{"format":"calico-law-export-v1","source":{"copy":{"lawId":"C2018A00029","compilationId":"C2026C00213","commit":"f578e546a17068939a3a5a928474713f844dfae8"},"metadata":{"title":"Security of Critical Infrastructure Act 2018","titleId":"C2018A00029","registerId":"C2026C00213","compilationNumber":"9","compilationDate":"2026-06-04","downloadDate":"2026-10-01","sourceURL":"https://www.legislation.gov.au/C2018A00029/2026-06-04/2026-06-04/text/1/epub/OEBPS/document_1/document_1.html","latestURL":"https://www.legislation.gov.au/C2018A00029/latest/text","licence":"https://creativecommons.org/licenses/by/4.0/","attribution":"Based on content from the Federal Register of Legislation at 1 October 2026. For the latest information on Australian Government legislation please go to https://www.legislation.gov.au.","changes":"Converted XHTML into Tiptap JSON; recovered lists from paragraph classes; kept literal labels and text. Print layout is changed.","exceptions":"The Commonwealth Coat of Arms is not covered by the CC BY licence."},"contents":[{"provisionId":"navPoint_3","heading":"1  Short title"},{"provisionId":"navPoint_4","heading":"2  Commencement"},{"provisionId":"navPoint_5","heading":"3  Object"},{"provisionId":"navPoint_6","heading":"4  Simplified outline of this Act"},{"provisionId":"navPoint_8","heading":"5  Definitions"},{"provisionId":"navPoint_9","heading":"5A  Meaning of protected information and relevant information"},{"provisionId":"navPoint_10","heading":"6  Meaning of interest and control information"},{"provisionId":"navPoint_11","heading":"7  Meaning of operational information"},{"provisionId":"navPoint_12","heading":"8  Meaning of direct interest holder"},{"provisionId":"navPoint_13","heading":"8A  Meaning of influence or control"},{"provisionId":"navPoint_14","heading":"8B  Meaning of associate"},{"provisionId":"navPoint_15","heading":"8C  Meanings of subsidiary and holding entity"},{"provisionId":"navPoint_16","heading":"8D  Meaning of critical infrastructure sector"},{"provisionId":"navPoint_17","heading":"8E  Meaning of critical infrastructure sector asset"},{"provisionId":"navPoint_18","heading":"8F  Critical infrastructure sector for a critical infrastructure asset"},{"provisionId":"navPoint_19","heading":"8G  Meaning of relevant impact"},{"provisionId":"navPoint_20","heading":"9  Meaning of critical infrastructure asset"},{"provisionId":"navPoint_21","heading":"10  Meaning of critical electricity asset"},{"provisionId":"navPoint_22","heading":"11  Meaning of critical port"},{"provisionId":"navPoint_23","heading":"12  Meaning of critical gas asset"},{"provisionId":"navPoint_24","heading":"12A  Meaning of critical liquid fuel asset"},{"provisionId":"navPoint_25","heading":"12B  Meaning of critical freight infrastructure asset"},{"provisionId":"navPoint_26","heading":"12C  Meaning of critical freight services asset"},{"provisionId":"navPoint_27","heading":"12D  Meaning of critical financial market infrastructure asset"},{"provisionId":"navPoint_28","heading":"12E  Meaning of critical broadcasting asset"},{"provisionId":"navPoint_29","heading":"12F  Meaning of critical data storage or processing asset"},{"provisionId":"navPoint_30","heading":"12G  Meaning of critical banking asset"},{"provisionId":"navPoint_31","heading":"12H  Meaning of critical insurance asset"},{"provisionId":"navPoint_32","heading":"12J  Meaning of critical superannuation asset"},{"provisionId":"navPoint_33","heading":"12K  Meaning of critical food and grocery asset"},{"provisionId":"navPoint_34","heading":"12KA  Meaning of critical domain name system"},{"provisionId":"navPoint_35","heading":"12L  Meaning of responsible entity"},{"provisionId":"navPoint_36","heading":"12M  Meaning of cyber security incident"},{"provisionId":"navPoint_37","heading":"12N  Meaning of unauthorised access, modification or impairment"},{"provisionId":"navPoint_38","heading":"12P  Examples of responding to an incident (including a cyber security