Understand the essential procedures for reporting cyber security incidents in Australia's aviation industry, ensuring compliance with legal requirements.
The aviation industry faces increasing cyber threats that can compromise security and operations. In Australia, reporting these incidents is not just recommended but legally mandated. This guide outlines the essential steps and requirements for reporting cyber security incidents in the aviation sector.
Cyber threats targeting aviation assets can have serious consequences, from operational disruptions to potential safety risks. The Australian government has established clear protocols to ensure these incidents are reported promptly and thoroughly. Understanding these procedures is crucial for all industry participants.
Reporting Procedures and Requirements
When a cyber security incident affects an aviation asset, it must be reported to both the Australian Cyber Security Centre (ACSC) and the Department of Home Affairs. The reporting process is designed to be straightforward, with multiple channels available for submission.
You can report the incident through the ACSC website where you can also provide consent to share your report with Home Affairs. If consent is not given, a separate aviation security incident report form must be submitted, specifying the ‘Cyber’ incident category. This dual reporting system ensures comprehensive coverage of all cyber threats.
Submission Methods and Deadlines
The law requires aviation industry participants to report incidents as soon as possible, and within 24 hours of first becoming aware of them. Reports must be submitted in writing, with the easiest method being the completion of the Aviation Security Incident Report Form. This form includes all required information, ensuring compliance with legal standards.
An initial report can also be made by calling 1300 791 581 but a written report must still be submitted within the 24-hour window. Alternatively, reports can be sent via email to [email protected]. These multiple submission methods provide flexibility for industry participants.
Essential Information for Reports
Your report should include as much detail as you know at the time of the incident. If additional required information becomes available later, it must be provided in writing as soon as possible. All reporting requirements are outlined in the Aviation Transport Security (Incident Reporting) Instrument 2026.
It is crucial to include all necessary details to ensure the report is considered valid. According to subsection 107(3) of the Aviation Transport Security Act 2004 a report that does not include all required information is treated as not reported. This underscores the importance of thorough and accurate reporting.
Just Culture Approach and Industry Guidance
The Australian government employs a just culture approach to encourage reporting. This means that generally, no enforcement action will be taken if certain conditions are met. These conditions include voluntary self-reporting of the incident, confirmation of steps taken to prevent recurrence, and the absence of reckless behavior.
For more detailed information, the Industry Guidance provides comprehensive insights into the reporting process and the just culture approach. This resource is invaluable for industry participants seeking to understand their obligations and the benefits of prompt reporting.
By adhering to these guidelines, the aviation industry can effectively mitigate the risks associated with cyber threats, ensuring the safety and security of all operations.
