Mandatory cybersecurity standards have been established under new legislation.

Under new laws, smart devices will need to comply with cybersecurity standards, and certain businesses will be required to report ransomware payments.

The Albanese government’s legislative package, passed by federal parliament on Monday, establishes Australia’s first standalone Cyber Security Act.

Mandatory cybersecurity standards will cover devices such as smart TVs, smartwatches, baby monitors, and consumer energy resources like rooftop solar systems.

Businesses exceeding a specific annual turnover threshold must report ransomware payments to the Department of Home Affairs or the Australian Signals Directorate within 72 hours of making the payment or becoming aware of it.

Joint Committee on Intelligence and Security Chair Raff Ciccone emphasized the indispensable role of smart devices in daily life.

“This legislative package presents an opportunity to strengthen Australia’s national cybersecurity defenses,” the Labor senator told parliament.

“The bills will equip Australians and businesses to better respond to and recover from cybersecurity threats while positioning the nation as a global leader in cybersecurity by 2030, amid an evolving threat landscape.”

The Victorian senator highlighted the underutilization of the voluntary reporting scheme, which limits the government’s understanding of ransomware threats.

“The reporting obligations are not about naming and shaming businesses or damaging their reputation,” he explained. “Instead, they aim to gauge threat levels and support domestic law enforcement in disrupting cybercrime activities locally and internationally.”

Over the past year, the Australian Signals Directorate received reports of more than 87,000 cybercrime incidents. Significant attacks included the September 2022 Optus breach affecting 10 million people and the October Medibank attack impacting approximately 9.7 million.

As part of the reforms, a Cyber Incident Review Board will be established to review major incidents and provide recommendations to prevent future attacks.

These measures align with the government’s 2023-2030 Australian Cyber Security Strategy.

Opposition cybersecurity spokesperson James Paterson expressed the coalition’s support for the intent of Labor’s package, acknowledging the need for robust measures in a “complex and evolving threat environment.”

“The government requires strong tools to safeguard Australians from cyber threats,” he said.