Who this applies to
Aviation, maritime and offshore industry participants.
Timeframe for reporting
A ‘significant impact’ must be reported within 12 hours, and a ‘relevant impact’ must be reported within 72 hours of the industry participant becoming aware of the incident.
Type of obligation
Mandatory
You must report a cyber-security incident to both the ASD’s ACSC and the Department of Home Affairs. You can submit a report electronically through the ASD’s ACSC and provide consent for that report to be shared with the Department of Home Affairs. If you do not provide your consent, you will need to make a separate report to the Department of Home Affairs.
If you have received an INC number from ASD's ACSC you may have already completed this reporting requirement.