Rushed scrutiny
Critics said the government moved the bill through Parliament too fast, limiting proper scrutiny of a complex cyber security package and increasing the risk of avoidable flaws.
This bill became law on Nov 29th, 2024.
Immigration, border & security
Australia can now require makers and sellers of internet-connected and network-connected smart devices to meet cyber security standards before those products are sold here.
More frequent, sophisticated cyber attacks and Australia’s fragmented, voluntary smart-device security rules left gaps in protection and poor visibility of ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payments and major incidents. The bill lets the government set mandatory security standards for connected devices, requires ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payment reporting, protects incident-sharing, and creates a review board.
Australia had a voluntary 2020 code for consumer smart devices, but a 2021 government study found low uptake, while major breaches including Optus and Medibank in 2022 and MediSecure in 2024 exposed how weak device safeguards, underreported ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payments and hesitant incident reporting were leaving government with poor visibility of cyber threats. After releasing a legislative reforms consultation paper in December 2023 and an exposure draftA draft version of proposed law released for public feedback before the bill was finalised. in September 2024, the government passed the Cyber Security Bill in November 2024 to make smart-device standards mandatory, require ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payment reporting, protect information shared during major incidents and set up post-incident reviews.
The main criticism was that the bill was pushed through too quickly and still left unresolved drafting and safeguard issues, especially around international standards, safe-harbour protections and how independent the cyber incident review boardThe independent body created by the act to review serious cyber attacks after they happen and publish recommendations. would be. Those concerns were raised mainly by the Greens and Coalition speakers, but no party represented in the debate opposed the bill's overall passage.
Hon Tony Burke MP introduced this bill. It passed on the voices.
Did it become law?
Yes
Became law 29 Nov 2024
Final passage
Passed without a counted vote
Members called out ‘aye’ or ‘no’ — no individual votes were recorded.
Passage speed
51 days
From introduction to the latest recorded parliamentary step
Meaning
Australia can now require makers and sellers of internet-connected and network-connected smart devices to meet cyber security standards before those products are sold here.
Manufacturers and suppliers must give a compliance statementA document manufacturers or suppliers must provide to show a covered device is claimed to meet the required security standard. with covered smart devices, so buyers and regulators can see the product is claimed to meet the required security standard.
The government can require businesses to report ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. or cyber extortionA payment demand made by criminals who threaten to release or misuse stolen data or otherwise harm the victim if they are not paid. payments within 72 hours, giving Australia better visibility of who is paying and how attacks are happening.
Businesses hit by major cyber incidents can share information with the National Cyber Security CoordinatorThe official who receives incident information from businesses and helps coordinate the government's response during major cyber incidents., and that information is meant to be used only for responding to the incident, not routine regulatory action.
The Act sets up an independent Cyber Incident Review BoardThe independent body created by the act to review serious cyber attacks after they happen and publish recommendations. to examine major cyber attacks after they happen and publish recommendations to help government and industry prevent similar failures.
This Act provides for mandatory security standards for certain products that can directly or indirectly connect to the internet (called relevant connectable products).Cyber Security as-passed bill text
(d) those suppliers must supply the product in Australia accompanied by a statement of compliance.Cyber Security as-passed bill text
Reports will be made to the Department of Home Affairs through a portal available on cyber.gov.au, which is administered by ASD's Australian Cyber Security Centre (ACSC). These reports are required to be made within 72 hours of the payment being made, or the reporting entity becoming aware of the payment being made. Critical infrastructure asset owners and operators with mandatory cyber security incident reporting obligations under Part 2B of the SOCI Act already have reporting obligations to the ASD’s ACSC through the Report Cyber portal and will be familiar with this type of process.Cyber Security explanatory memorandum
This subsection reinforces that the intention of this Part is to encourage entities to engage with the National Cyber Security Coordinator during a cyber incident, whilst being assured that the information provided cannot be recorded, used or disclosed for law enforcement or regulatory purposes. This does not prevent disclosure for the purpose of imposing a penalty or sanction for a criminal offence as it is not the intention of the regime to protect against breaches of criminal law.Cyber Security explanatory memorandum
In response, this Bill establishes the Board as an independent, advisory body with a clear remit to conduct no-fault, post-incident reviews of significant cyber security incidents in Australia. Following such a review, the Board will also disseminate recommendations to both Government and industry to strengthen Australia’s collective cyber resilience. This is particularly important for driving constant improvement within both the public and private sectors as cyber-enabled interference grows.Cyber Security explanatory memorandum
Context
Australia had a voluntary 2020 code for consumer smart devices, but a 2021 government study found low uptake, while major breaches including Optus and Medibank in 2022 and MediSecure in 2024 exposed how weak device safeguards, underreported ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payments and hesitant incident reporting were leaving government with poor visibility of cyber threats. After releasing a legislative reforms consultation paper in December 2023 and an exposure draftA draft version of proposed law released for public feedback before the bill was finalised. in September 2024, the government passed the Cyber Security Bill in November 2024 to make smart-device standards mandatory, require ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payment reporting, protect information shared during major incidents and set up post-incident reviews.
