##### 30AA  Simplified outline of this Part - • The responsible entity for one or more critical infrastructure assets must have, and comply with, a critical infrastructure risk management program \(unless an exemption applies\)\. - • The purpose of a critical infrastructure risk management program is to do the following for each of those assets: - \(a\) identify each hazard where there is a material risk that the occurrence of the hazard could have a relevant impact on the asset; - \(b\) so far as it is reasonably practicable to do so—minimise or eliminate any material risk of such a hazard occurring; - \(c\) so far as it is reasonably practicable to do so—mitigate the relevant impact of such a hazard on the asset\. - • A responsible entity must give an annual report relating to its critical infrastructure risk management program\. If the entity has a board, council or other governing body, the annual report must be approved by the board, council or other governing body\. Note: See also section 30AB \(application of this Part\)\. --- ## Source and attribution Saved copy: C2018A00029 / C2026C00213 / f578e546a17068939a3a5a928474713f844dfae8 Scope: navPoint\_66 Compiled 2026\-06\-04\. This does not establish legal commencement\. Official source: https://www\.legislation\.gov\.au/C2018A00029/2026\-06\-04/2026\-06\-04/text/1/epub/OEBPS/document\_1/document\_1\.html Licence: https://creativecommons\.org/licenses/by/4\.0/ Based on content from the Federal Register of Legislation at 1 October 2026\. For the latest information on Australian Government legislation please go to https://www\.legislation\.gov\.au\. Converted XHTML into Tiptap JSON; recovered lists from paragraph classes; kept literal labels and text\. Print layout is changed\. The Commonwealth Coat of Arms is not covered by the CC BY licence\.