Security of Critical Infrastructure Act 2018

Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

improving the transparency of the ownership and operational control of critical infrastructure in Australia in order to better understand those risks; and

facilitating cooperation and collaboration between all levels of government, and regulators, owners and operators of critical infrastructure, in order to identify and manage those risks; and

requiring responsible entities for critical infrastructure assets to identify and manage risks relating to those assets; and

imposing enhanced cyber security obligations on relevant entities for systems of national significance in order to improve their preparedness for, and ability to respond to, cyber security incidents; and

imposing enhanced security obligations on responsible entities for critical telecommunications assets; and

providing a regime for the Commonwealth to respond to serious incidents relating to critical infrastructure assets.

the keeping of a register of information in relation to critical infrastructure assets (the register will not be made public);

requiring the responsible entity for one or more critical infrastructure assets to have, and comply with, a critical infrastructure risk management program (unless an exemption applies);

requiring notification of cyber security incidents;

imposing enhanced cyber security obligations that relate to systems of national significance;

imposing enhanced security obligations for critical telecommunications assets;

requiring certain entities relating to a critical infrastructure asset to provide information in relation to the asset, and to notify if certain events occur in relation to the asset;

allowing the Minister to require certain entities relating to a critical infrastructure asset to do, or refrain from doing, an act or thing if the Minister is satisfied that there is a risk of an act or omission that would be prejudicial to security;

allowing the Secretary to require certain entities relating to a critical infrastructure asset to provide certain information or documents;

setting up a regime for the Commonwealth to respond to a serious incident that has had, is having, or is likely to have, one or more relevant impacts on one or more critical infrastructure assets;

allowing the Secretary to undertake an assessment of a critical infrastructure asset to determine if there is a risk to national security relating to the asset.

Protected information is relevant information:

the disclosure of which would or could reasonably be expected to prejudice national security or the defence of Australia; or

the disclosure of which would or could reasonably be expected to prejudice the social or economic stability of Australia or its people; or

that contains, or is, confidential commercial information; or

the disclosure of which would or could reasonably be expected to prejudice the availability, integrity, reliability or security of a critical infrastructure asset.

A document or information is protected information if it:

was a document or information to which subsection (1) applied; and

is obtained by a person by way of an authorised disclosure under Division 3 of Part 4 or in accordance with section 46.

Relevant information is:

a document or information that is obtained or generated by a person in the course of exercising powers, or performing duties or functions, under this Act; or

a document or information that is obtained, generated or adopted by an entity for the purposes of complying with this Act;

records or is the fact that an asset is declared under section 51 to be a critical infrastructure asset; or

records or is the fact that an asset is declared under section 52B to be a system of national significance; or

records or is the fact that the Minister has:

given a Ministerial authorisation; or

revoked a Ministerial authorisation; or

is, or is included in, a critical infrastructure risk management program that is adopted by an entity in compliance with section 30AC; or

is, or is included in, a report that is given under section 30AG or 30AQ; or

is, or is included in, a report under section 30BC or 30BD; or

is, or is included in, an incident response plan adopted by an entity in compliance with section 30CD; or

is, or is included in, an evaluation report prepared under section 30CQ or 30CR; or

is, or is included in, a vulnerability assessment report prepared under section 30CZ; or

is, or is included in, a report prepared in compliance with:

a system information periodic reporting notice; or

a system information event‑based reporting notice; or

records or is the fact that the Minister has:

given a direction under subsection 30EF(1); or

revoked such a direction; or

records or is the fact that the Minister has:

given a direction under subsection 32(2); or

revoked such a direction; or

records or is the fact that the Secretary has:

given a direction under section 35AK; or

revoked such a direction; or

records or is the fact that the Secretary has:

given a direction under section 35AQ; or

revoked such a direction; or

records or is the fact that the Secretary has:

given a request under section 35AX; or

revoked such a request.

