improving the transparency of the ownership and operational control of critical infrastructure in Australia in order to better understand those risks; and

facilitating cooperation and collaboration between all levels of government, and regulators, owners and operators of critical infrastructure, in order to identify and manage those risks; and

requiring responsible entities for critical infrastructure assets to identify and manage risks relating to those assets; and

imposing enhanced cyber security obligations on relevant entities for systems of national significance in order to improve their preparedness for, and ability to respond to, cyber security incidents; and

imposing enhanced security obligations on responsible entities for critical telecommunications assets; and

providing a regime for the Commonwealth to respond to serious incidents relating to critical infrastructure assets.

the keeping of a register of information in relation to critical infrastructure assets (the register will not be made public);

requiring the responsible entity for one or more critical infrastructure assets to have, and comply with, a critical infrastructure risk management program (unless an exemption applies);

requiring notification of cyber security incidents;

imposing enhanced cyber security obligations that relate to systems of national significance;

imposing enhanced security obligations for critical telecommunications assets;

requiring certain entities relating to a critical infrastructure asset to provide information in relation to the asset, and to notify if certain events occur in relation to the asset;

allowing the Minister to require certain entities relating to a critical infrastructure asset to do, or refrain from doing, an act or thing if the Minister is satisfied that there is a risk of an act or omission that would be prejudicial to security;

allowing the Secretary to require certain entities relating to a critical infrastructure asset to provide certain information or documents;

setting up a regime for the Commonwealth to respond to a serious incident that has had, is having, or is likely to have, one or more relevant impacts on one or more critical infrastructure assets;

allowing the Secretary to undertake an assessment of a critical infrastructure asset to determine if there is a risk to national security relating to the asset.

in a case where the computer data is held in a computer—the display of the data by the computer or any other output of the data from the computer; or

in a case where the computer data is held in a computer—the copying or moving of the data to:

in a case where the computer data is held in a data storage device—the copying or moving of the data to:

the secretary of the company; or

an officer of the company appointed to hold property on behalf of the company.

a system; and

a network; and

a facility; and

a computer; and

a computer device; and

a computer program; and

computer data; and

premises; and

any other thing.

an antenna; or

a combiner; or

a feeder system; or

an apparatus; or

an item of equipment; or

a structure; or

a line; or

an electricity cable or wire;

a radiocommunications transmitter; or

a broadcasting transmission tower; or

an associated transmission facility;

a radiocommunications transmitter; or

a broadcasting transmission tower; or

an associated transmission facility;

a national broadcasting service; or

a commercial radio broadcasting service; or

a commercial television broadcasting service.

personal information (within the meaning of the Privacy Act 1988) that relates to at least 20,000 individuals; or

information relating to any research and development in relation to a critical infrastructure asset; or

information relating to any systems needed to operate a critical infrastructure asset; or

information needed to operate a critical infrastructure asset; or

information relating to risk management and business continuity (however described) in relation to a critical infrastructure asset.

supplying a carriage service; or

providing a broadcasting service; or

owning or operating assets that are used in connection with the supply of a carriage service; or

owning or operating assets that are used in connection with the transmission of a broadcasting service; or

administering an Australian domain name system.

one or more computers; or

one or more computer systems; or

one or more computer networks; or

any combination of the above.

a computer; or

a data storage device.

information relating to trade secrets;

other information that has a commercial value that would be, or could reasonably be expected to be, destroyed or diminished if the information were communicated.

an asset that:

an asset that:

an asset that is used by an airport operator in connection with the operation of an airport.

would prevent the proper function of the asset; or

could cause significant damage to the asset;

materiel; and

technology; and

a platform; and

a network; and

a system; and

a service;

the defence of Australia; or

national security.

is being, or will be, supplied by an entity to the Defence Department, or the Australian Defence Force, under a contract; and

consists of, or enables, a critical defence capability.

is owned or operated by an entity that is registered in the Australian university category of the National Register of Higher Education Providers; and

is used in connection with undertaking a program of research that is critical to:

is owned or operated by:

is used in connection with the operation of an energy market or system; and

is critical to ensuring the security and reliability of an energy market or system;

a critical electricity asset; or

a critical gas asset; or

a critical liquid fuel asset.

is managed by a single entity; and

is capable of handling at least 5 million passenger journeys per month;

a telecommunications network that is:

any other asset that is:

are managed by a single water utility; and

ultimately deliver services to at least 100,000 water connections or 100,000 sewerage connections.

the individual is an employee, intern, contractor or subcontractor of the responsible entity for a critical infrastructure asset to which Part 2A applies;

the absence or compromise of the individual:

  as assessed by the responsible entity for the asset;

the individual has access to, or control and management of, a critical component of the asset.

a service that:

a data processing service that:

a service that is specified in the rules.

the production, transmission, distribution or supply of electricity; or

the production, processing, transmission, distribution or supply of gas; or

the production, processing, transmission, distribution or supply of liquid fuel.

do an act or thing; or

omit to perform an act or thing.

an individual, whether or not resident in Australia or an Australian citizen;

a body corporate, whether or not formed, or carrying on business, in Australia;

a body politic, whether or not an Australian body politic;

a partnership, whether or not formed in Australia;

a trust, whether or not created in Australia;

a superannuation fund, whether or not created in Australia;

an unincorporated foreign company.

