a critical infrastructure risk management program permits a background check of an individual to be conducted under the AusCheck scheme; or

requiring responsible entities for critical infrastructure assets to identify and manage risks relating to those assets; and

imposing enhanced cyber security obligations on relevant entities for systems of national significance in order to improve their preparedness for, and ability to respond to, cyber security incidents; and

requiring the responsible entity for one or more critical infrastructure assets to have, and comply with, a critical infrastructure risk management program (unless an exemption applies);

imposing enhanced cyber security obligations that relate to systems of national significance;

would prevent the proper function of the asset; or

could cause significant damage to the asset;

is owned or operated by an entity that is registered in the Australian university category of the National Register of Higher Education Providers; and

is used in connection with undertaking a program of research that is critical to:

a critical infrastructure sector (other than the higher education and research sector); or

the defence of Australia; or

national security.

a telecommunications network that is:

owned or operated by a carrier or a carriage service provider; and

used to supply a carriage service; or

(b) a facility (within the meaning of the Telecommunications Act 1997) that is:

owned or operated by a carrier or a carriage service provider; and

used to supply a carriage service.

the individual is an employee, intern, contractor or subcontractor of the responsible entity for a critical infrastructure asset to which Part 2A applies;

the absence or compromise of the individual:

would prevent the proper function of the asset; or

could cause significant damage to the asset;

the individual has access to, or control and management of, a critical component of the asset.

a service that:

enables end-users to store or back-up data; and

is provided on a commercial basis; or

a data processing service that:

involves the use of one or more computers; and

is provided on a commercial basis; or

a service that is specified in the rules.

supported financially (in whole or in part) by the Commonwealth; and

critical to:

a critical infrastructure sector (other than the higher education and research sector); or

national security; or

the defence of Australia.

subsection 52D(4).

records or is the fact that an asset is declared under section 52B to be a system of national significance; or

is, or is included in, a critical infrastructure risk management program that is adopted by an entity in compliance with section 30AC; or

is, or is included in, a report that is given under section 30AG or 30AQ; or

is, or is included in, an incident response plan adopted by an entity in compliance with section 30CD; or

is, or is included in, an evaluation report prepared under section 30CQ or 30CR; or

is, or is included in, a vulnerability assessment report prepared under section 30CZ; or

the entity is:

(i) the entity (the first entity) that entered into the moneylending agreement; or

a subsidiary or holding entity of the first entity; or

a person who is (alone or with others) in a position to determine the investments or policy of the first entity; or

a security trustee who holds or acquires the interest on behalf of the first entity; or

a receiver, or a receiver and manager, appointed by, or appointed on instructions from, a person or entity mentioned in any of subparagraphs (i) to (iv).

the entity is the provider of a custodial or depository service; and

the entity holds the interest in the asset solely in the entity’s capacity as the provider of a custodial or depository service; and

the holding of the interest does not put the entity in a position to directly or indirectly influence or control the asset.

the entity is the provider of a service specified in the rules; and

the entity holds the interest in the asset solely in the entity’s capacity as the provider of the service; and

the holding of the interest does not put the entity in a position to directly or indirectly influence or control the asset.

the impact (whether direct or indirect) of the incident on the availability of the system;

the impact (whether direct or indirect) of the incident on the integrity of the system;

the impact (whether direct or indirect) of the incident on the reliability of the system;

the impact (whether direct or indirect) of the incident on the confidentiality of:

information about the system; or

if information is stored in the system—the information; or

if the system is computer data—the computer data.

specified assets that are critical to the administration of an Australian domain name system; or

requirements for an asset to be critical to the administration of an Australian domain name system.

identify each hazard where there is a material risk that the occurrence of the hazard could have a relevant impact on the asset;

so far as it is reasonably practicable to do so—minimise or eliminate any material risk of such a hazard occurring;

so far as it is reasonably practicable to do so—mitigate the relevant impact of such a hazard on the asset.

the asset is specified in the rules; or

both:

the asset is the subject of a declaration under section 51; and

the declaration determines that this Part applies to the asset.

beginning when the asset became a critical infrastructure asset; and

ending at a time ascertained in accordance with the rules.

an entity holds a certificate of hosting certification (strategic level) that relates to one or more services; and

the certificate was issued under the scheme that is:

administered by the Commonwealth; and

known as the hosting certification framework; and

a critical infrastructure asset, or a part of a critical infrastructure asset, is used in connection with the provision of any of those services; and

the entity is the responsible entity for the asset;

an entity is covered by a provision of a law of the Commonwealth, a State or a Territory; and

the provision is specified in the rules; and

the entity is the responsible entity for a critical infrastructure asset;

a critical infrastructure asset is covered by a provision of a law of the Commonwealth, a State or a Territory; and

the provision is specified in the rules;

cause to be published on the Department’s website a notice:

setting out the draft rules or amendments; and

inviting persons to make submissions to the Minister about the draft rules or amendments within the period specified in the notice; and

give a copy of the notice to each First Minister; and

consider any submissions received within the period mentioned in paragraph (a).

adopt; and

maintain;

an entity is the responsible entity for one or more critical infrastructure assets; and

the entity has adopted a critical infrastructure risk management program that applies to the entity;

the critical infrastructure risk management program; or

if the program has been varied on one or more occasions—the program as varied.

