Security of Critical Infrastructure Act 2018

Despite subsection 14(2) of the Legislation Act 2003, rules made for the purposes of section 30AH or 30AKA of this Act may make provision in relation to a matter by applying, adopting or incorporating, with or without modification, any matter contained in a relevant document as in force or existing from time to time.

For the purposes of this section, relevant document means:

the document titled Essential Eight Maturity Model and published by the Australian Signals Directorate; or

the document titled Framework for Improving Critical Infrastructure Cybersecurity and published by the National Institute of Standards and Technology of the United States of America; or

the document titled Cybersecurity Capability Maturity Model and published by the Department of Energy of the United States of America; or

the document titled The 2020‑21 AESCSF Framework Core and published by Australian Energy Market Operator Limited (ACN 072 010 327); or

the document titled Cyber Supply Chain Risk Management and published by the Australian Signals Directorate; or

a document specified in the rules.

Subsection 13(3) of the Legislation Act 2003 does not apply to paragraph (2)(f) of this section.