carrying on banking business; or

operating a superannuation fund; or

carrying on insurance business; or

carrying on life insurance business; or

carrying on health insurance business; or

operating a financial market; or

operating a clearing and settlement facility;

operating a derivative trade repository; or

administering a financial benchmark; or

operating a payment system; or

carrying on business of providing financial services (within the meaning of the Corporations Act 2001); or

carrying on credit facility business.

manufacturing; or

processing; or

packaging; or

distributing; or

supplying;

is in a gaseous state at standard temperature and pressure; and

consists of naturally occurring hydrocarbons, or a naturally occurring mixture of hydrocarbons and non‑hydrocarbons, the principal constituent of which is methane; and

is suitable for consumption.

is equipped and staffed so that it is capable of providing to a patient:

is supported by:

has admission and discharge policies in operation.

for an asset that is, or will be, a critical infrastructure asset at the end of the period of 6 months starting on the commencing day—that 6 month period; or

for an asset that becomes a critical infrastructure asset after the end of the period mentioned in paragraph (a)—the period of 6 months starting on the day the asset becomes a critical infrastructure asset.

services provided by individuals who practise in any of the following professions or occupations:

treatment and maintenance as a patient at a hospital.

the provision of health care; or

the production, distribution or supply of medical supplies.

supported financially (in whole or in part) by the Commonwealth; and

critical to:

the Inspector‑General of Intelligence and Security; or

any other person covered by subsection 32(1) of the Inspector‑General of Intelligence and Security Act 1986.

the prevention of any such communication; and

the impairment of any such communication on an electronic link or network used by the computer;

manages:

manages an aspect of:

manages an aspect of the operation of:

goods for therapeutic use; and

things specified in the rules.

in respect of computer data—means:

in respect of a computer program—means:

subsection 30EC(4); or

subsection 30EC(6); or

subsection 30ED(3); or

subsection 30ED(4); or

subsection 30EF(4); or

subsection 35AE(3); or

subsection 35AE(4); or

subsection 35AE(5); or

subsection 35AE(6); or

subsection 35AE(7); or

subsection 35AE(8); or

subsection 35AH(5); or

subsection 35AH(6); or

subsection 35AH(7); or

subsection 35AY(3); or

subsection 35AY(4); or

subsection 35AY(5); or

subsection 35AY(6); or

subsection 35AY(7); or

subsection 35AY(8); or

subsection 51(3); or

subsection 52(4); or

subsection 52B(3).

the Ombudsman; or

a Deputy Commonwealth Ombudsman; or

a person who is a member of the staff referred to in subsection 31(1) of the Ombudsman Act 1976.

for a critical port—a port facility operator (within the meaning of the Maritime Transport and Offshore Facilities Security Act 2003) of a port facility within the port; or

for a critical infrastructure asset other than a critical port—an entity that operates the asset or part of the asset.

a Department that is specified in the rules; or

a body that is:

is the responsible entity for the asset; or

is a direct interest holder in relation to the asset; or

is an operator of the asset; or

is a managed service provider for the asset.

the responsible entity for the asset;

a direct interest holder in relation to the asset.

subject to paragraph (b)—has the same meaning as in the Australian Security Intelligence Organisation Act 1979; and

in the definitions of critical energy market operator asset and protected information and sections 10, 12, 12A, 12D, 12G, 12H, 12J, 12M, 12N, 30AG, 30AQ, 30CB, 30CM, 30CR, 30CU, 30CW and 42AA—has its ordinary meaning.

for a body corporate—a director of the body corporate; or

for a unit trust:

an individual who is, or an individual in a group of individuals who are, in a position to determine the investments or policy of the entity or a trustee of the entity; or

an individual who makes, or participates in making, decisions that affect the whole, or a substantial part of, the business of the entity; or

an individual who has the capacity to affect significantly the financial standing of the entity.

position, navigation and timing services in relation to space objects;

space situational awareness services;

space weather monitoring and forecasting;

communications, tracking, telemetry and control in relation to space objects;

remote sensing earth observations from space;

facilitating access to space.

owning or operating assets that are used in connection with the transport of goods or passengers on a commercial basis; or

the transport of goods or passengers on a commercial basis.

operating water or sewerage systems or networks; or

manufacturing or supplying goods, or providing services, for use in connection with the operation of water or sewerage systems or networks.

the disclosure of which would or could reasonably be expected to prejudice national security or the defence of Australia; or

the disclosure of which would or could reasonably be expected to prejudice the social or economic stability of Australia or its people; or

that contains, or is, confidential commercial information; or

the disclosure of which would or could reasonably be expected to prejudice the availability, integrity, reliability or security of a critical infrastructure asset.

was a document or information to which subsection (1) applied; and

is obtained by a person by way of an authorised disclosure under Division 3 of Part 4 or in accordance with section 46.

