AICD submission on cyber security reforms subordinate legislation

The AICD's submission was limited to the proposed Cyber Security (Ransomware Reporting) Rules 2024 and the Cyber Security (Cyber Incident Review Board) Rules 2024. Our key points on the proposed rules were:

• We did not support the ransomware payment reporting threshold being set at $3 million per annum. A threshold this low will result in significant inadvertent non-compliance through small businesses and NFPs not being aware of the obligation. It may also result in contradictory and punitive enforcement outcomes where a small business or NFP is penalised for failing to meet a reporting requirement, in addition to experiencing the material costs and disruption of a ransomware incident.
• We recommended that the turnover threshold is set at a $10 million per annum consistent with the Department of Home Affairs (Home Affairs) proposal in 2023. This threshold would capture businesses that have the requisite resources and awareness to meet the reporting obligation.
• We supported the proposed eligibility criteria for both board members of the CIRB and members of the expert panel. We recommended that in appointing board and expert panel members that the Minister be guided by a skills matrix that is consistent with the proposed CIRB Rules. The composition of both the board and expert panel should cover a diverse range of relevant skills and experience with a majority of members being appointed from outside of the Australian Public Service. 
• We recommended that section 10 of the CIRB Rules be broadened to provide the Chair with discretion to delay a review when there is significant private litigation before the courts and there is a risk that a CIRB review may prejudice these actions.