Government introduces a voluntary smart-device security code
Australia adopted the voluntary Code of Practice, Securing the Internet of ThingsConnected devices that link to the internet or a network, such as smart TVs, watches, home assistants and baby monitors, which this bill brings under mandatory security rules. for Consumers, but it did not impose mandatory cyber security requirements on connected products sold here.
Cyber Security explanatory memorandum ↗Government study finds low uptake of the voluntary code
A government study found manufacturers had adopted the voluntary code at low levels, reinforcing that the existing approach was fragmented and insufficient as connected devices became more common.
Cyber Security explanatory memorandum ↗Optus, Medibank and MediSecure breaches expose the impact of major cyber attacks
The explanatory memorandum cites the Optus breaches in 2022 and 2023, the Medibank breach in 2022 and the MediSecure breach in 2024 as evidence that government and industry needed stronger ways to learn from serious incidents and prepare for future attacks.
Cyber Security explanatory memorandum ↗Government releases its cyber security legislative reforms consultation paper
The consultation paper opened work on a legislative package aimed at mandatory device standards, ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payment reporting and clearer arrangements for handling major cyber incidents.
Cyber Security explanatory memorandum ↗Department releases an exposure draftA draft version of proposed law released for public feedback before the bill was finalised. of the cyber reforms
Home Affairs published a targeted exposure draftA draft version of proposed law released for public feedback before the bill was finalised. and received submissions focused on making the proposed incident-information protections work as intended.
Cyber Security explanatory memorandum ↗Parliament passes the bill
Both houses passed the bill in the same form, clearing the way for a national scheme covering connected-device standards, ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. payment reporting and cyber incident review arrangements.
Parliamentary timeline ↗Royal AssentThe formal step that turns a passed bill into an act of Parliament law. turns the bill into law
Royal AssentThe formal step that turns a passed bill into an act of Parliament law. made the package law so the government could begin establishing the new reporting, information-sharing and review framework set out in the Act.
Parliamentary timeline ↗Legislative route
The bill was formally presented to the chamber and read a first time, which starts its parliamentary journey.
Introduced and read a first time
A minister or sponsoring member moved the second reading, opening the main debate on the bill's purpose and principles.
Second reading moved
Referred to Committee (10/10/2024): Parliamentary Joint Committee on Intelligence and SecurityThe parliamentary committee that the government amendment would require to review the scheme after 1 December 2027.; Committee Report (18/11/2024)
Referred to committee
APH bill page notesThe bill reached this recorded parliamentary step.
The bill reached this recorded parliamentary step.
Referred to Federation Chamber
The bill reached this recorded parliamentary step.
Second reading debate
The chamber agreed to the bill at second reading, meaning it accepted the bill in principle and allowed it to continue.
Second reading agreed to
The chamber considered amendments before the bill moved to the next stage.
Consideration in detail debate
The bill reached this recorded parliamentary step.
Reported from Federation Chamber
The chamber agreed to the bill at third reading, which completed passage through that chamber.
Third reading agreed to
The bill was formally presented to the chamber and read a first time, which starts its parliamentary journey.
Introduced and read a first time
A minister or sponsoring member moved the second reading, opening the main debate on the bill's purpose and principles.
Second reading moved
The bill reached this recorded parliamentary step.
The chamber agreed to the bill at second reading, meaning it accepted the bill in principle and allowed it to continue.
Second reading agreed to
The bill reached this recorded parliamentary step.
The chamber agreed to the bill at third reading, which completed passage through that chamber.
Third reading agreed to
Both houses passed the bill in the same form, completing parliamentary passage.
Finally passed both Houses
The Governor-General gave Royal AssentThe formal step that turns a passed bill into an act of Parliament law., turning the bill into an Act.
Key criticism
The main criticism was that the bill was pushed through too quickly and still left unresolved drafting and safeguard issues, especially around international standards, safe-harbour protections and how independent the cyber incident review boardThe independent body created by the act to review serious cyber attacks after they happen and publish recommendations. would be. Those concerns were raised mainly by the Greens and Coalition speakers, but no party represented in the debate opposed the bill's overall passage.
Criticism focused on scrutiny and safeguards, not on rejecting the bill's core cyber security goals.
Rushed scrutiny
Critics said the government moved the bill through Parliament too fast, limiting proper scrutiny of a complex cyber security package and increasing the risk of avoidable flaws.
