Security of Critical Infrastructure Act 2018

This section applies if:

a computer:

is needed to operate a system of national significance; or

is a system of national significance; and

the Secretary believes on reasonable grounds that a relevant entity for the system of national significance is technically capable of preparing periodic reports consisting of information that:

relates to the operation of the computer; and

may assist with determining whether a power under this Act should be exercised in relation to the system of national significance; and

is not personal information (within the meaning of the Privacy Act 1988).

The Secretary may, by written notice given to the entity, require the entity to:

prepare periodic reports that:

consist of any such information; and

relate to such regular intervals as are specified in the notice; and

prepare those periodic reports:

in the manner and form specified in the notice; and

in accordance with the information technology requirements specified in the notice; and

give each of those periodic reports to ASD within the period ascertained in accordance with the notice in relation to the periodic report concerned.

A notice under subsection (2) is to be known as a system information periodic reporting notice.

In deciding whether to give a system information periodic reporting notice to the entity, the Secretary must have regard to:

the costs that are likely to be incurred by the entity in complying with the notice; and

the reasonableness and proportionality of the requirements in the notice; and

such other matters (if any) as the Secretary considers relevant.

A system information periodic reporting notice must set out the effect of section 30DF.

This section does not, by implication, limit a power conferred by another provision of this Act.