a document or information that is obtained or generated by a person in the course of exercising powers, or performing duties or functions, under this Act; or

a document or information that is obtained, generated or adopted by an entity for the purposes of complying with this Act;

records or is the fact that an asset is declared under section 51 to be a critical infrastructure asset; or

records or is the fact that an asset is declared under section 52B to be a system of national significance; or

records or is the fact that the Minister has:

is, or is included in, a critical infrastructure risk management program that is adopted by an entity in compliance with section 30AC; or

is, or is included in, a report that is given under section 30AG or 30AQ; or

is, or is included in, a report under section 30BC or 30BD; or

is, or is included in, an incident response plan adopted by an entity in compliance with section 30CD; or

is, or is included in, an evaluation report prepared under section 30CQ or 30CR; or

is, or is included in, a vulnerability assessment report prepared under section 30CZ; or

is, or is included in, a report prepared in compliance with:

records or is the fact that the Minister has:

records or is the fact that the Minister has:

records or is the fact that the Secretary has:

records or is the fact that the Secretary has:

records or is the fact that the Secretary has:

the name of the first entity;

if applicable, the ABN of the first entity, or other similar business number (however described) if the first entity was incorporated, formed or created (however described) outside Australia;

for an entity other than an individual:

for an entity that is an individual:

the type and level of the interest the first entity holds in the asset;

information about the influence or control the first entity is in a position to directly or indirectly exercise in relation to the asset;

information about the ability of a person, who has been appointed by the first entity to the body that governs the asset, to directly access networks or systems that are necessary for the operation or control of the asset;

the name of each other entity that is in a position to directly or indirectly influence or control:

in relation to each entity (the higher entity) covered by paragraph (h):

information prescribed by the rules for the purposes of this paragraph.

is the Governor‑General, the Prime Minister or a Minister; and

is a direct interest holder in relation to an asset because of paragraph 8(1)(b);

the location of the asset;

a description of the area the asset services;

the following information about each entity that is the responsible entity for, or an operator of, the asset:

the following information about the chief executive officer (however described) of the responsible entity for the asset:

a description of the arrangements under which each operator operates the asset or a part of the asset;

a description of the arrangements under which data prescribed by the rules relating to the asset is maintained;

information prescribed by the rules for the purposes of this paragraph.

together with any associates of the entity, holds an interest of at least 10% in the asset (including if any of the interests are held jointly with one or more other entities); or

holds an interest in the asset that puts the entity in a position to directly or indirectly influence or control the asset.

the entity holds the interest in the asset:

the entity is:

an agreement entered into in good faith, on ordinary commercial terms and in the ordinary course of carrying on a business (a moneylending business) of lending money or otherwise providing financial accommodation, except an agreement dealing with any matter unrelated to the carrying on of that business; or

if the entity:

  an agreement to acquire an interest arising from a moneylending agreement (within the meaning of paragraph (a)).

the entity is the provider of a custodial or depository service; and

the entity holds the interest in the asset solely in the entity’s capacity as the provider of a custodial or depository service; and

the holding of the interest does not put the entity in a position to directly or indirectly influence or control the asset.

the entity is the provider of a service specified in the rules; and

the entity holds the interest in the asset solely in the entity’s capacity as the provider of the service; and

the holding of the interest does not put the entity in a position to directly or indirectly influence or control the asset.

the entity is in a position to exercise voting or veto rights in relation to the body that governs the asset; or

the entity is in a position to make decisions that materially impact on the running of, or strategic direction in relation to, the asset; or

the entity has the ability to appoint:

the entity is in a position to influence or determine decisions relating to:

is in a position to exercise voting or veto rights in relation to the controlled entity; or

is in a position to make decisions that materially impact on the running of, or strategic direction of, the controlled entity; or

has the ability to appoint persons to the board of the controlled entity; or

is in a position to influence or determine decisions relating to:

together with any associates of the controlling entity, holds an interest of at least 10% in the controlled entity (including if any of the interests are held jointly with one or more other entities).

any relative of the person;

any person with whom the person is acting, or proposes to act, in concert in relation to an asset;

any person with whom the person carries on a business in partnership;

any corporate entity of which the person is a senior officer;

if the person is a corporate entity:

any corporate entity whose senior officers are accustomed or under an obligation (whether formal or informal) to act in accordance with the directions, instructions or wishes of:

a corporate entity if the person is accustomed or under an obligation (whether formal or informal) to act in accordance with the directions, instructions or wishes of:

any body corporate in which the person holds an interest;

if the person is a body corporate—a person who holds an interest in the body corporate;

the trustee of a trust in which the person holds an interest;

if the person is the trustee of a trust—a person who holds an interest in the trust;

any other person or body prescribed by the rules.

the higher entity:

the lower entity is a subsidiary of a corporate entity that is the higher entity’s subsidiary (including because of one or more applications of this subsection).

the communications sector;

the data storage or processing sector;

the financial services and markets sector;

the water and sewerage sector;

the energy sector;

the health care and medical sector;

the higher education and research sector;

the food and grocery sector;

the transport sector;

the space technology sector;

the defence industry sector.

a critical telecommunications asset;

a critical broadcasting asset;

a critical domain name system.

a critical banking asset;

a critical superannuation asset;

a critical insurance asset;

a critical financial market infrastructure asset.

a critical electricity asset;

a critical gas asset;

a critical energy market operator asset;

a critical liquid fuel asset.