Safeguards and board independence
The strongest policy reservations were that the bill still needed changes to make it coherent and effective, including stronger safe-harbour protections, clearer use of international standards, and more independent oversight arrangements for the review board and information sharing.
Further sources
Votes
The bill passed both chambers on the voices, so there is no list of individual Aye and No votes for final passage.
House agreed to the bill's third reading on the voices, so there is no list of individual Aye and No votes for final passage in that chamber.
Passed on the voices
In a voice vote, members call out Aye or No and the presiding officer judges which side has it. Individual names are only recorded if a formal division is called.
Senate agreed to the bill's third reading on the voices, so there is no list of individual Aye and No votes for final passage in that chamber.
Passed on the voices
In a voice vote, members call out Aye or No and the presiding officer judges which side has it. Individual names are only recorded if a formal division is called.
Amendments grouped by chamber. Where APH reports aggregate counts, the package card summarizes the matching public amendment sheets by source theme.
House
Government amendments extend the bill’s intelligence and security review timetable to start after 1 December 2027, broaden the review’s reach across key powers and reporting triggers, and require a Parliamentary Joint Committee assessment of the Act’s operation, effectiveness and implications.
Passed on the voices
The chamber agreed to this amendment package without a counted vote. APH records the agreed count by amendment, while the source documents are grouped into amendment sheets.
Senate
The Senate Journal records this outcome as defeated on voices.
Defeated on voices
The chamber decided this amendment without a counted division, so there is no list of individual Aye and No votes.
Senator Shoebridge's proposal, decided on voices and defeated, would have replaced references to the Minister and Department with the Prime Minister and the Prime Minister's Department for the board's oversight arrangements.
Defeated on voices
The chamber decided this amendment without a counted division, so there is no list of individual Aye and No votes.
Senator Shoebridge's proposal, decided on voices and defeated, would have stopped the National Cyber Security CoordinatorThe official who receives incident information from businesses and helps coordinate the government's response during major cyber incidents. sharing certain information with ASDThe national signals intelligence and cyber agency that administers the reporting portal used for ransomware payment reports. unless the entity consented or urgent steps had been taken to seek consent.
Defeated on voices
The chamber decided this amendment without a counted division, so there is no list of individual Aye and No votes.
The Senate Journal records a Shoebridge amendment outcome defeated on voices; the proposal concerned consent before sharing certain cyber information with the National Cyber Security CoordinatorThe official who receives incident information from businesses and helps coordinate the government's response during major cyber incidents..
Defeated on voices
The chamber decided this amendment without a counted division, so there is no list of individual Aye and No votes.
Parliamentary debate
Start here — lead voices
Mr Burke supports the Cyber Security Bill and says it will give Australia a single legislative framework to strengthen cyber defences, improve ransomwareMalicious software that locks or disrupts systems until payment is made, which is one of the incident types this bill requires to be reported. reporting, and support incident response.
Read in Hansard ↗James Paterson says the coalition will support the Cyber Security Bill 2024, because it strengthens Australia's ability to respond to cyberthreats and includes sensible measures such as limited-use protections, smart device standards and a cyber incident review boardThe independent body created by the act to review serious cyber attacks after they happen and publish recommendations..
Read in Hansard ↗Ayres supports the Cyber Security Bill 2024 and says it provides a holistic framework to strengthen national cyber defences and resilience.
Read in Hansard ↗Landry says the coalition will support the Cyber Security Bill 2024 without amendment because the measures strengthen Australia’s cyber resilience and improve cooperation between industry and government.
