30AQ  Reporting obligations relating to certain assets that are not covered by a critical infrastructure risk management program
Scope
(1)

This section applies if, during a period (the relevant period) that consists of the whole or a part of a financial year, an entity was the responsible entity for one or more critical infrastructure assets that are covered by subsection 30AB(4), (5) or (6).

Annual report
(2)

The entity must, within 90 days after the end of the financial year, give:

(a)

if there is a relevant Commonwealth regulator that has functions relating to the security of those assets—the relevant Commonwealth regulator; or

(b)

in any other case—the Secretary;

a report that:

(c)

sets out the reason why those assets are covered by subsection 30AB(4), (5) or (6); and

(d)

if a hazard had a significant relevant impact on one or more of those assets during the relevant period—includes a statement that:

(i)

identifies the hazard; and

(ii)

evaluates the effectiveness of the action (if any) taken by the entity for the purposes of mitigating the significant relevant impact of the hazard on the assets concerned; and

(e)

is in the approved form; and

(f)

if the entity has a board, council or other governing body—is approved by the board, council or other governing body, as the case requires.

Civil penalty: 150 penalty units.

(3)

A report given by an entity under subsection (2) is not admissible in evidence against the entity in civil proceedings relating to a contravention of a civil penalty provision of this Act.

Part 2B—Notification of cyber security incidents