a critical port;

a critical freight infrastructure asset;

a critical freight services asset;

a critical public transport asset;

a critical aviation asset.

the impact (whether direct or indirect) of the hazard on the availability of the asset;

the impact (whether direct or indirect) of the hazard on the integrity of the asset;

the impact (whether direct or indirect) of the hazard on the reliability of the asset;

the impact (whether direct or indirect) of the hazard on the confidentiality of:

the impact (whether direct or indirect) of the incident on the availability of the asset;

the impact (whether direct or indirect) of the incident on the integrity of the asset;

the impact (whether direct or indirect) of the incident on the reliability of the asset;

the impact (whether direct or indirect) of the incident on the confidentiality of:

the impact (whether direct or indirect) of the incident on the availability of the system;

the impact (whether direct or indirect) of the incident on the integrity of the system;

the impact (whether direct or indirect) of the incident on the reliability of the system;

the impact (whether direct or indirect) of the incident on the confidentiality of:

a critical telecommunications asset; or

a critical broadcasting asset; or

a critical domain name system; or

a critical data storage or processing asset; or

a critical banking asset; or

a critical superannuation asset; or

a critical insurance asset; or

a critical financial market infrastructure asset; or

a critical water asset; or

a critical electricity asset; or

a critical gas asset; or

a critical energy market operator asset; or

a critical liquid fuel asset; or

a critical hospital; or

a critical education asset; or

a critical food and grocery asset; or

a critical port; or

a critical freight infrastructure asset; or

a critical freight services asset; or

a critical public transport asset; or

a critical aviation asset; or

a critical defence industry asset; or

an asset declared under section 51 to be a critical infrastructure asset; or

an asset prescribed by the rules for the purposes of this paragraph.

a critical telecommunications asset; or

a critical broadcasting asset; or

a critical domain name system; or

a critical data storage or processing asset; or

a critical banking asset; or

a critical superannuation asset; or

a critical insurance asset; or

a critical financial market infrastructure asset; or

a critical water asset; or

a critical electricity asset; or

a critical gas asset; or

a critical energy market operator asset; or

a critical liquid fuel asset; or

a critical hospital; or

a critical education asset; or

a critical food and grocery asset; or

a critical port; or

a critical freight infrastructure asset; or

a critical freight services asset; or

a critical public transport asset; or

a critical aviation asset; or

a critical defence industry asset;

the Commonwealth; or

a body corporate established by a law of the Commonwealth (other than a government business enterprise);

the asset is declared under section 51 to be a critical infrastructure asset; or

the asset is prescribed by the rules for the purposes of paragraph (1)(f).

the satellite is included in the Register of Space Objects kept under section 76 of the Space (Launches and Returns) Act 2018;

Australia is the appropriate State Party for the purposes of undertaking the authorisation and continuing supervision required in respect of the satellite under Article VI of the Outer Space Treaty.

the asset is critical to:

the asset relates to a critical infrastructure sector.

consulted the following persons (the consulted Minister):

given each consulted Minister written notice of the proposal to prescribe the asset; and

had regard to any representations given by a consulted Minister under subsection (5) within the period specified for that purpose.

at least 28 days after the notice is given; or

a shorter period if the Commonwealth Minister considers the shorter period is necessary because of urgent circumstances.

the responsible entity for the critical infrastructure asset owns or operates the data storage system;

the data storage system is used, or is to be used, in connection with the critical infrastructure asset;

business critical data is stored, or is processed in or by, the data storage system (whether or not other information is also stored, or is processed in or by, the data storage system);

for a hazard where there is a material risk that the occurrence of the hazard could have an impact on the data storage system, there is also a material risk that the occurrence of the hazard could have a relevant impact on the critical infrastructure asset.

obligations under Part 2 in relation to a critical infrastructure asset will also need to take into account the data storage system; and

a critical infrastructure risk management program under Part 2A in relation to a critical infrastructure asset will also need to cover the data storage system; and

notification obligations under Part 2B of cyber security incidents relating to any relevant impact on a critical infrastructure asset will also need to take into account any relevant impact on the data storage system.

a network, system, or interconnector, for the transmission or distribution of electricity to ultimately service at least 100,000 customers or any other number of customers prescribed by the rules; or

an electricity generation station that is critical to ensuring the security and reliability of electricity networks or electricity systems in a State or Territory, in accordance with subsection (2).

Broome Port;

Port Adelaide;

Port of Brisbane;

Port of Cairns;

Port of Christmas Island;

Port of Dampier;

Port of Darwin;

Port of Eden;

Port of Fremantle;

Port of Geelong;

Port of Gladstone;

Port of Hay Point;

Port of Hobart;

Port of Melbourne;

Port of Newcastle;

Port of Port Botany;

Port of Port Hedland;

Port of Rockhampton;

Port of Sydney Harbour;

Port of Townsville;

a security regulated port prescribed by the rules for the purposes of this paragraph.

a gas processing facility that has a capacity of at least 300 terajoules per day or any other capacity prescribed by the rules;

a gas storage facility that has a maximum daily withdrawal capacity of at least 75 terajoules per day or any other maximum daily withdrawal capacity prescribed by the rules;

a network or system for the distribution of gas to ultimately service at least 100,000 customers or any other number of customers prescribed by the rules;

a gas transmission pipeline that is critical to ensuring the security and reliability of a gas market, in accordance with subsection (2);

a control room, or any other asset, that is required to operate a gas transmission pipeline covered by paragraph (d).

