AustraliaSecurity of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules, Critical Telecommunications Assets
Security of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules 2025 ss. 5, 7, 9, 11 and 17; Security of Critical Infrastructure Act 2018 (Cth), Part 2A
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance, Reporting
As of .
What it requires
- This binds the responsible entity for a relevant critical infrastructure asset, being a critical telecommunications asset owned or operated by a carrier or owned or operated by a carriage service provider and used in connection with the supply of at least 20,000 active total carriage services (or known to be used to supply carriage services to a Commonwealth entity) (reached by declaring that you provide telecommunications services). The Rules commenced on , and Part 2A of the Security of Critical Infrastructure Act 2018 does not apply to an asset until the last day of 6 months after that commencement or after the asset became a relevant critical infrastructure asset, whichever is later (section 7(2)).
- Adopt and maintain a critical infrastructure risk management program that applies to you, comply with it and review it regularly (Security of Critical Infrastructure Act 2018, sections 30AC to 30AE).
- In the program, identify the operational context of the asset and its material risks, and, as far as it is reasonably practicable, minimise or eliminate those risks and mitigate the relevant impact of each hazard (Rules, section 9).
- In the program, include a process or system that would, as far as it is reasonably practicable, minimise or eliminate any material risk of a cyber and information security hazard occurring and mitigate its relevant impact on the asset (Rules, section 11(2)).
- For an asset owned or operated by a carrier, include a process or system to comply with a listed cyber framework (the Essential Eight Maturity Model at maturity level two, the Cybersecurity Capability Maturity Model at maturity level two, or the AESCSF at security profile two) within 24 months after the end of the period in section 7(2), or with an equivalent framework (Rules, section 11(4) and (5)).
- For an asset owned or operated by a carrier, provide the Secretary of the Department with all information reasonably necessary to assess a change or proposed change to the telecommunications service or system, including a risk assessment, details of software, hardware and major suppliers, and schematics (Rules, section 17).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Secretary of the Department administering the Act, who is an authorised applicant for its civil penalty provisions, together with a person whom the Secretary appoints as an authorised applicant from among the chief executive officers and senior employees of the Department or of a relevant Commonwealth regulator.
Settledness
- As of
- Open questions
- How do the Telecommunications Security and Risk Management Program Rules and the Critical infrastructure risk management program Rules divide the assets of an entity that is the responsible entity for both a telecommunications asset and another critical infrastructure asset?
What this law does
Section 7(1) of the Security of Critical Infrastructure (Telecommunications Security and Risk Management Program) Rules 2025 specifies a relevant critical infrastructure asset for the purposes of Part 2A of the Security of Critical Infrastructure Act 2018. Section 5 of the Rules defines a relevant critical infrastructure asset as a critical telecommunications asset that is owned or operated by a carrier or is a relevant carriage service provider asset.
Section 4 of the Rules treats a critical infrastructure asset owned or operated by a carriage service provider as a relevant carriage service provider asset where it is used in connection with the supply of at least 20,000 active total carriage services.
Section 9 of the Rules requires a critical infrastructure risk management program for a relevant critical infrastructure asset to identify the operational context and the material risks and, so far as is reasonably practicable, to minimise or eliminate those risks and mitigate the relevant impact of each hazard.
Section 11(2) of the Rules requires a critical infrastructure risk management program to include a process or system that would, as far as is reasonably practicable, minimise or eliminate any material risk of a cyber and information security hazard occurring.
Section 11(4) of the Rules requires a program for a critical telecommunications asset owned or operated by a carrier to include a process or system to comply with a listed framework, among them the Essential Eight Maturity Model at maturity level two, within 24 months after the end of the period in section 7(2).
Section 17(1) of the Rules requires a responsible entity for a critical telecommunications asset to provide all information reasonably necessary for the Secretary to assess a change or proposed change to its telecommunications service or system.
Section 7(2) of the Rules suspends Part 2A for a relevant critical infrastructure asset until the later of the last day of 6 months after the commencement of the instrument and the last day of 6 months after the asset became a relevant critical infrastructure asset. The Rules commence on the later of the day after the instrument is registered and immediately after the commencement of Parts 1 and 2 of Schedule 5 to the Enhanced Response and Prevention Act 2024. Schedule 5 of the Enhanced Response and Prevention Act 2024 commenced on .
When LexLint raises it
When your app profile says your app provides telecom services.