Security of Critical Infrastructure Act 2018

the keeping of a register of information in relation to critical infrastructure assets (the register will not be made public);

requiring the responsible entity for one or more critical infrastructure assets to have, and comply with, a critical infrastructure risk management program (unless an exemption applies);

requiring notification of cyber security incidents;

imposing enhanced cyber security obligations that relate to systems of national significance;

imposing enhanced security obligations for critical telecommunications assets;

requiring certain entities relating to a critical infrastructure asset to provide information in relation to the asset, and to notify if certain events occur in relation to the asset;

allowing the Minister to require certain entities relating to a critical infrastructure asset to do, or refrain from doing, an act or thing if the Minister is satisfied that there is a risk of an act or omission that would be prejudicial to security;

allowing the Secretary to require certain entities relating to a critical infrastructure asset to provide certain information or documents;

setting up a regime for the Commonwealth to respond to a serious incident that has had, is having, or is likely to have, one or more relevant impacts on one or more critical infrastructure assets;

allowing the Secretary to undertake an assessment of a critical infrastructure asset to determine if there is a risk to national security relating to the asset.