specified gas transmission pipelines that are critical to ensuring the security and reliability of a gas market; or

requirements for a gas transmission pipeline to be critical to ensuring the security and reliability of a gas market.

a liquid fuel refinery that is critical to ensuring the security and reliability of a liquid fuel market, in accordance with subsection (2);

a liquid fuel pipeline that is critical to ensuring the security and reliability of a liquid fuel market, in accordance with subsection (3);

a liquid fuel storage facility that is critical to ensuring the security and reliability of a liquid fuel market, in accordance with subsection (4).

specified liquid fuel refineries that are critical to ensuring the security and reliability of a liquid fuel market; or

requirements for a liquid fuel refinery to be critical to ensuring the security and reliability of a liquid fuel market.

specified liquid fuel pipelines that are critical to ensuring the security and reliability of a liquid fuel market; or

requirements for a liquid fuel pipeline to be critical to ensuring the security and reliability of a liquid fuel market.

specified liquid fuel storage facilities that are critical to ensuring the security and reliability of a liquid fuel market; or

requirements for a liquid fuel storage facility to be critical to ensuring the security and reliability of a liquid fuel market.

a road network that, in accordance with subsection (2), functions as a critical corridor for the transportation of goods between:

a rail network that, in accordance with subsection (3), functions as a critical corridor for the transportation of goods between:

an intermodal transfer facility that, in accordance with subsection (4), is critical to the transportation of goods between:

specified road networks that function as a critical corridor for the transportation of goods between:

requirements for a road network to function as a critical corridor for the transportation of goods between:

specified rail networks that function as a critical corridor for the transportation of goods between:

requirements for a rail network to function as a critical corridor for the transportation of goods between:

specified intermodal transfer facilities that are critical to the transportation of goods between:

requirements for an intermodal transfer facility to be critical to the transportation of goods between:

road;

rail;

inland waters;

sea.

specified businesses that are critical to the transportation of goods by any or all of the following:

requirements for a business to be critical to the transportation of goods by any or all of the following:

an asset that:

an asset that:

an asset that:

an asset that:

an asset that:

an asset that:

an asset that:

an asset that:

an asset that is used in connection with the operation of a payment system that, in accordance with subsection (6), is critical to the security and reliability of the financial services and markets sector.

specified financial markets that are critical to the security and reliability of the financial services and markets sector; or

requirements for a financial market to be critical to the security and reliability of the financial services and markets sector.

specified clearing and settlement facilities that are critical to the security and reliability of the financial services and markets sector; or

requirements for a clearing and settlement facility to be critical to the security and reliability of the financial services and markets sector.

specified significant financial benchmarks that are critical to the security and reliability of the financial services and markets sector; or

requirements for a significant financial benchmark to be critical to the security and reliability of the financial services and markets sector.

specified derivative trade repositories that are critical to the security and reliability of the financial services and markets sector; or

requirements for a derivative trade repository to be critical to the security and reliability of the financial services and markets sector.

specified payment systems that are critical to the security and reliability of the financial services and markets sector; or

requirements for a payment system to be critical to the security and reliability of the financial services and markets sector.

the broadcasting transmission assets are:

the broadcasting transmission assets are:

the broadcasting transmission assets are owned or operated by an entity that, in accordance with subsection (3), is critical to the transmission of a broadcasting service.

specified sites that are critical transmission sites; or

requirements for sites to be critical transmission sites.

specified entities that are critical to the transmission of a broadcasting service; or

requirements for an entity to be critical to the transmission of a broadcasting service.

it is owned or operated by an entity that is a data storage or processing provider; and

it is used wholly or primarily to provide a data storage or processing service that relates to business critical data and that is provided by the entity to an end‑user that is:

the entity knows that the asset is used as described in paragraph (b); and

the asset is not a critical infrastructure asset that is covered by a paragraph of subsection 9(1) (other than paragraph 9(1)(d)).

it is owned or operated by an entity that is a data storage or processing provider; and

it is used wholly or primarily to provide a data storage or processing service that:

the entity knows that the asset is used as described in paragraph (b); and

the asset is not a critical infrastructure asset that is covered by a paragraph of subsection 9(1) (other than paragraph 9(1)(d)).

an entity (the first entity) is the responsible entity for a critical infrastructure asset; and

the first entity becomes aware that a data storage or processing service:

take reasonable steps to inform that other entity that the first entity has become aware that the data storage or processing service:

do so as soon as practicable after becoming so aware.

an asset where the following conditions are satisfied:

an asset where the following conditions are satisfied:

specified authorised deposit‑taking institutions that are critical to the security and reliability of the financial services and markets sector; or

requirements for an authorised deposit‑taking institution to be critical to the security and reliability of the financial services and markets sector.

specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or

requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector.