The following information is interest and control information in relation to an entity (the first entity) and an asset (subject to subsection (3)):

the name of the first entity;

if applicable, the ABN of the first entity, or other similar business number (however described) if the first entity was incorporated, formed or created (however described) outside Australia;

for an entity other than an individual:

the address of the first entity’s head office or principal place of business; and

the country in which the first entity was incorporated, formed or created (however described);

for an entity that is an individual:

the residential address of the first entity; and

the country in which the first entity usually resides; and

the country or countries of which the first entity is a citizen;

the type and level of the interest the first entity holds in the asset;

information about the influence or control the first entity is in a position to directly or indirectly exercise in relation to the asset;

information about the ability of a person, who has been appointed by the first entity to the body that governs the asset, to directly access networks or systems that are necessary for the operation or control of the asset;

the name of each other entity that is in a position to directly or indirectly influence or control:

the first entity; or

any entity covered by a previous application of this paragraph;

in relation to each entity (the higher entity) covered by paragraph (h):

the information in paragraphs (b) to (d), and (e) if appropriate, as if a reference in those paragraphs to the first entity were a reference to the higher entity; and

information about the influence or control the higher entity is in a position to directly or indirectly exercise in relation to the first entity or any entity covered by paragraph (h);

information prescribed by the rules for the purposes of this paragraph.

For example, if Holding Entity 1 holds a 10% interest in the first entity, and Holding Entity 2 holds a 10% interest in Holding Entity 1, the information mentioned in paragraphs (1)(h) and (ha) relating to those holding entities, would be given to the Secretary.

For the definition of influence or control, see section 8A.

For interests held by trusts, partnerships, superannuation funds and unincorporated foreign companies, see section 53A.

Information under subsection (1) may include personal information (within the meaning of the Privacy Act 1988).

If the first entity is a Governor, First Minister, Administrator or Minister of a State or Territory who is a direct interest holder in relation to an asset because of paragraph 8(1)(b), the first entity is not required to provide any interest and control information.

However, subsection (3) does not affect the obligation of the State or Territory to provide interest and control information in relation to the asset if the State or Territory is also a direct interest holder in relation to the asset because of paragraph 8(1)(a) or (b).

If the first entity:

is the Governor‑General, the Prime Minister or a Minister; and

is a direct interest holder in relation to an asset because of paragraph 8(1)(b);

The expression Minister is defined in section 2B of the Acts Interpretation Act 1901.

However, subsection (5) does not affect the obligation of the Commonwealth to provide interest and control information in relation to the asset if the Commonwealth is also a direct interest holder in relation to the asset because of paragraph 8(1)(a) or (b).

The following information is operational information in relation to an asset:

the location of the asset;

a description of the area the asset services;

the following information about each entity that is the responsible entity for, or an operator of, the asset:

the name of the entity;

if applicable, the ABN of the entity, or other similar business number (however described) if the entity was incorporated, formed or created (however described) outside Australia;

the address of the entity’s head office or principal place of business;

the country in which the entity was incorporated, formed or created (however described);

the following information about the chief executive officer (however described) of the responsible entity for the asset:

the full name of the officer;

the country or countries of which the officer is a citizen;

a description of the arrangements under which each operator operates the asset or a part of the asset;

a description of the arrangements under which data prescribed by the rules relating to the asset is maintained;

information prescribed by the rules for the purposes of this paragraph.

For paragraph (e), this would include if the control system of the asset is managed by a separate body.

Information under subsection (1) may include personal information (within the meaning of the Privacy Act 1988).

An entity is a direct interest holder in relation to an asset if the entity:

together with any associates of the entity, holds an interest of at least 10% in the asset (including if any of the interests are held jointly with one or more other entities); or

holds an interest in the asset that puts the entity in a position to directly or indirectly influence or control the asset.

For interests held by trusts, partnerships, superannuation funds and unincorporated foreign companies, see section 53A.

Subsection (1) does not apply to an interest in an asset held by an entity if:

the entity holds the interest in the asset:

solely by way of security for the purposes of a moneylending agreement; or

solely as a result of enforcing a security for the purposes of a moneylending agreement; and

the entity is:

the entity (the first entity) that entered into the moneylending agreement; or

a subsidiary or holding entity of the first entity; or

a person who is (alone or with others) in a position to determine the investments or policy of the first entity; or

a security trustee who holds or acquires the interest on behalf of the first entity; or

a receiver, or a receiver and manager, appointed by, or appointed on instructions from, a person or entity mentioned in any of subparagraphs (i) to (iv).

