Provides telecom services, in Australia

Broadcasting Services Act 1992 (Cth), Part 9D · Read the law's page

• If you hold a commercial television broadcasting license, provide a captioning service for television programs transmitted between 6 am and midnight and for news or current affairs programs transmitted at any other hour (ss. 130ZL(2) and 130ZR(1)); on an SDTV or HDTV multi-channelled service, that duty reaches only programs previously transmitted on your primary service, and you must caption a program there whenever you captioned it when you previously transmitted it on another of your services (ss. 130ZR(4) and (5) and 130ZS(1) and (2)).
• If you hold a subscription television license, caption at least the annual captioning target of each subscription television service's program hours in each financial year, a target set by category of service for 2014-15 that rises by 5% a year to 100% (s. 130ZV), and caption repeats, and simultaneous transmissions on another of your services, of programs you captioned before (ss. 130ZZ and 130ZZAA).
• Meet the captioning standards the ACMA determines on the quality of captions, including readability, comprehensibility and accuracy (s. 130ZZA).
• When you transmit an emergency warning at the request of an emergency service agency, transmit the whole warning as text and as speech, and caption it if reasonably practicable (s. 130ZZB).
• Give the ACMA an annual captioning compliance report within 90 days after each financial year, and keep written and audio-visual records of your compliance for the periods section 130ZZD sets; a subscription television licensee owes these duties if it is a body corporate (ss. 130ZZC and 130ZZD).
• Part 9D does not apply to programs wholly in a language other than English or to programs whose audio is only music without recognizable English vocal content; advertising and sponsorship matter are not programs; a breach caused by significant technical or engineering difficulties you could not reasonably have foreseen is disregarded; and the ACMA may make an exemption order or a target reduction order where refusing one would impose an unjustifiable hardship on you (ss. 130ZK, 130ZM, 130ZN, 130ZUA, 130ZUB, 130ZY and 130ZZAB).

Security of Critical Infrastructure Act 2018 (Cth), Part 2B, ss. 30BB-30BD and 30BEA; Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022, s. 5 · Read the law's page

• This binds the responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies: an asset the Application Rules specify (among them a critical banking, superannuation, insurance, financial market infrastructure, hospital, electricity, gas, water, data storage or processing or telecommunications asset owned or operated by a carrier), or an asset the Minister has declared under section 51 (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecommunications services).
• Give the relevant Commonwealth body a report about the incident as soon as practicable, and in any event within 12 hours after you become aware that a cyber security incident has occurred or is occurring and has had, or is having, a significant impact on the availability of the asset (section 30BC(1)). The report may be given orally or in writing.
• If you give the report orally, make a written record of it in the approved form and give a copy to the relevant Commonwealth body within 84 hours after you give the report (section 30BC(3)).
• Give the relevant Commonwealth body a report as soon as practicable, and in any event within 72 hours after you become aware that a cyber security incident has occurred, is occurring or is imminent and has had, is having or is likely to have a relevant impact on the asset (section 30BD(1)).

Security of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules 2025, ss. 5, 7, 9, 11 and 17; Security of Critical Infrastructure Act 2018 (Cth), Part 2A · Read the law's page

• This binds the responsible entity for a relevant critical infrastructure asset, being a critical telecommunications asset owned or operated by a carrier or owned or operated by a carriage service provider and used in connection with the supply of at least 20,000 active total carriage services (or known to be used to supply carriage services to a Commonwealth entity) (reached by declaring that you provide telecommunications services). The Rules commenced on 4 April 2025, and Part 2A of the Security of Critical Infrastructure Act 2018 does not apply to an asset until the last day of 6 months after that commencement or after the asset became a relevant critical infrastructure asset, whichever is later (section 7(2)).
• Adopt and maintain a critical infrastructure risk management program that applies to you, comply with it and review it regularly (Security of Critical Infrastructure Act 2018, sections 30AC to 30AE).
• In the program, identify the operational context of the asset and its material risks, and, as far as it is reasonably practicable, minimise or eliminate those risks and mitigate the relevant impact of each hazard (Rules, section 9).
• In the program, include a process or system that would, as far as it is reasonably practicable, minimise or eliminate any material risk of a cyber and information security hazard occurring and mitigate its relevant impact on the asset (Rules, section 11(2)).
• For an asset owned or operated by a carrier, include a process or system to comply with a listed cyber framework (the Essential Eight Maturity Model at maturity level two, the Cybersecurity Capability Maturity Model at maturity level two, or the AESCSF at security profile two) within 24 months after the end of the period in section 7(2), or with an equivalent framework (Rules, section 11(4) and (5)).
• For an asset owned or operated by a carrier, provide the Secretary of the Department with all information reasonably necessary to assess a change or proposed change to the telecommunications service or system, including a risk assessment, details of software, hardware and major suppliers, and schematics (Rules, section 17).