AustraliaSecurity of Critical Infrastructure Act, Critical Infrastructure Risk Management Programs
Security of Critical Infrastructure Act 2018 (Cth) Part 2A, ss. 30AB-30AD; Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023, ss. 4 and 8
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the responsible entity for a critical infrastructure asset to which Part 2A of the Security of Critical Infrastructure Act 2018 applies: an asset the Critical infrastructure risk management program Rules specify (a critical electricity, gas, water, liquid fuel, food and grocery, freight, broadcasting, data storage or processing or domain name system asset, a critical energy market operator asset, a designated hospital, or a critical financial market infrastructure asset), or an asset the Minister has declared under section 51 (reached by declaring that you operate an essential service, handle health records or provide financial services).
- Adopt and maintain a written critical infrastructure risk management program that applies to you (section 30AC).
- Comply with the program you have adopted, and review it on a regular basis (sections 30AD and 30AE).
- In the program, identify each hazard with a material risk of a relevant impact on the asset and, so far as it is reasonably practicable, minimise or eliminate that risk and mitigate its impact (section 30AH(1)).
- In the program, establish and maintain a process or system to minimise or eliminate any material risk of a cyber and information security hazard occurring, and to mitigate its relevant impact on the asset, as far as it is reasonably practicable (Rules, section 8(2)).
- Within 12 months after the end of the period in section 4(2) of the Rules, comply with a framework in the Rules' table (AS ISO/IEC 27001:2015, the Essential Eight Maturity Model at maturity level one, the NIST Framework for Improving Critical Infrastructure Cybersecurity, the C2M2 at Maturity Indicator Level 1, or the AESCSF at Security Profile 1) or with an equivalent framework (Rules, section 8(3) to (5)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Secretary of the Department administering the Act, who is an authorised applicant for its civil penalty provisions, together with a person whom the Secretary appoints as an authorised applicant from among the chief executive officers and senior employees of the Department or of a relevant Commonwealth regulator.
Settledness
- As of
- Open questions
- Which of the cyber hazard requirements in Part 2 of the Rules apply to an asset that is also subject to a separate Part 2A instrument, such as the telecommunications assets covered by their own risk management program rules?
What this law does
Section 30AC of the Security of Critical Infrastructure Act 2018 requires the responsible entity for one or more critical infrastructure assets to adopt and maintain a critical infrastructure risk management program that applies to the entity. Section 30AD of the Act requires that entity to comply with the program once it has adopted one. Section 30AB(1)(a) of the Act applies Part 2A to a critical infrastructure asset that is specified in the rules.
Section 4(1) of the Critical infrastructure risk management program Rules (LIN 23/006) 2023 specifies, among others, a critical electricity asset, a critical gas asset, a critical water asset, a designated hospital and a critical data storage or processing asset.
Section 8(2) of those Rules requires a responsible entity to establish and maintain a process or system in the program to minimise or eliminate any material risk of a cyber and information security hazard occurring, as far as it is reasonably practicable to do so. Those Rules commenced on .
Section 4(2) of those Rules suspends Part 2A for an asset until the later of 6 months after the commencement of the instrument and 6 months after the asset became a critical infrastructure asset. A contravention of section 30AC is a civil penalty provision carrying 200 penalty units.
When LexLint raises it
When your app profile says your app runs an essential service, handles health records or provides financial services.