incident)"},{"provisionId":"navPoint_40","heading":"13  Application of this Act"},{"provisionId":"navPoint_41","heading":"14  Extraterritoriality"},{"provisionId":"navPoint_42","heading":"15  This Act binds the Crown"},{"provisionId":"navPoint_43","heading":"16  Concurrent operation of State and Territory laws"},{"provisionId":"navPoint_44","heading":"17  State constitutional powers"},{"provisionId":"navPoint_47","heading":"18  Simplified outline of this Part"},{"provisionId":"navPoint_48","heading":"18A  Application of this Part"},{"provisionId":"navPoint_49","heading":"18AA  Consultation—rules"},{"provisionId":"navPoint_51","heading":"19  Secretary must keep Register"},{"provisionId":"navPoint_52","heading":"20  Secretary may add information to Register"},{"provisionId":"navPoint_53","heading":"21  Secretary may correct or update information in the Register"},{"provisionId":"navPoint_54","heading":"22  Register not to be made public"},{"provisionId":"navPoint_56","heading":"23  Initial obligation to give information"},{"provisionId":"navPoint_57","heading":"24  Ongoing obligation to give information and notify of events"},{"provisionId":"navPoint_58","heading":"25  Information that is not able to be obtained"},{"provisionId":"navPoint_59","heading":"26  Meaning of notifiable event"},{"provisionId":"navPoint_60","heading":"27  Rules may exempt from requirement to give notice or information"},{"provisionId":"navPoint_62","heading":"28  Requirement for executors and administrators to give notice or information for individuals who die"},{"provisionId":"navPoint_63","heading":"29  Requirement for corporate liquidators etc. to give notice or information"},{"provisionId":"navPoint_64","heading":"30  Agents may give notice or information"},{"provisionId":"navPoint_66","heading":"30AA  Simplified outline of this Part"},{"provisionId":"navPoint_67","heading":"30AB  Application of this Part"},{"provisionId":"navPoint_68","heading":"30ABA  Consultation—rules"},{"provisionId":"navPoint_69","heading":"30AC  Responsible entity must have a critical infrastructure risk management program"},{"provisionId":"navPoint_70","heading":"30AD  Compliance with critical infrastructure risk management program"},{"provisionId":"navPoint_71","heading":"30AE  Review of critical infrastructure risk management program"},{"provisionId":"navPoint_72","heading":"30AF  Update of critical infrastructure risk management program"},{"provisionId":"navPoint_73","heading":"30AG  Responsible entity must submit annual report"},{"provisionId":"navPoint_74","heading":"30AH  Critical infrastructure risk management program"},{"provisionId":"navPoint_75","heading":"30AI  Direction to vary critical infrastructure risk management program"},{"provisionId":"navPoint_76","heading":"30AJ  Variation of critical infrastructure risk management program"},{"provisionId":"navPoint_77","heading":"30AK  Revocation of adoption of critical infrastructure risk management program"},{"provisionId":"navPoint_78","heading":"30AKA  Responsible entity must have regard to certain matters in deciding whether to adopt or vary critical infrastructure risk management program etc."},{"provisionId":"navPoint_79","heading":"30AL  Consultation—rules made for the purposes of section 30AH or 30AKA"},{"provisionId":"navPoint_80","heading":"30AM  Review of rules"},{"provisionId":"navPoint_81","heading":"30AN  Application, adoption or incorporation of a law of a State or Territory etc."