Cyber incident affecting an aviation asset
You must report a cyber security incident to both the Australian Cyber Security Centre (ACSC) and the Department of Home Affairs.
You can report the incident on the ACSC website. There, you can give consent to share your report with Home Affairs. If you do not give consent, you must submit a separate aviation security incident report form. You must select the ‘Cyber’ incident category.
Report an Aviation security incident
You must report any aviation security incident to the department under Part 6 of the
Aviation Transport Security Act 2004. This includes air cargo security incidents.
Aviation industry participants must report incidents as soon as possible, and
within 24 hours of first becoming aware of them.
Reports must be
in writing. The easiest way is to complete the
Aviation Security Incident Report Form. This form includes all required information.
You may make an initial report by calling 1300 791 581. However, a written report must be submitted within 24 hours.
Alternatively, reports can be submitted by email to transport.security@homeaffairs.gov.au.
What the report must include
Your report should include as much detail as you know at the time.
If you learn more required information later, you must provide it in writing as soon as possible.
All reporting requirements are set out in the
Aviation Transport Security (Incident Reporting) Instrument 2026.
If your report does
not include all required information, the law treats it as
not reported under subsection 107(3) of the
Aviation Transport Security Act 2004.
Just culture approach
We use a ‘just culture’ approach to encourage reporting. This means generally no enforcement action will be taken if:
- you voluntarily self-report the incident
- you confirm you have taken steps to prevent it happening again (if asked)
- the incident was not caused by reckless behaviour.
For more information, see the
Industry Guidance.
