The Cyber Security Act 2024 (Cth) commenced on 20 May 2025 and requires entities to report ransomware payments to the Australian Signals Directorate within 72 hours of making a payment. This applies to operators of critical infrastructure and businesses with annual turnover exceeding $3 million. Non-compliance may attract penalties for non-compliance.