},{"provisionId":"navPoint_82","heading":"30ANA  Application, adoption or incorporation of certain documents"},{"provisionId":"navPoint_83","heading":"30ANB  Consultation—rules made for the purposes of paragraph 30ANA(2)(f)"},{"provisionId":"navPoint_84","heading":"30ANC  Disallowance of rules"},{"provisionId":"navPoint_86","heading":"30AP  Simplified outline of this Part"},{"provisionId":"navPoint_87","heading":"30AQ  Reporting obligations relating to certain assets that are not covered by a critical infrastructure risk management program"},{"provisionId":"navPoint_89","heading":"30BA  Simplified outline of this Part"},{"provisionId":"navPoint_90","heading":"30BB  Application of this Part"},{"provisionId":"navPoint_91","heading":"30BBA  Consultation—rules"},{"provisionId":"navPoint_92","heading":"30BC  Notification of critical cyber security incidents"},{"provisionId":"navPoint_93","heading":"30BD  Notification of other cyber security incidents"},{"provisionId":"navPoint_94","heading":"30BE  Liability"},{"provisionId":"navPoint_95","heading":"30BEA  Significant impact"},{"provisionId":"navPoint_96","heading":"30BEB  Consultation—rules"},{"provisionId":"navPoint_97","heading":"30BF  Relevant Commonwealth body"},{"provisionId":"navPoint_100","heading":"30CA  Simplified outline of this Part"},{"provisionId":"navPoint_103","heading":"30CB  Application of statutory incident response planning obligations—determination by the Secretary"},{"provisionId":"navPoint_104","heading":"30CC  Revocation of determination"},{"provisionId":"navPoint_106","heading":"30CD  Responsible entity must have an incident response plan"},{"provisionId":"navPoint_107","heading":"30CE  Compliance with incident response plan"},{"provisionId":"navPoint_108","heading":"30CF  Review of incident response plan"},{"provisionId":"navPoint_109","heading":"30CG  Update of incident response plan"},{"provisionId":"navPoint_110","heading":"30CH  Copy of incident response plan must be given to the Secretary"},{"provisionId":"navPoint_111","heading":"30CJ  Incident response plan"},{"provisionId":"navPoint_112","heading":"30CK  Variation of incident response plan"},{"provisionId":"navPoint_113","heading":"30CL  Revocation of adoption of incident response plan"},{"provisionId":"navPoint_115","heading":"30CM  Requirement to undertake cyber security exercise"},{"provisionId":"navPoint_116","heading":"30CN  Cyber security exercise"},{"provisionId":"navPoint_117","heading":"30CP  Compliance with requirement to undertake cyber security exercise"},{"provisionId":"navPoint_118","heading":"30CQ  Internal evaluation report"},{"provisionId":"navPoint_119","heading":"30CR  External evaluation report"},{"provisionId":"navPoint_120","heading":"30CS  Meaning of evaluation report"},{"provisionId":"navPoint_121","heading":"30CT  External auditors"},{"provisionId":"navPoint_123","heading":"30CU  Requirement to undertake vulnerability assessment"},{"provisionId":"navPoint_124","heading":"30CV  Compliance with requirement to undertake a vulnerability assessment"},{"provisionId":"navPoint_125","heading":"30CW  Designated officers may undertake a vulnerability assessment"},{"provisionId":"navPoint_126","heading":"30CX  Compliance with requirement to provide reasonable assistance etc."},{"provisionId":"navPoint_127","heading":"30CY  Vulnerability assessment"},{"provisionId":"navPoint_128","heading":"30CZ  Vulnerability assessment report"},{"provisionId":"navPoint_129","heading":"30DA  Meaning of vulnerability assessment report"},{"provisionId":"navPoint_132","heading":"30DB  Secretary may require periodic reporting of system information"},{"provisionId":"navPoint_133","heading":"30DC  Secretary may require event‑based reporting of system information"},{"provisionId":"navPoint_134","heading":"30DD  Consultation"},{"provisionId":"navPoint_135","heading":"30DE  Duration of system information periodic reporting notice or system information event‑based reporting notice"},{"provisionId":"navPoint_136","heading":"30DF  Compliance with system information periodic reporting notice or system information event‑based reporting notice"},{"provisionId":"navPoint_137","heading":"30DG  Self‑incrimination etc."},{"provisionId":"navPoint_138","heading":"30DH  Admissibility of report etc."