SOCI Mandatory Cyber Security Incident Report or Ransomware Payment Report

Completed regulatory cyber incident reports made to the Australian Signals Directorate: mandatory cyber security incident reports under the Security of Critical Infrastructure Act 2018 (s 30BC critical incidents, 12 hours, written record within 84 hours of an oral report; s 30BD other incidents, 72 hours, written record within 48 hours), content entered in the ASD/ACSC "Report a cyber security incident" form (organisation, ABN, contact number, date and time the incident was identified, whether it is ongoing, incident type, Home Affairs consent), and ransomware payment reports under s 27 of the Cyber Security Act 2024. Distinct from global-security-incident-report and the OT cyber incident report classifiers, which cover internal incident and forensic reports; this one requires the regulatory reporting frame plus populated ASD form fields.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium: the statutory terms and ASD form labels are specific, but cyber.gov.au, CISC and law-firm guidance repeat the deadlines, section numbers and form questions. Enforce tiers require answered form fields rather than the questions alone, and there is no public report identifier. 85/75 are heuristic evidence tiers, not measured accuracy; test values are synthetic.
Jurisdictions: au
Regulations: Security of Critical Infrastructure Act 2018 (Cth), Cyber Security Act 2024 (Cth), Ransomware Payment Reporting Rules 2025 (Cyber Security Act 2024)
Frameworks: PSPF, QGISCF
Data categories: security, infrastructure, government
Scope: narrow
Risk rating: 9
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:(?:critical\s+)?cyber\s+security\s+incident\s+(?:report|notification)|mandatory\s+cyber\s+(?:security\s+)?incident\s+report(?:ing)?|ransomware\s+payment\s+report|critical\s+cyber\s+security\s+incident|(?:section|s\.?)\s?30B[CD]|Cyber\s+Security\s+Act\s+2024|reported\s+to\s+(?:the\s+)?(?:ASD|ACSC|Australian\s+Signals\s+Directorate))\b

Corroborative evidence keywords

significant impact, relevant impact, Operational technology systems, Information technology systems, Customer data, National Office of Cyber Security, Australian Signals Directorate, Department of Home Affairs, ransom demand, threat actor

Proximity: 300 characters

Should match

Mandatory cyber security incident report - critical (s 30BC), written record following oral report Organisation name: Tallowood Energy Pty Ltd ABN: 62 000 641 439 Contact number: 07 3555 0192 Date and time the incident was identified: 12/09/2026 03:40 Is the incident ongoing? Yes Incident type: Ransomware Impacted: Operational technology systems (distribution SCADA). Consent to share with the National Office of Cyber Security (NOCS): Yes — 85 tier - completed ASD report form for a critical incident with several answered fields and OT impact
Cyber security incident report - other incident (s 30BD) Date and time the incident was identified: 3 September 2026, 14:20 Summary: credential stuffing against the customer portal caused a relevant impact on billing availability. — 75 tier - s 30BD report with one answered form field
Ransomware payment report under the Cyber Security Act 2024 (s 27) Reporting entity: Brolga Freight Logistics Pty Ltd Amount paid: USD 180,000 in Bitcoin Date of payment: 19/09/2026 The threat actor supplied a decryptor after an initial ransom demand of USD 400,000. — 85 tier - s 27 ransomware payment report with entity, amount and payment date plus threat actor / ransom demand
Critical cyber security incident - reported to ASD by phone. Is the incident ongoing? No — 75 tier - critical incident note with one answered form question
SOCI s 30BC notification Oral report made to ASD at 06:15 on 12/09/2026; written record to follow within 84 hours. Contact number: 0412 555 318 — 85 tier - dated oral report plus contact number and ASD reference

Should not match

If your organisation is a responsible entity for a critical infrastructure asset you must report a critical cyber security incident within 12 hours of becoming aware of it (s 30BC) and other cyber security incidents within 72 hours (s 30BD). If you report orally you must make a written record within 84 hours. — cyber.gov.au / CISC guidance
Report a cyber security incident Organisation name: __________ ABN: __________ Date and time the incident was identified: ____ Is the incident ongoing? Yes / No Do you consent for this cyber incident report to be provided to the Department of Home Affairs to meet mandatory regulatory reporting requirements? Yes No Which of the following are being impacted? Information technology systems / Operational technology systems / Customer data — Blank ASD reporting form
SOCI Act explained: the 12-hour and 72-hour mandatory cyber incident reporting deadlines, what counts as a significant impact, and how the Cyber Security Act 2024 adds ransomware payment reporting. This article is general information only. — Law-firm article
Ransomware payment reporting under the Cyber Security Act 2024 gives affected businesses 72 hours to report a payment, and the minister said early numbers were lower than expected. — News reporting
Security incident report INC-4471: root cause was a phished VPN credential; containment completed 14:20 and the firewall rule was tightened. — Internal security incident report without the regulatory frame (covered by global-security-incident-report)

Known false positives

cyber.gov.au and CISC guidance, law-firm and vendor articles repeat the 12/72/84/48-hour deadlines, section numbers and form questions. Mitigation: Guidance stays at 65 discovery; enforce tiers need answered form fields and exclude cisc.gov.au / legislation.gov.au, "Civil penalty:", "you must report" instructions and law-firm disclaimers.
Blank or printed ASD reporting forms list every option ("Yes / No", all incident types). Mitigation: Yes/No answers followed by the other option are rejected, and incident type must follow a labelled field; blank lines and placeholders are rejected.
Internal incident reports and post-incident reviews. Mitigation: Without the regulatory frame (s 30BC/30BD, ASD report, Cyber Security Act 2024) the primary does not fire; these are covered by global-security-incident-report.