AustraliaSecurity of Critical Infrastructure Act, Notification of Cyber Security Incidents
Security of Critical Infrastructure Act 2018 (Cth) Part 2B, ss. 30BB-30BD and 30BEA; Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022, s. 5
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds the responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies: an asset the Application Rules specify (among them a critical banking, superannuation, insurance, financial market infrastructure, hospital, electricity, gas, water, data storage or processing or telecommunications asset owned or operated by a carrier), or an asset the Minister has declared under section 51 (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecommunications services).
- Give the relevant Commonwealth body a report about the incident as soon as practicable, and in any event within 12 hours after you become aware that a cyber security incident has occurred or is occurring and has had, or is having, a significant impact on the availability of the asset (section 30BC(1)). The report may be given orally or in writing.
- If you give the report orally, make a written record of it in the approved form and give a copy to the relevant Commonwealth body within 84 hours after you give the report (section 30BC(3)).
- Give the relevant Commonwealth body a report as soon as practicable, and in any event within 72 hours after you become aware that a cyber security incident has occurred, is occurring or is imminent and has had, is having or is likely to have a relevant impact on the asset (section 30BD(1)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Secretary of the Department administering the Act, who is an authorised applicant for its civil penalty provisions, together with a person whom the Secretary appoints as an authorised applicant from among the chief executive officers and senior employees of the Department or of a relevant Commonwealth regulator.
Settledness
- As of
- Open questions
- Which circumstances do the rules specify, under section 30BEA(b), as a significant impact on the availability of an asset?
What this law does
Section 30BC(1) of the Security of Critical Infrastructure Act 2018 requires the responsible entity for a critical infrastructure asset to give the relevant Commonwealth body a report within 12 hours after becoming aware of a cyber security incident that has had a significant impact on the availability of the asset.
Section 30BD(1) of the Act requires the responsible entity to give the relevant Commonwealth body a report within 72 hours after becoming aware of a cyber security incident that has had, is having or is likely to have a relevant impact on the asset. Section 30BB(1)(a) of the Act applies Part 2B to a critical infrastructure asset that is specified in the rules.
Section 5(1) of the Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022 specifies, among others, a critical banking asset, a critical superannuation asset, a critical insurance asset, a critical hospital, a critical electricity asset and a critical telecommunications asset owned or operated by a carrier.
Section 30BEA of the Act provides that a cyber security incident has a significant impact on the availability of an asset only if the asset is used in connection with the provision of essential goods or services and the incident has materially disrupted their availability, or a circumstance the rules specify exists.
Section 5(5) of those Rules suspends Part 2B for an asset until the later of 3 months after the commencement of the instrument and 3 months after the asset became a critical infrastructure asset. The Application Rules commenced on . A contravention of section 30BC(1) is a civil penalty provision carrying 50 penalty units.
When LexLint raises it
When your app profile says your app runs an essential service, handles health records, provides financial services or provides telecom services.