Security of Critical Infrastructure Act 2018

This section applies if, during a period (the relevant period) that consists of the whole or a part of a financial year:

an entity was the responsible entity for one or more critical infrastructure assets; and

the entity had a critical infrastructure risk management program that applied to the entity.

The entity must, within 90 days after the end of the financial year, give:

if there is a relevant Commonwealth regulator that has functions relating to the security of those assets—the relevant Commonwealth regulator; or

in any other case—the Secretary;

if the entity had the program at the end of the financial year—includes whichever of the following statements is applicable:

if the program was up to date at the end of the financial year—a statement to that effect;

if the program was not up to date at the end of the financial year—a statement to that effect; and

if a hazard had a significant relevant impact on one or more of those assets during the relevant period—includes a statement that:

identifies the hazard; and

evaluates the effectiveness of the program in mitigating the significant relevant impact of the hazard on the assets concerned; and

if the program was varied during the financial year as a result of the occurrence of the hazard—outlines the variation; and

if one or more of those assets are critical telecommunications assets:

includes a summary of the changes (if any) the entity notified during the relevant period under subsection 30EC(2); and

describes the risks (if any) advised to the entity during the relevant period under paragraph 30ED(3)(c); and

describes the measures (if any) the entity adopted during the relevant period to eliminate or reduce risks advised to the entity during the relevant period or any previous period; and

includes a statement that evaluates the effectiveness of those measures to eliminate or reduce risks advised to the entity during the relevant period or any previous period; and

if the entity was given a direction under section 30AI during the relevant period—includes a statement that:

sets out the content of the direction; and

sets out how the program was varied in response to the direction; and

is in the approved form; and

if the entity has a board, council or other governing body—is approved by the board, council or other governing body, as the case requires.

A report given by an entity under subsection (2) is not admissible in evidence against the entity in civil proceedings relating to a contravention of a civil penalty provision of this Act.