Checklist · Privacy, Data Protection & Cyber
Critical infrastructure cyber incident reporting clocks
Record of the 12-hour and 72-hour reporting clocks in the March 2026 CISC guidance on Part 2B of the Security of Critical Infrastructure Act 2018.
- Kind
- Checklist. Steps or checks to work through and tick off.
- Where it applies
- Australia, Commonwealth
- AI use
- Yellow You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at
- 22 October 2026
- Status
- Maintained. Checked on 22 October 2026 against the authority it cites, for Australia and Commonwealth.
- Version
- 1
- Source
- Written for this library
When to use it
Use when a responsible entity for a critical infrastructure asset is assessing whether a cyber security incident must be reported to the Australian Cyber Security Centre. It does not classify the incident.
Used for these tasks
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
AI may build a chronology of who knew what and when from the tickets and emails, and the lawyer decides whether the incident is reportable and whether the impact is significant or relevant.
AI may
- Build a time line from the logs, tickets and emails, with the source of each time
- Calculate 12 hours, 72 hours, 84 hours and 48 hours from a time the lawyer nominates as awareness
- List the asset and the sector as they are described in the entity's own records
AI must not
- Must not decide that the entity is a responsible entity or that the asset is a critical infrastructure asset
- Must not classify the impact as significant or relevant
- Must not draft the report to the Australian Cyber Security Centre
The lawyer checks
- The asset is in a class the guidance says has the notification obligation, including the exclusions in the guidance notes
- The incident meets section 12M as the guidance describes it, and is not only a scam, social-engineering contact, or a storage incident of the kind the guidance says is unlikely to be covered
- The awareness time follows the guidance, including that an automated flag alone is not awareness
- An oral report is followed by the written report within the period the guidance states for that class
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is available after you log in. It is free. When you log in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)
- Cross-border disclosure of personal information under APP 8
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Response to a direct marketing opt-out or source request (APP 7.6 and 7.7)
- OAIC privacy complaint form
- CCPA privacy policy
- Incident response plan outline
- Use or disclosure of personal information under APP 6
- Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option
- OAIC privacy complaint authorised representative form
- Notifiable data breach statement to the OAIC: completion guide for the online form
- Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)
- Breach notice with a statute checklist
- Notice at collection
- Security and destruction of personal information under APP 11
- Employee records exemption: assessment checklist for a planned use of staff information (Privacy Act s 7B(3))
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Letter of demand for a serious invasion of privacy (statutory tort, Privacy Act Sch 2): take-down, undertakings and remedies
- Consumer request response
- Service-provider safeguards addendum
- Collection notice (APP 5) for forms, websites, apps and call scripts
- De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- California security breach notice
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area