---
title: "Prepare the ransomware or cyber extortion payment report"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/prepare-the-ransomware-or-cyber-extortion-payment-report"
type: "task"
site: "AI Law Framework"
id: "A24-T20261018-7"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Prepare the ransomware or cyber extortion payment report

> From the incident timeline, the payment records and the threat actor communications, fill the report fields: the paying entity's details and ABN, when the incident occurred and when the entity became aware of it, its…

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/prepare-the-ransomware-or-cyber-extortion-payment-report  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the incident timeline, the payment records and the threat actor communications, fill the report fields: the paying entity's details and ABN, when the incident occurred and when the entity became aware of it, its impact, the demand and the payment made, and flag every field the file does not yet answer. |
| What the lawyer must review | Confirm the client is a reporting business entity, either by turnover above the threshold for the previous financial year or as a responsible entity for a Part 2B asset, identify who must report where a payment was made on the client's behalf, check each field against the evidence, and confirm the report is made within 72 hours of the payment. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: From the incident timeline, the payment records and the threat actor communications, fill the report fields: the paying entity's details and ABN, when the incident occurred and when the entity became aware of it, its impact, the demand and the payment made, and flag every field the file does not yet answer.
- What the lawyer does: Confirm the client is a reporting business entity, either by turnover above the threshold for the previous financial year or as a responsible entity for a Part 2B asset, identify who must report where a payment was made on the client's behalf, check each field against the evidence, and confirm the report is made within 72 hours of the payment.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Confirm the instructions, the jurisdiction and the complete relevant material before starting.
2. Confirm the client's annual turnover for the previous financial year, or its Part 2B status, before treating it as a reporting entity.
3. Check the payment date and time, because the 72 hours run from the payment.
4. Check every completed field against a document in the incident file and leave unknown fields marked as unknown.
5. Check the output against the source documents named in it before it is relied on.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [Department of Home Affairs: Ransomware and cyber extortion payment reporting fact sheet](https://www.homeaffairs.gov.au/cyber-security-subsite/files/factsheet-ransomware-payment-reporting.pdf) (checked 2026-10-18)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Ransomware or cyber extortion payment report: fields on the ACSC form](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/ransomware-payment-report-fields.md) | Checklist | Yellow | Field list for the ransomware and cyber extortion payment report on the cyber.gov.au form. The form cites section 27 of the Cyber Security Act 2024 and a 72-hour period.… |
| [SOCI Act cyber incident report: 12-hour and 72-hour clocks](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/soci-cyber-incident-clocks.md) | Checklist | Yellow | The CISC description of mandatory cyber incident reporting for a critical infrastructure asset. A significant impact is 12 hours. A relevant impact is 72 hours.… |

Signed-in accounts can read the full text of each one.

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/prepare-the-ransomware-or-cyber-extortion-payment-report/united-states.md) | Red |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*