Read in Hansard ↗All speeches by bloc
7 speakers · 7 support
“The Cyber Security Bill provides this framework, bringing together measures to achieve the Australian Government's vision under one holistic piece of legislation.”Read the full speech in Hansard ↗
“This is a package of key reforms necessary to support the continued uplift of Australia's collective cybersecurity. I want Australian citizens and businesses to be best placed to take every opportunity in the digital economy, something that cannot occur without being safe and secure online. I commend these bills to the Chamber.”Read the full speech in Hansard ↗
“This bill delivers on measures promised by our government in that strategy. It takes necessary steps to ensure that Australians and Australian businesses can enjoy the full benefit of the internet, while keeping us safe. There's an urgent need for this bill.”Read the full speech in Hansard ↗
“The Albanese government is committed to lifting our country's cyber legislative strategy and doing everything it can to support Australians and small businesses around the country. The Cyber Security Bill and related bills provide an opportunity for this country and for the Senate to strengthen our national cybersecurity defences.”Read the full speech in Hansard ↗
“We must remember that cyber crimes can impact businesses and individuals, and it's important that when you have an incident, you report it and reach out and get the support that you need. I thank Minister Burke and Minister O'Neill for their leadership, and I thank those who provided evidence to our committee to investigate this. I recommend the bill to be passed in the Senate today.”Read the full speech in Hansard ↗
“I commend the bill to the chamber.”Read the full speech in Hansard ↗
“That committee has now handed down its report and recommended that, subject to implementation of the recommendations in its report, the package be passed by the parliament. The government agrees or agrees in principle to all 13 recommendations in the committee's report and, in line with recommendation 1, proposes the package be passed by the parliament. I thank the committee for its work on these bills through its inquiry and recommendations, and I thank all senators for their contributions to the debate on these important bills. On that basis, I commend the bills to the chamber.”Read the full speech in Hansard ↗
4 speakers · 4 support
“As I said, the coalition supports the policy intent of this legislative package. In the face of a complex and evolving threat environment, the government needs robust levers to protect Australians from cyberthreats. We will always support sensible changes which ensure our legislation is fit for purpose to tackle the ever-evolving cyberthreats facing Australia, which is why we will be supporting the passage of these bills and the accompanying government amendments.”Read the full speech in Hansard ↗
“The coalition supports the policy intent of the legislative package. In the face of a complex and evolving threat environment, the Commonwealth government needs robust leaders to protect Australians from cyberthreats. Industry should also be able to engage quickly and confidently with government in responding to cyber challenges, and we welcome the limited use provisions which will go some way to facilitating this culture of cooperation. The coalition will be supporting these bills without amendment.”Read the full speech in Hansard ↗
“It is our duty, and it is the government's role, to ensure ordinary Australians are protected to the best of Australia's ability and the best of the government's ability. We must protect not just Australians but industry from cybercrime. That should be the ultimate goal: to keep Australians safe. I appreciate that that's what the government are endeavouring to do, and they have the coalition's support in just that.”Read the full speech in Hansard ↗
“This legislation is so very important. The three bills we're debating are designed to mandate minimum cybersecurity standards for smart devices; to introduce mandatory ransomware reporting for certain businesses to report ransom payments; to introduce limited-use obligations for the National Cyber Security Coordinator and the Australian Signals Directorate, or ASD; to establish a cyber incident review board and clarify, simplify, streamline, and align existing obligations, regulations and government assistance measures.”Read the full speech in Hansard ↗
1 speaker · 1 mixed
“I'll finish with this. This is rushed legislation that's important, and the rush is part of the problem. I move:”Read the full speech in Hansard ↗
Record
House · Introduced and read a first time
Introduced
The bill was formally presented to the chamber and read a first time, which starts its parliamentary journey.
House · Second reading moved
Second reading opened
A minister or sponsoring member moved the second reading, opening the main debate on the bill's purpose and principles.
House · Second reading debate
Second reading debate
The bill reached this recorded parliamentary step.
House · Referred to Federation Chamber
Referred to Federation Chamber
The bill reached this recorded parliamentary step.
House · Second reading debate
Second reading debate
The bill reached this recorded parliamentary step.
House · Second reading agreed to
Second reading agreed
The chamber agreed to the bill at second reading, meaning it accepted the bill in principle and allowed it to continue.
House · Consideration in detail: amendments considered
Amendment packages agreed
The chamber considered amendments before the bill moved to the next stage.
House · Reported from Federation Chamber
Reported from Federation Chamber
The bill reached this recorded parliamentary step.
House · Third reading agreed to
Third reading agreed
The chamber agreed to the bill at third reading, which completed passage through that chamber.
Senate · Introduced and read a first time
Introduced
The bill was formally presented to the chamber and read a first time, which starts its parliamentary journey.
Senate · Second reading moved
Second reading opened
A minister or sponsoring member moved the second reading, opening the main debate on the bill's purpose and principles.
Senate · Second reading debate
Second reading debate
The bill reached this recorded parliamentary step.
Senate · Second reading agreed to
Second reading agreed
The chamber agreed to the bill at second reading, meaning it accepted the bill in principle and allowed it to continue.
Senate · Committee of the Whole debate
Committee of the Whole debate
The bill reached this recorded parliamentary step.
Senate · Third reading agreed to
Third reading agreed
The chamber agreed to the bill at third reading, which completed passage through that chamber.
Parliament · Finally passed both Houses
Passed both houses
Both houses passed the bill in the same form, completing parliamentary passage.
Assent · Assent
Assent
The Governor-General gave Royal AssentThe formal step that turns a passed bill into an act of Parliament law., turning the bill into an Act.
Parliamentary Joint Committee on Intelligence and Security; Committee Report (18/11/2024)
Referred to committee
Referred to Committee (10 Oct 2024): Parliamentary Joint Committee on Intelligence and Security; Committee Report (18 Nov 2024)
APH bill page notes