Security of Critical Infrastructure Act 2018

An asset is a critical infrastructure asset if it is:

a critical telecommunications asset; or

a critical broadcasting asset; or

a critical domain name system; or

a critical data storage or processing asset; or

a critical banking asset; or

a critical superannuation asset; or

a critical insurance asset; or

a critical financial market infrastructure asset; or

a critical water asset; or

a critical electricity asset; or

a critical gas asset; or

a critical energy market operator asset; or

a critical liquid fuel asset; or

a critical hospital; or

a critical education asset; or

a critical food and grocery asset; or

a critical port; or

a critical freight infrastructure asset; or

a critical freight services asset; or

a critical public transport asset; or

a critical aviation asset; or

a critical defence industry asset; or

an asset declared under section 51 to be a critical infrastructure asset; or

an asset prescribed by the rules for the purposes of this paragraph.

For prescription by class, see subsection 13(3) of the Legislation Act 2003.

Data storage systems that store or process business critical data are part of the critical infrastructure asset: see subsection (7).

However, the rules may prescribe that a specified:

a critical telecommunications asset; or

a critical broadcasting asset; or

a critical domain name system; or

a critical data storage or processing asset; or

a critical banking asset; or

a critical superannuation asset; or

a critical insurance asset; or

a critical financial market infrastructure asset; or

a critical water asset; or

a critical electricity asset; or

a critical gas asset; or

a critical energy market operator asset; or

a critical liquid fuel asset; or

a critical hospital; or

a critical education asset; or

a critical food and grocery asset; or

a critical port; or

a critical freight infrastructure asset; or

a critical freight services asset; or

a critical public transport asset; or

a critical aviation asset; or

a critical defence industry asset;

For prescription by class, see subsection 13(3) of the Legislation Act 2003.

If an asset is owned by:

the Commonwealth; or

a body corporate established by a law of the Commonwealth (other than a government business enterprise);

the asset is declared under section 51 to be a critical infrastructure asset; or

the asset is prescribed by the rules for the purposes of paragraph (1)(f).

Subject to subsections (2C) and (2D), an asset is not a critical infrastructure asset if, or to the extent to which, the asset is located outside Australia.

Subsection (2B) does not apply for the purposes of working out whether a satellite‑based facility is a critical telecommunications asset if the satellite‑based facility is in a satellite to which either or both of the following apply:

the satellite is included in the Register of Space Objects kept under section 76 of the Space (Launches and Returns) Act 2018;

Australia is the appropriate State Party for the purposes of undertaking the authorisation and continuing supervision required in respect of the satellite under Article VI of the Outer Space Treaty.

For the definitions of Outer Space Treaty and satellite‑based facility, see section 5.

Subsection (2B) does not apply for the purposes of working out whether a submarine cable is a critical telecommunications asset if the submarine cable is installed in Australian waters.

For the definitions of submarine cable and Australian waters, see section 5.

The Minister must not prescribe an asset for the purposes of paragraph (1)(f) unless the Minister is satisfied that:

the asset is critical to:

the social or economic stability of Australia or its people; or

the defence of Australia; or

national security; and

the asset relates to a critical infrastructure sector.

The Minister (the Commonwealth Minister) also must not prescribe the asset unless the Commonwealth Minister has:

consulted the following persons (the consulted Minister):

the First Minister of the State, the Australian Capital Territory or the Northern Territory in which the critical infrastructure asset is wholly or partly located;

each Minister of a State, the Australian Capital Territory, or the Northern Territory, who has responsibility for the regulation or oversight of the relevant critical infrastructure sector in that State or Territory; and

given each consulted Minister written notice of the proposal to prescribe the asset; and

had regard to any representations given by a consulted Minister under subsection (5) within the period specified for that purpose.

The notice must invite each consulted Minister to make written representations to the Commonwealth Minister in relation to the proposal to prescribe the asset within the period specified in the notice, which must be:

at least 28 days after the notice is given; or

a shorter period if the Commonwealth Minister considers the shorter period is necessary because of urgent circumstances.

Subsection (4) does not limit the persons with whom the Commonwealth Minister may consult.

If, under this section, an asset is a critical infrastructure asset, then a data storage system in respect of which all of the following requirements are satisfied is taken to be part of the critical infrastructure asset:

the responsible entity for the critical infrastructure asset owns or operates the data storage system;

the data storage system is used, or is to be used, in connection with the critical infrastructure asset;

business critical data is stored, or is processed in or by, the data storage system (whether or not other information is also stored, or is processed in or by, the data storage system);

for a hazard where there is a material risk that the occurrence of the hazard could have an impact on the data storage system, there is also a material risk that the occurrence of the hazard could have a relevant impact on the critical infrastructure asset.

The effect of this subsection is, for example, that:

obligations under Part 2 in relation to a critical infrastructure asset will also need to take into account the data storage system; and

a critical infrastructure risk management program under Part 2A in relation to a critical infrastructure asset will also need to cover the data storage system; and

notification obligations under Part 2B of cyber security incidents relating to any relevant impact on a critical infrastructure asset will also need to take into account any relevant impact on the data storage system.