---
title: "Critical infrastructure cyber incident reporting clocks"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/soci-cyber-incident-clocks"
type: "precedent"
site: "AI Law Framework"
id: "a25-soci-cyber-incident-clocks"
area_id: "A25"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A25-T1-R15"]
law_stated_as_at: "2026-10-22"
---

# Critical infrastructure cyber incident reporting clocks

> Record of the 12-hour and 72-hour reporting clocks in the March 2026 CISC guidance on Part 2B of the Security of Critical Infrastructure Act 2018.

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/soci-cyber-incident-clocks  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: Australia, Commonwealth
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the authority it cites, for Australia and Commonwealth.

## When to use it

Use when a responsible entity for a critical infrastructure asset is assessing whether a cyber security incident must be reported to the Australian Cyber Security Centre. It does not classify the incident.

## Used for these tasks

- [Map critical-infrastructure cyber reporting duties for the asset](https://ailawframework.com/practice/privacy-data-protection-and-cyber/map-critical-infrastructure-cyber-reporting-duties-for-the-asset.md)

## How AI may be used

AI may build a chronology of who knew what and when from the tickets and emails, and the lawyer decides whether the incident is reportable and whether the impact is significant or relevant.

**AI may:**

- Build a time line from the logs, tickets and emails, with the source of each time
- Calculate 12 hours, 72 hours, 84 hours and 48 hours from a time the lawyer nominates as awareness
- List the asset and the sector as they are described in the entity's own records

**AI must not:**

- Must not decide that the entity is a responsible entity or that the asset is a critical infrastructure asset
- Must not classify the impact as significant or relevant
- Must not draft the report to the Australian Cyber Security Centre

**The lawyer checks:**

- The asset is in a class the guidance says has the notification obligation, including the exclusions in the guidance notes
- The incident meets section 12M as the guidance describes it, and is not only a scam, social-engineering contact, or a storage incident of the kind the guidance says is unlikely to be covered
- The awareness time follows the guidance, including that an automated flag alone is not awareness
- An oral report is followed by the written report within the period the guidance states for that class

## Authorities

- [Cyber and Infrastructure Security Centre, Notification of Cyber Security Incidents guidance, March 2026](https://www.cisc.gov.au/resources-subsite/Documents/ncsi-guidance.pdf)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/soci-cyber-incident-clocks and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*