is a necessary, urgent step to strengthen Australia’s response to ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. and other cyber threats.
    “This bill delivers on measures promised by our government in that strategy. It takes necessary steps to ensure that Australians and Australian businesses can enjoy the full benefit of the internet, while keeping us safe. There's an urgent need for this bill.”

    Australian Labor Party • MP • 19 Nov 2024

    Read the full speech in Hansard ↗
  3. Raff Ciccone Raff Ciccone supports the Cyber Security Bill 2024 and says it will strengthen Australia’s defences by improving incident reporting, setting device security standards, and creating a review board to learn from major cyber incidents.
    “The Albanese government is committed to lifting our country's cyber legislative strategy and doing everything it can to support Australians and small businesses around the country. The Cyber Security Bill and related bills provide an opportunity for this country and for the Senate to strengthen our national cybersecurity defences.”

    Australian Labor Party • Senator • 25 Nov 2024

    Read the full speech in Hansard ↗
  4. Helen Polley Helen Polley supports the Cyber Security Bill 2024 and recommends that it pass, saying it will strengthen Australia’s cyber defences, improve protections for consumers and victims, and help government and industry respond better to incidents.
    “We must remember that cyber crimes can impact businesses and individuals, and it's important that when you have an incident, you report it and reach out and get the support that you need. I thank Minister Burke and Minister O'Neill for their leadership, and I thank those who provided evidence to our committee to investigate this. I recommend the bill to be passed in the Senate today.”

    Australian Labor Party • Senator • 25 Nov 2024

    Read the full speech in Hansard ↗
  5. Murray Watt Watt supports the Cyber Security Bill and the wider package, saying it will strengthen national cyber defences and close gaps in Australia’s existing cybersecurity rules.
    “That committee has now handed down its report and recommended that, subject to implementation of the recommendations in its report, the package be passed by the parliament. The government agrees or agrees in principle to all 13 recommendations in the committee's report and, in line with recommendation 1, proposes the package be passed by the parliament. I thank the committee for its work on these bills through its inquiry and recommendations, and I thank all senators for their contributions to the debate on these important bills. On that basis, I commend the bills to the chamber.”

    Australian Labor Party • Senator • 25 Nov 2024

    Read the full speech in Hansard ↗

Coalition

4 speakers · 4 support

  1. Michael McCormack McCormack says the coalition supports the Cyber Security Bill 2024 because cybercrime is a major and growing threat and the bill would strengthen mandatory standards and incident reporting.
    “It is our duty, and it is the government's role, to ensure ordinary Australians are protected to the best of Australia's ability and the best of the government's ability. We must protect not just Australians but industry from cybercrime. That should be the ultimate goal: to keep Australians safe. I appreciate that that's what the government are endeavouring to do, and they have the coalition's support in just that.”

    National Party • MP • 19 Nov 2024

    Read the full speech in Hansard ↗
  2. Andrew Wallace Wallace supports the Cyber Security Bill 2024 and says the coalition will back measures like smart device standards, ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. reporting and the cyber incident review boardThe independent body created by the act to review serious cyber attacks after they happen and publish recommendations..
    “This legislation is so very important. The three bills we're debating are designed to mandate minimum cybersecurity standards for smart devices; to introduce mandatory ransomware reporting for certain businesses to report ransom payments; to introduce limited-use obligations for the National Cyber Security Coordinator and the Australian Signals Directorate, or ASD; to establish a cyber incident review board and clarify, simplify, streamline, and align existing obligations, regulations and government assistance measures.”

    Liberal National Party • MP • 19 Nov 2024

    Read the full speech in Hansard ↗

Greens

1 speaker · 1 mixed

  1. David Shoebridge Shoebridge says the cyber security bill is important, but argues it has been rushed and needs changes on international standards, safe-harbour protections and the independence of the review board.
    “I'll finish with this. This is rushed legislation that's important, and the rush is part of the problem. I move:”

    Australian Greens • Senator • 25 Nov 2024

    Read the full speech in Hansard ↗

Full record

Full chat