},{"provisionId":"navPoint_140","heading":"30DJ  Secretary may require installation of system information software"},{"provisionId":"navPoint_141","heading":"30DK  Consultation"},{"provisionId":"navPoint_142","heading":"30DL  Duration of system information software notice"},{"provisionId":"navPoint_143","heading":"30DM  Compliance with system information software notice"},{"provisionId":"navPoint_144","heading":"30DN  Self‑incrimination etc."},{"provisionId":"navPoint_145","heading":"30DP  Admissibility of information etc."},{"provisionId":"navPoint_147","heading":"30DQ  Designated officer"},{"provisionId":"navPoint_150","heading":"30EA  Simplified outline of this Part"},{"provisionId":"navPoint_152","heading":"30EB  Responsible entity’s obligation to protect critical telecommunications assets"},{"provisionId":"navPoint_154","heading":"30EC  Responsible entity to notify certain changes and proposed changes to telecommunications service or system"},{"provisionId":"navPoint_155","heading":"30ED  Secretary to assess notified changes and proposed changes"},{"provisionId":"navPoint_156","heading":"30EE  Kinds of changes and proposed changes to telecommunications services or telecommunications systems"},{"provisionId":"navPoint_158","heading":"30EF  Minister’s direction if use or supply of carriage services prejudicial to security"},{"provisionId":"navPoint_161","heading":"31  Simplified outline of this Part"},{"provisionId":"navPoint_163","heading":"32  Direction if risk of act or omission that would be prejudicial to security"},{"provisionId":"navPoint_164","heading":"33  Consultation before giving direction"},{"provisionId":"navPoint_165","heading":"34  Requirement to comply with direction"},{"provisionId":"navPoint_166","heading":"35  Exception—acquisition of property"},{"provisionId":"navPoint_167","heading":"35AAA  Directions prevail over inconsistent critical infrastructure risk management programs"},{"provisionId":"navPoint_168","heading":"35AAB  Liability"},{"provisionId":"navPoint_171","heading":"35AA  Simplified outline of this Part"},{"provisionId":"navPoint_173","heading":"35AB  Ministerial authorisation"},{"provisionId":"navPoint_174","heading":"35AC  Kinds of acts or things that may be specified in an intervention request"},{"provisionId":"navPoint_175","heading":"35AD  Consultation"},{"provisionId":"navPoint_176","heading":"35AE  Form and notification of Ministerial authorisation"},{"provisionId":"navPoint_177","heading":"35AF  Form of application for Ministerial authorisation"},{"provisionId":"navPoint_178","heading":"35AG  Duration of Ministerial authorisation"},{"provisionId":"navPoint_179","heading":"35AH  Revocation of Ministerial authorisation"},{"provisionId":"navPoint_180","heading":"35AJ  Minister to exercise powers personally"},{"provisionId":"navPoint_182","heading":"35AK  Information gathering direction"},{"provisionId":"navPoint_183","heading":"35AL  Form of direction"},{"provisionId":"navPoint_184","heading":"35AM  Compliance with an information gathering direction"},{"provisionId":"navPoint_185","heading":"35AN  Self‑incrimination etc."},{"provisionId":"navPoint_186","heading":"35AP  Admissibility of information etc."},{"provisionId":"navPoint_188","heading":"35AQ  Action direction"},{"provisionId":"navPoint_189","heading":"35AR  Form of direction"},{"provisionId":"navPoint_190","heading":"35AS  Revocation of direction"},{"provisionId":"navPoint_191","heading":"35AT  Compliance with direction"},{"provisionId":"navPoint_192","heading":"35AU  Directions prevail over inconsistent critical infrastructure risk management programs"},{"provisionId":"navPoint_193","heading":"35AV  Directions prevail over inconsistent obligations"},{"provisionId":"navPoint_194","heading":"35AW  Liability"},{"provisionId":"navPoint_196","heading":"35AX  Intervention request"},{"provisionId":"navPoint_197","heading":"35AY  Form and notification of request"},{"provisionId":"navPoint_198","heading":"35AZ  Compliance with request"},{"provisionId":"navPoint_199","heading":"35BA  Revocation of request"},{"provisionId":"navPoint_200","heading":"35BB  Relevant entity to assist the authorised agency"},{"provisionId":"navPoint_201","heading":"35BC  Constable may assist the authorised agency"},{"provisionId":"navPoint_202","heading":"35BD  Removal and return of computers etc."