an asset where the following conditions are satisfied:

an asset where the following conditions are satisfied:

an asset where the following conditions are satisfied:

an asset where the following conditions are satisfied:

an asset where the following conditions are satisfied:

an asset where the following conditions are satisfied:

specified entities that are critical to the security and reliability of the financial services and markets sector; or

requirements for an entity to be critical to the security and reliability of the financial services and markets sector.

specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or

requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector.

specified entities that are critical to the security and reliability of the financial services and markets sector; or

requirements for an entity to be critical to the security and reliability of the financial services and markets sector.

specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or

requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector.

specified entities that are critical to the security and reliability of the financial services and markets sector; or

requirements for an entity to be critical to the security and reliability of the financial services and markets sector.

specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or

requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector.

it is owned or operated by an RSE licensee that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector; and

it is used in connection with the operation of a superannuation fund.

specified RSE licensees that are critical to the security and reliability of the financial services and markets sector; or

requirements for an RSE licensee to be critical to the security and reliability of the financial services and markets sector.

is used for the distribution or supply of:

is owned or operated by an entity that is:

specified entities that are critical supermarket retailers; or

requirements for an entity to be a critical supermarket retailer.

specified entities that are critical food wholesalers; or

requirements for an entity to be a critical food wholesaler.

specified entities that are critical grocery wholesalers; or

requirements for an entity to be a critical grocery wholesaler.

is managed by an entity that, in accordance with subsection (2), is critical to the administration of an Australian domain name system; and

is used in connection with the administration of an Australian domain name system; and

is an asset that, in accordance with subsection (3), is critical to the administration of an Australian domain name system.

specified entities that are critical to the administration of an Australian domain name system; or

requirements for an entity to be critical to the administration of an Australian domain name system.

specified assets that are critical to the administration of an Australian domain name system; or

requirements for an asset to be critical to the administration of an Australian domain name system.

whichever of the following is applicable:

if another entity is prescribed by the rules in relation to the asset—that other entity.

the entity referred to in whichever of the following provisions is applicable:

if another entity is prescribed by the rules in relation to the asset—that other entity.

the entity referred to in paragraph 12KA(1)(a); or

if another entity is prescribed by the rules in relation to the system—that other entity.

if the asset is covered by subsection 12F(1)—the entity referred to in paragraph 12F(1)(a); or

if the asset is covered by subsection 12F(2)—the entity referred to in paragraph 12F(2)(a); or

if another entity is prescribed by the rules in relation to the asset—that other entity.

if the asset is covered by paragraph 12G(1)(a)—the authorised deposit‑taking institution referred to in subparagraph 12G(1)(a)(i); or

if the asset is covered by paragraph 12G(1)(b)—the body corporate referred to in subparagraph 12G(1)(b)(i); or

if another entity is prescribed by the rules in relation to the asset—that other entity.

the RSE licensee referred to in subsection 12J(1); or

if another entity is prescribed by the rules in relation to the asset—that other entity.

if the asset is covered by paragraph 12H(1)(a)—the entity referred to in subparagraph 12H(1)(a)(i); or

if the asset is covered by paragraph 12H(1)(b)—the body corporate referred to in subparagraph 12H(1)(b)(i); or

if the asset is covered by paragraph 12H(1)(c)—the entity referred to in subparagraph 12H(1)(c)(i); or

if the asset is covered by paragraph 12H(1)(d)—the body corporate referred to in subparagraph 12H(1)(d)(i); or

if the asset is covered by paragraph 12H(1)(e)—the entity referred to in subparagraph 12H(1)(e)(i); or

if the asset is covered by paragraph 12H(1)(f)—the body corporate referred to in subparagraph 12H(1)(f)(i); or

if another entity is prescribed by the rules in relation to the asset—that other entity.

if the asset is covered by paragraph 12D(1)(a)—the body corporate referred to in subparagraph 12D(1)(a)(i); or

if the asset is covered by paragraph 12D(1)(b)—the associated entity referred to in subparagraph 12D(1)(b)(i); or

if the asset is covered by paragraph 12D(1)(c)—the body corporate referred to in subparagraph 12D(1)(c)(i); or

if the asset is covered by paragraph 12D(1)(d)—the associated entity referred to in subparagraph 12D(1)(d)(i); or

if the asset is covered by paragraph 12D(1)(e)—the body corporate referred to in subparagraph 12D(1)(e)(i); or

if the asset is covered by paragraph 12D(1)(f)—the associated entity referred to in subparagraph 12D(1)(f)(i); or

if the asset is covered by paragraph 12D(1)(g)—the body corporate referred to in subparagraph 12D(1)(g)(i); or

if the asset is covered by paragraph 12D(1)(h)—the associated entity referred to in subparagraph 12D(1)(h)(i); or

if the asset is covered by paragraph 12D(1)(i)—the entity prescribed by the rules; or

if another entity is prescribed by the rules in relation to the asset—that other entity.

the water utility that holds the licence, approval or authorisation (however described), under a law of the Commonwealth, a State or a Territory, to provide the service to be delivered by the asset; or

if another entity is prescribed by the rules in relation to the asset—that other entity.

the entity that holds the licence, approval or authorisation (however described) to operate the asset to provide the service to be delivered by the asset; or

if another entity is prescribed by the rules in relation to the asset—that other entity.

