Critical infrastructure entities must report significant cyber incidents within 12 hours. That's not a comms exercise — it's a data-availability problem. Solve it before the incident.
The SOCI Act's reporting regime gives responsible entities 12 hours for incidents with significant impact on essential services, and 72 hours for other relevant incidents.
Twelve hours is a data-availability problem: who is authorised to lodge, what minimum fields can you populate at hour three, and how do you update without contradicting yourself?
Pre-stage the skeleton: asset identifiers from your register entry, sector and impact taxonomies, and contact chains that survive a weekend. The ACSC ReportCyber flow rewards preparation.
Integrate the SOCI clock with the CPS 234 (72-hour APRA) and NDB clocks — one incident can trigger all three, and inconsistent narratives create their own regulatory risk.
Disclaimer
General information only — not legal, financial or professional advice. Verify obligations against the current instruments and your entity's circumstances.