},{"provisionId":"navPoint_203","heading":"35BE  Use of force against an individual not authorised"},{"provisionId":"navPoint_204","heading":"35BF  Liability"},{"provisionId":"navPoint_205","heading":"35BG  Evidentiary certificates"},{"provisionId":"navPoint_206","heading":"35BH  Chief executive of the authorised agency to report to the Defence Minister and the Minister"},{"provisionId":"navPoint_207","heading":"35BJ  Approved staff members of the authorised agency"},{"provisionId":"navPoint_209","heading":"35BK  Reports to the Parliamentary Joint Committee on Intelligence and Security"},{"provisionId":"navPoint_212","heading":"36  Simplified outline of this Part"},{"provisionId":"navPoint_214","heading":"37  Secretary may obtain information or documents from entities"},{"provisionId":"navPoint_215","heading":"38  Copies of documents"},{"provisionId":"navPoint_216","heading":"39  Retention of documents"},{"provisionId":"navPoint_217","heading":"40  Self‑incrimination"},{"provisionId":"navPoint_220","heading":"41  Authorised use and disclosure—performing functions etc."},{"provisionId":"navPoint_221","heading":"42  Authorised use and disclosure—other person’s functions etc."},{"provisionId":"navPoint_222","heading":"42AA  Authorised use and disclosure—availability, integrity, reliability or security of a critical infrastructure asset"},{"provisionId":"navPoint_223","heading":"42A  Authorised use and disclosure—development of proposed amendments of this Act etc."},{"provisionId":"navPoint_224","heading":"43  Authorised disclosure relating to law enforcement"},{"provisionId":"navPoint_225","heading":"43AA  Authorised disclosure to Ombudsman official"},{"provisionId":"navPoint_226","heading":"43A  Authorised disclosure to IGIS official"},{"provisionId":"navPoint_227","heading":"43B  Authorised use and disclosure—Ombudsman official"},{"provisionId":"navPoint_228","heading":"43C  Authorised use and disclosure—IGIS official"},{"provisionId":"navPoint_229","heading":"43D  Authorised use and disclosure—ASD"},{"provisionId":"navPoint_230","heading":"43E  Authorised disclosure of protected information by the entity to whom the information relates"},{"provisionId":"navPoint_231","heading":"43F  Authorised use and disclosure—relevant entity’s business, professional, commercial or financial affairs"},{"provisionId":"navPoint_232","heading":"44  Secondary use and disclosure of protected information"},{"provisionId":"navPoint_233","heading":"44A  Authorised APS employees"},{"provisionId":"navPoint_235","heading":"45  Offence for unauthorised use or disclosure of protected information"},{"provisionId":"navPoint_236","heading":"46  Exceptions to offence for unauthorised use or disclosure"},{"provisionId":"navPoint_237","heading":"47  No requirement to provide information"},{"provisionId":"navPoint_240","heading":"48  Simplified outline of this Part"},{"provisionId":"navPoint_242","heading":"49  Civil penalties, enforceable undertakings and injunctions"},{"provisionId":"navPoint_244","heading":"49A  Monitoring powers"},{"provisionId":"navPoint_245","heading":"49B  Investigation powers"},{"provisionId":"navPoint_247","heading":"49C  Infringement notices"},{"provisionId":"navPoint_250","heading":"50  Simplified outline of this Part"},{"provisionId":"navPoint_252","heading":"51  Declaration of assets by the Minister"},{"provisionId":"navPoint_253","heading":"51A  Consultation—declaration"},{"provisionId":"navPoint_254","heading":"52  Notification of change to reporting entities for asset"},{"provisionId":"navPoint_257","heading":"52A  Simplified outline of this Part"},{"provisionId":"navPoint_259","heading":"52B  Declaration of systems of national significance by the Minister"},{"provisionId":"navPoint_260","heading":"52C  