the entity that holds the licence, approval or authorisation (however described) to operate the asset to provide the service to be delivered by the asset; or

if another entity is prescribed by the rules in relation to the asset—that other entity.

if the asset is used by Australian Energy Market Operator Limited (ACN 072 010 327)—that company; or

if the asset is used by Power and Water Corporation—that corporation; or

if the asset is used by Regional Power Corporation—that corporation; or

if the asset is used by Electricity Networks Corporation—that corporation; or

if another entity is prescribed by the rules in relation to the asset—that other entity.

if the asset is a liquid fuel refinery—the entity that operates the liquid fuel refinery; or

if the asset is a liquid fuel pipeline—the entity that operates the liquid fuel pipeline; or

if the asset is a liquid fuel storage facility—the entity that operates the liquid fuel storage facility; or

if another entity is prescribed by the rules in relation to the asset—that other entity.

if the critical hospital is a public hospital—the local hospital network that operates the hospital; or

if the critical hospital is a private hospital—the entity that holds the licence, approval or authorisation (however described), under a law of a State or a Territory to operate the hospital; or

if another entity is prescribed by the rules in relation to the hospital—that other entity.

the entity referred to in the definition of critical education asset in section 5; or

if another entity is prescribed by the rules in relation to the asset—that other entity.

the entity referred to in paragraph 12K(1)(b); or

if another entity is prescribed by the rules in relation to the asset—that other entity.

the port operator (within the meaning of the Maritime Transport and Offshore Facilities Security Act 2003) of the port; or

if another entity is prescribed by the rules in relation to the port—that other entity.

if the Commonwealth is responsible for the management of the asset—the Commonwealth; or

if a State is responsible for the management of the asset—the State; or

if a Territory is responsible for the management of the asset—the Territory; or

if a body is:

  that body; or

if none of paragraphs (a), (b), (c), (d) and (e) apply—the entity prescribed by the rules in relation to the asset; or

if another entity is prescribed by the rules in relation to the asset—that other entity.

the entity referred to in subsection 12C(1); or

if another entity is prescribed by the rules in relation to the asset—that other entity.

the entity referred to in paragraph (a) of the definition of critical public transport asset in section 5; or

if another entity is prescribed by the rules in relation to the asset—that other entity.

if the asset is:

  the aircraft operator; or

if the asset is:

  the regulated air cargo agent; or

if the asset is used by an airport operator in connection with the operation of an airport—the airport operator; or

if another entity is prescribed by the rules in relation to the asset—that other entity.

the entity referred to in paragraph (a) of the definition of critical defence industry asset; or

if another entity is prescribed by the rules in relation to the asset—that other entity.

unauthorised access to:

unauthorised modification of:

unauthorised impairment of electronic communication to or from a computer;

unauthorised impairment of the availability, reliability, security or operation of:

access to:

modification of:

the impairment of electronic communication to or from a computer; or

the impairment of the availability, reliability, security or operation of:

a person causes any access, modification or impairment of a kind mentioned in that subsection; and

the person does so:

if the incident is imminent—preventing the incident;

mitigating a relevant impact of the incident on:

if a critical infrastructure asset or a critical infrastructure sector asset has been, or is being, affected by the incident—restoring the functionality of the asset.

an entity that is a corporation to which paragraph 51(xx) of the Constitution applies;

an entity, so far as the entity is the responsible entity for, a reporting entity for, a relevant entity for, or an operator of, an asset that is:

an entity that is an alien (within the meaning of paragraph 51(xix) of the Constitution).

the asset is specified in the rules; or

both:

immediately before the commencement of this section, the asset was a critical infrastructure asset (within the meaning of this Act as in force immediately before that commencement).

beginning when the asset became a critical infrastructure asset; and

ending at a time ascertained in accordance with the rules.

cause to be published on the Department’s website a notice:

give a copy of the notice to each First Minister; and

consider any submissions received within the period mentioned in paragraph (a).

the information obtained by the Secretary under Division 3 (obligation to give information and notify of events); and

any information added under section 20; and

any corrections or updates of information described in paragraph (a) or (b) that are made under section 21.

operational information in relation to a critical infrastructure asset;

interest and control information in relation to a direct interest holder and a critical infrastructure asset.

if the reporting entity is the responsible entity for the asset—the operational information in relation to the asset;

if the reporting entity is a direct interest holder in relation to the asset—the interest and control information in relation to the entity and the asset.

in the approved form; and

by the later of:

after the entity gives information in relation to the asset under section 23; or

after the end of the grace period for the asset.

in the approved form; and

by the end of 30 days after the event occurs.

before the end of 30 days after the first event occurs, another notifiable event (the second event) occurs in relation to the asset; and

a result of the second event is that the information in relation to the asset that was required to be given to the Secretary under subsection (2) following the first event is no longer correct.

the person uses the person’s best endeavours to obtain the information; and

the person is not able to obtain the information.

the event has the effect that either of the following previously obtained by the Secretary for the purposes of this Act becomes incorrect or incomplete:

the event is an entity becoming a reporting entity for the asset; or

the event is a reporting entity for the asset becoming an entity to which this Act applies (see section 13).

