AustraliaSecurity of Critical Infrastructure Act, Enhanced Cyber Security Obligations for Systems of National Significance
Security of Critical Infrastructure Act 2018 (Cth), Part 2C, ss. 30CB, 30CD, 30CM and 30CU; s. 52B
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the responsible entity for a critical infrastructure asset that the Minister has declared a system of national significance (section 52B), and each of the duties below arises only once the Secretary gives that entity a written notice or determination (reached by declaring that you operate an essential service).
- Where the Secretary has determined that the statutory incident response planning obligations apply to you, adopt and maintain an incident response plan for the system and for cyber security incidents, comply with it, review it regularly, keep it up to date, and give the Secretary a copy as soon as practicable after you adopt or vary it (sections 30CB and 30CD to 30CH).
- Where the Secretary gives you a written notice, undertake a cyber security exercise in relation to the system within the period the notice specifies, which may not end earlier than 30 days after the notice (section 30CM).
- Where the Secretary gives you a written notice, undertake, or cause to be undertaken, a vulnerability assessment in relation to the system within the period the notice specifies (section 30CU).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Secretary of the Department administering the Act, who is an authorised applicant for its civil penalty provisions, together with a person whom the Secretary appoints as an authorised applicant from among the chief executive officers and senior employees of the Department or of a relevant Commonwealth regulator.
Settledness
- As of
- Open questions
- Which assets has the Minister declared systems of national significance under section 52B, given that a declaration is not a public instrument?
What this law does
Section 52B(1) of the Security of Critical Infrastructure Act 2018 allows the Minister to declare a critical infrastructure asset to be a system of national significance if the Minister is satisfied that the asset is of national significance.
Section 30CB(1) of the Act allows the Secretary, by written notice to the responsible entity for a system of national significance, to determine that the statutory incident response planning obligations apply to the entity in relation to the system and cyber security incidents. Section 30CD of the Act requires the responsible entity for a system of national significance to which the statutory incident response planning obligations apply to adopt and maintain an incident response plan.
A contravention of section 30CD is a civil penalty provision carrying 200 penalty units. Section 30CM(1) of the Act allows the Secretary, by written notice to the responsible entity for a system of national significance, to require it to undertake a cyber security exercise in relation to the system within the period specified in the notice.
Section 30CU(1) of the Act allows the Secretary, by written notice to the responsible entity for a system of national significance, to require it to undertake, or cause to be undertaken, a vulnerability assessment in relation to the system within the period specified in the notice.
When LexLint raises it
When your app profile says your app runs an essential service.