Security of Critical Infrastructure Act 2018

This section applies if:

a computer:

is needed to operate a system of national significance; or

is a system of national significance; and

the Secretary believes on reasonable grounds that, each time a particular kind of event occurs, a relevant entity for the system of national significance will be technically capable of preparing a report consisting of information that:

relates to the operation of the computer; and

may assist with determining whether a power under this Act should be exercised in relation to the system of national significance; and

is not personal information (within the meaning of the Privacy Act 1988).

The Secretary may, by written notice given to the entity, require the entity to do the following things each time an event of that kind occurs:

prepare a report that consists of any such information;

prepare that report:

in the manner and form specified in the notice; and

in accordance with the information technology requirements specified in the notice;

give that report to ASD as soon as practicable after the event occurs.

A notice under subsection (2) is to be known as a system information event‑based reporting notice.

In deciding whether to give a system information event‑based reporting notice to the entity, the Secretary must have regard to:

the costs that are likely to be incurred by the entity in complying with the notice; and

the reasonableness and proportionality of the requirements in the notice; and

such other matters (if any) as the Secretary considers relevant.

A system information event‑based reporting notice must set out the effect of section 30DF.

This section does not, by implication, limit a power conferred by another provision of this Act.