Cyber Security Act 2024

The Secretary may give an entity that must comply with an obligation under section 15 or 16 a stop notice if:

the entity has been given a compliance notice under section 17 in relation to the non‑compliance with the obligation; and

the Secretary is reasonably satisfied that:

the entity has not complied with the compliance notice; or

actions taken by the entity to rectify non‑compliance with the obligation (whether in accordance with the compliance notice or otherwise) are inadequate to rectify the non‑compliance.

The stop notice must:

set out the name of the entity to which the notice is given; and

set out brief details of the non‑compliance; and

specify action within the entity’s control that the entity must take, or refrain from taking, in order to address the non‑compliance; and

specify a reasonable period within which the entity must take the specified action or refrain from taking the specified action; and

if the Secretary considers it appropriate—specify a reasonable period within which the entity must provide the Secretary with evidence that the entity has taken the specified action or refrained from taking the specified action; and

explain what may happen if the entity does not comply with the notice; and

explain how the entity may seek review of the decision to issue the notice; and

set out any other matters prescribed by the rules.

Before giving the notice to the entity, the Secretary must:

notify the entity that the Secretary intends to give the notice to the entity; and

give the entity a specified period (which must not be shorter than 10 days) to make representations about the giving of the notice.

Only one stop notice may be given to an entity in relation to a particular instance of the entity’s non‑compliance with an obligation under section 15 or 16.