• enable the minister for cyber security to prescribe mandatory cyber security standards for smart devices to give Australians assurance the devices they purchase aren’t putting them at risk,
• require certain businesses to report ransom payments, so our cyber experts can build a better picture of the threat landscape,
• give effect to a ‘limited use’ obligation for the National Cyber Security Coordinator and the Australian Signals Directorate (ASD) to facilitate rapid and open sharing of information during a cyber security incident,
• establish a Cyber Incident Review Board (CIRB) to conduct no-fault, post-incident reviews of significant cyber security incidents in Australia and make concrete recommendations to aid in the prevention, detection, response, and minimisation of cyber incidents in the future.

“I also welcome the limited-use provisions in this legislation, which will provide assurance to entities that the information they disclose to government about cyber incidents will not be used against their interests in the future,” Senator and Shadow Minister for Cyber Security James Paterson said. “We need seamless, time-sensitive sharing of information between government and business when there is a cyberattack. We can’t afford for any CISO or their CEO to hesitate to pick up the phone to the ACSC and share what they know.”

Patterson said that it is important to learn the right lessons from major incidents and apply these lessons. “Two years on from the data breaches suffered by Optus and Medibank, we are still in the dark about the specifics of what led to these incidents, how they were managed and what companies can learn from the incidents to guard against future cyberattacks of a similar nature.”

The Cyber Security Bill 2024 was introduced on 9 October and was later recommended for urgent parliamentary approval on 19 November by the Parliamentary Joint Committee on Intelligence and Security (PJCIS).