Consultation—declaration"},{"provisionId":"navPoint_261","heading":"52D  Notification if responsible entity for an asset ceases to be the responsible entity"},{"provisionId":"navPoint_262","heading":"52E  Review of declaration"},{"provisionId":"navPoint_263","heading":"52F  Revocation of determination"},{"provisionId":"navPoint_266","heading":"53  Simplified outline of this Part"},{"provisionId":"navPoint_268","heading":"53A  How certain entities hold interests"},{"provisionId":"navPoint_269","heading":"54  Treatment of partnerships"},{"provisionId":"navPoint_270","heading":"55  Treatment of trusts and superannuation funds that are trusts"},{"provisionId":"navPoint_271","heading":"56  Treatment of unincorporated foreign companies"},{"provisionId":"navPoint_273","heading":"57  Additional power of Secretary"},{"provisionId":"navPoint_274","heading":"58  Assets ceasing to be critical infrastructure assets"},{"provisionId":"navPoint_275","heading":"59  Delegation of Secretary’s powers"},{"provisionId":"navPoint_277","heading":"60  Periodic report"},{"provisionId":"navPoint_278","heading":"60AA  Compensation for acquisition of property"},{"provisionId":"navPoint_279","heading":"60AB  Service of notices, directions and instruments by electronic means"},{"provisionId":"navPoint_280","heading":"60A  Independent review"},{"provisionId":"navPoint_281","heading":"60B  Review of this Act"},{"provisionId":"navPoint_282","heading":"61  Rules"}],"nodes":[{"type":"heading","attrs":{"sourceIndex":1928,"sourceClass":"ActHead5","sourceId":"navPoint_70","sourceStyle":"","sourceMarker":null,"markerPrefix":"","markerSuffix":"","level":5},"content":[{"type":"text","text":"30AD  Compliance with critical infrastructure risk management program","marks":[{"type":"bold"}]}]},{"type":"legalList","attrs":{"logicalLevel":0},"content":[{"type":"legalListItem","attrs":{"marker":null},"content":[{"type":"paragraph","attrs":{"sourceIndex":1929,"sourceClass":"subsection","sourceId":null,"sourceStyle":"","sourceMarker":null,"markerPrefix":"","markerSuffix":""},"content":[{"type":"text","text":"  If:"}]},{"type":"legalList","attrs":{"logicalLevel":1},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"sourceIndex":1930,"sourceClass":"paragraph","sourceId":null,"sourceStyle":"","sourceMarker":"(a)","markerPrefix":" ","markerSuffix":" "},"content":[{"type":"text","text":"an entity is the responsible entity for one or more critical infrastructure assets; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"sourceIndex":1931,"sourceClass":"paragraph","sourceId":null,"sourceStyle":"","sourceMarker":"(b)","markerPrefix":" ","markerSuffix":" "},"content":[{"type":"text","text":"the entity has adopted a critical infrastructure risk management program that applies to the entity;"}]}]}]},{"type":"paragraph","attrs":{"sourceIndex":1932,"sourceClass":"subsection2","sourceId":null,"sourceStyle":"","sourceMarker":null,"markerPrefix":"","markerSuffix":""},"content":[{"type":"text","text":"the entity must comply with:"}]},{"type":"legalList","attrs":{"logicalLevel":1},"content":[{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"sourceIndex":1933,"sourceClass":"paragraph","sourceId":null,"sourceStyle":"","sourceMarker":"(c)","markerPrefix":" ","markerSuffix":" "},"content":[{"type":"text","text":"the critical infrastructure risk management program; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(d)"},"content":[{"type":"paragraph","attrs":{"sourceIndex":1934,"sourceClass":"paragraph","sourceId":null,"sourceStyle":"","sourceMarker":"(d)","markerPrefix":" ","markerSuffix":" "},"content":[{"type":"text","text":"if the program has been varied on one or more occasions—the program as varied."}]}]}]},{"type":"paragraph","attrs":{"sourceIndex":1935,"sourceClass":"Penalty","sourceId":null,"sourceStyle":"","sourceMarker":null,"markerPrefix":"","markerSuffix":""},"content":[{"type":"text","text":"Civil penalty: 200 penalty units."}]}]}]}]},"provisionId":"navPoint_70","notes":[]}