Security of Critical Infrastructure Act 2018

This section applies to a critical telecommunications asset that is prescribed by the rules for the purposes of this subsection.

For specification by class, see subsection 13(3) of the Legislation Act 2003.

For the purposes of security and the protection of a critical telecommunications asset from any hazard where there is a material risk that the occurrence of the hazard could have a relevant impact on the asset, the responsible entity for the asset must, so far as it is reasonably practicable to do so, protect the asset to ensure:

the confidentiality of communications (as defined in the Telecommunications Act 1997) carried on, and of information contained on, the asset; and

the availability and integrity of the asset.

Security has the same meaning as in the Australian Security Intelligence Organisation Act 1979: see the definition of security in section 5 of this Act.

Without limiting subsection (2), the responsible entity’s obligation under that subsection in respect of the critical telecommunications asset includes complying with the following:

any requirements that apply to the entity and the asset under Part 2A (critical infrastructure risk management programs);

the requirement to maintain competent supervision of, and effective control over, the asset;

any other requirements prescribed by the rules for the purposes of this paragraph.

An entity is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith in performance of the obligation imposed by subsection (2).

An officer, employee or agent of an entity is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith in connection with an act done or omitted by the entity as mentioned in subsection (4).