any entity; or

specified classes of entities; or

specified entities;

is placed into voluntary administration, liquidation or receivership before giving the notice or information; and

is no longer in a position to give the notice or information;

identify each hazard where there is a material risk that the occurrence of the hazard could have a relevant impact on the asset;

so far as it is reasonably practicable to do so—minimise or eliminate any material risk of such a hazard occurring;

so far as it is reasonably practicable to do so—mitigate the relevant impact of such a hazard on the asset.

the asset is specified in the rules; or

both:

beginning when the asset became a critical infrastructure asset; and

ending at a time ascertained in accordance with the rules.

an entity holds a certificate of hosting certification (strategic level) that relates to one or more services; and

the certificate was issued under the scheme that is:

a critical infrastructure asset, or a part of a critical infrastructure asset, is used in connection with the provision of any of those services; and

the entity is the responsible entity for the asset;

an entity is covered by a provision of a law of the Commonwealth, a State or a Territory; and

the provision is specified in the rules; and

the entity is the responsible entity for a critical infrastructure asset;

a critical infrastructure asset is covered by a provision of a law of the Commonwealth, a State or a Territory; and

the provision is specified in the rules;

cause to be published on the Department’s website a notice:

give a copy of the notice to each First Minister; and

consider any submissions received within the period mentioned in paragraph (a).

adopt; and

maintain;

an entity is the responsible entity for one or more critical infrastructure assets; and

the entity has adopted a critical infrastructure risk management program that applies to the entity;

the critical infrastructure risk management program; or

if the program has been varied on one or more occasions—the program as varied.

an entity is the responsible entity for one or more critical infrastructure assets; and

the entity has adopted a critical infrastructure risk management program that applies to the entity;

an entity is the responsible entity for one or more critical infrastructure assets; and

the entity has adopted a critical infrastructure risk management program that applies to the entity;

an entity was the responsible entity for one or more critical infrastructure assets; and

the entity had a critical infrastructure risk management program that applied to the entity.

if there is a relevant Commonwealth regulator that has functions relating to the security of those assets—the relevant Commonwealth regulator; or

in any other case—the Secretary;

if the entity had the program at the end of the financial year—includes whichever of the following statements is applicable:

if a hazard had a significant relevant impact on one or more of those assets during the relevant period—includes a statement that:

if one or more of those assets are critical telecommunications assets:

if the entity was given a direction under section 30AI during the relevant period—includes a statement that:

is in the approved form; and

if the entity has a board, council or other governing body—is approved by the board, council or other governing body, as the case requires.

that applies to a particular entity that is the responsible entity for one or more critical infrastructure assets; and

the purpose of which is to do the following for each of those assets:

that complies with such requirements (if any) as are specified in the rules.

may be of general application; or

may relate to one or more specified critical infrastructure assets.

permit a background check of an individual to be conducted under the AusCheck scheme; and

provide that such a background check must include assessment of information relating to one or more of the matters mentioned in paragraphs 5(a), (b), (c) and (d) of the AusCheck Act 2007, as specified in the rules; and

provide that, if such a background check includes an assessment of information relating to the matter mentioned in paragraph 5(a) of the AusCheck Act 2007, the criteria against which that information must be assessed are the criteria specified in the rules; and

provide that, if such a background check includes assessment of information relating to the matter mentioned in paragraph 5(d) of the AusCheck Act 2007, the assessment must consist of whichever of the following is specified in the rules:

any existing regulatory system of the Commonwealth, a State or a Territory that imposes obligations on responsible entities;

the costs that are likely to be incurred by responsible entities in complying with those rules;

the reasonableness and proportionality of the requirements in relation to the purpose referred to in paragraph (1)(b);

such other matters (if any) as the Minister considers relevant.

the likelihood of the hazard occurring; and

the relevant impact of the hazard on the asset if the hazard were to occur.

the Secretary, unless paragraph (b) applies; or

if there is a relevant Commonwealth regulator that has functions relating to the security of those assets:

national security; or

the defence of Australia; or

the social or economic stability of Australia or its people.

specify the serious deficiencies; and

require the responsible entity to vary the entity’s critical infrastructure risk management program to address those deficiencies; and

specify the period within which the responsible entity must vary that program, which must be a period of at least 14 days starting on the day on which the direction is given.

stating that the relevant official is considering giving the responsible entity a direction under subsection (1); and

specifying the serious deficiencies covered by subsection (1); and

invite the responsible entity to give the relevant official, within 14 days after the day the notice is given to the responsible entity, a written submission in relation to the notice.

any written submission received from the responsible entity within that 14‑day period; and

any action that is taken, or proposed to be taken, by the responsible entity in response to the notice and that is notified to the relevant official within that 14‑day period.

revoking that adoption; and

adopting another critical infrastructure risk management program that applies to the entity.

an entity is the responsible entity for one or more critical infrastructure assets; and

the entity has adopted a critical infrastructure risk management program that applies to the entity;

an entity is the responsible entity for one or more critical infrastructure assets; and

the entity has adopted a critical infrastructure risk management program that applies to the entity;

may be of general application; or

may relate to one or more specified critical infrastructure assets.

cause to be published on the Department’s website a notice:

give a copy of the notice to each First Minister; and