A moneylending agreement is:

an agreement entered into in good faith, on ordinary commercial terms and in the ordinary course of carrying on a business (a moneylending business) of lending money or otherwise providing financial accommodation, except an agreement dealing with any matter unrelated to the carrying on of that business; or

if the entity:

is carrying on a moneylending business; or

is a subsidiary or holding entity of a corporate entity that is carrying on a moneylending business;

Subsection (1) does not apply to an interest in an asset held by an entity if:

the entity is the provider of a custodial or depository service; and

the entity holds the interest in the asset solely in the entity’s capacity as the provider of a custodial or depository service; and

the holding of the interest does not put the entity in a position to directly or indirectly influence or control the asset.

Subsection (1) does not apply to an interest in an asset held by an entity if:

the entity is the provider of a service specified in the rules; and

the entity holds the interest in the asset solely in the entity’s capacity as the provider of the service; and

the holding of the interest does not put the entity in a position to directly or indirectly influence or control the asset.

An entity is in a position to directly or indirectly influence or control an asset if:

the entity is in a position to exercise voting or veto rights in relation to the body that governs the asset; or

the entity is in a position to make decisions that materially impact on the running of, or strategic direction in relation to, the asset; or

the entity has the ability to appoint:

persons to the body that governs the asset; or

key personnel involved in running the asset; or

the entity is in a position to influence or determine decisions relating to:

the business plan, or any other management plan, for the asset; or

major expenditure relating to the asset; or

major contracts or transactions involving the asset; or

major loans involving the asset.

For interests held by trusts, partnerships, superannuation funds and unincorporated foreign companies, see section 53A.

An entity (the controlling entity) is in a position to directly or indirectly influence or control another entity (the controlled entity) if the controlling entity:

is in a position to exercise voting or veto rights in relation to the controlled entity; or

is in a position to make decisions that materially impact on the running of, or strategic direction of, the controlled entity; or

has the ability to appoint persons to the board of the controlled entity; or

is in a position to influence or determine decisions relating to:

the business plan, or any other management plan, for the controlled entity; or

major expenditure relating to the controlled entity; or

major contracts or transactions involving the controlled entity; or

major loans involving the controlled entity; or

together with any associates of the controlling entity, holds an interest of at least 10% in the controlled entity (including if any of the interests are held jointly with one or more other entities).

This section does not limit when an entity is in a position to directly or indirectly influence or control an asset or other entity.

any relative of the person;

any person with whom the person is acting, or proposes to act, in concert in relation to an asset;

any person with whom the person carries on a business in partnership;

any corporate entity of which the person is a senior officer;

if the person is a corporate entity:

any holding entity of the corporate entity; or

any senior officer of the corporate entity;

any corporate entity whose senior officers are accustomed or under an obligation (whether formal or informal) to act in accordance with the directions, instructions or wishes of:

the person; or

if the person is a corporate entity—the senior officers of the person;

a corporate entity if the person is accustomed or under an obligation (whether formal or informal) to act in accordance with the directions, instructions or wishes of:

the corporate entity; or

the senior officers of the corporate entity;

any body corporate in which the person holds an interest;

if the person is a body corporate—a person who holds an interest in the body corporate;

the trustee of a trust in which the person holds an interest;

if the person is the trustee of a trust—a person who holds an interest in the trust;

any other person or body prescribed by the rules.

A corporate entity (the lower entity) is a subsidiary of another corporate entity (the higher entity) if:

the higher entity:

is in a position to control more than half the voting power in the lower entity; or

holds more than half the issued securities in the lower entity (disregarding any securities that carry no right to participate beyond a specified amount in a distribution of either profits or capital); or

the lower entity is a subsidiary of a corporate entity that is the higher entity’s subsidiary (including because of one or more applications of this subsection).

A corporate entity (the higher entity) is a holding entity of another corporate entity (the lower entity) if the lower entity is a subsidiary of the higher entity.

the communications sector;

the data storage or processing sector;

the financial services and markets sector;

the water and sewerage sector;

the energy sector;

the health care and medical sector;

the higher education and research sector;

the food and grocery sector;

the transport sector;

the space technology sector;

the defence industry sector.