an entity is the responsible entity for one or more critical infrastructure assets; and

the entity has adopted a critical infrastructure risk management program that applies to the entity;

an entity is the responsible entity for one or more critical infrastructure assets; and

the entity has adopted a critical infrastructure risk management program that applies to the entity;

an entity was the responsible entity for one or more critical infrastructure assets; and

the entity had a critical infrastructure risk management program that applied to the entity.

if there is a relevant Commonwealth regulator that has functions relating to the security of those assets—the relevant Commonwealth regulator; or

in any other case—the Secretary;

if the entity had the program at the end of the financial year—includes whichever of the following statements is applicable:

if the program was up to date at the end of the financial year—a statement to that effect;

if the program was not up to date at the end of the financial year—a statement to that effect; and

if a hazard had a significant relevant impact on one or more of those assets during the relevant period—includes a statement that:

identifies the hazard; and

evaluates the effectiveness of the program in mitigating the significant relevant impact of the hazard on the assets concerned; and

if the program was varied during the financial year as a result of the occurrence of the hazard—outlines the variation; and

is in the approved form; and

if the entity has a board, council or other governing body—is approved by the board, council or other governing body, as the case requires.

that applies to a particular entity that is the responsible entity for one or more critical infrastructure assets; and

the purpose of which is to do the following for each of those assets:

identify each hazard where there is a material risk that the occurrence of the hazard could have a relevant impact on the asset;

so far as it is reasonably practicable to do so—minimise or eliminate any material risk of such a hazard occurring;

so far as it is reasonably practicable to do so—mitigate the relevant impact of such a hazard on the asset; and

that complies with such requirements (if any) as are specified in the rules.

may be of general application; or

may relate to one or more specified critical infrastructure assets.

permit a background check of an individual to be conducted under the AusCheck scheme; and

(b) provide that such a background check must include assessment of information relating to one or more of the matters mentioned in paragraphs 5(a), (b), (c) and (d) of the AusCheck Act 2007, as specified in the rules; and

(c) provide that, if such a background check includes an assessment of information relating to the matter mentioned in paragraph 5(a) of the AusCheck Act 2007, the criteria against which that information must be assessed are the criteria specified in the rules; and

(d) provide that, if such a background check includes assessment of information relating to the matter mentioned in paragraph 5(d) of the AusCheck Act 2007, the assessment must consist of whichever of the following is specified in the rules:

an electronic identity verification check;

an in person identity verification check;

both an electronic identity verification check and an in person identity verification check.

any existing regulatory system of the Commonwealth, a State or a Territory that imposes obligations on responsible entities;

the costs that are likely to be incurred by responsible entities in complying with those rules;

the reasonableness and proportionality of the requirements in relation to the purpose referred to in paragraph (1)(b);

such other matters (if any) as the Minister considers relevant.

the likelihood of the hazard occurring; and

the relevant impact of the hazard on the asset if the hazard were to occur.

revoking that adoption; and

adopting another critical infrastructure risk management program that applies to the entity.

an entity is the responsible entity for one or more critical infrastructure assets; and

the entity has adopted a critical infrastructure risk management program that applies to the entity;

an entity is the responsible entity for one or more critical infrastructure assets; and

the entity has adopted a critical infrastructure risk management program that applies to the entity;

may be of general application; or

may relate to one or more specified critical infrastructure assets.

cause to be published on the Department’s website a notice:

setting out the draft rules or amendments; and

inviting persons to make submissions to the Minister about the draft rules or amendments within the period specified in the notice; and

give a copy of the notice to each First Minister; and

consider any submissions received within the period mentioned in paragraph (a).

the Minister is satisfied that there is an imminent threat that a hazard will have a significant relevant impact on a critical infrastructure asset; or

the Minister is satisfied that a hazard has had, or is having, a significant relevant impact on a critical infrastructure asset.

rules; or

amendments.

if paragraph (1)(a) applies—review the operation, effectiveness and implications of the rules; and

if paragraph (1)(b) applies—review the operation, effectiveness and implications of the amendments; and

without limiting paragraph (a) or (b), consider whether any amendments should be made; and

give the Minister:

a report of the review; and

a statement setting out the Secretary’s findings.

cause to be published on the Department’s website a notice:

setting out the rules or amendments concerned; and

inviting persons to make submissions to the Secretary about the rules or amendments concerned within the period specified in the notice; and

give a copy of the notice to each First Minister; and

consider any submissions received within the period mentioned in paragraph (a).

(a) the document titled Essential Eight Maturity Model and published by the Australian Signals Directorate; or

(b) the document titled Framework for Improving Critical Infrastructure Cybersecurity and published by the National Institute of Standards and Technology of the United States of America; or

(c) the document titled Cybersecurity Capability Maturity Model and published by the Department of Energy of the United States of America; or

(d) the document titled The 2020-21 AESCSF Framework Core and published by Australian Energy Market Operator Limited (ACN 072 010 327); or

(e) the document titled Cyber Supply Chain Risk Management and published by the Australian Signals Directorate; or

a document specified in the rules.

cause to be published on the Department’s website a notice:

setting out the draft rules or amendments; and

inviting persons to make submissions to the Minister about the draft rules or amendments within the period specified in the notice; and

give a copy of the notice to each First Minister; and

consider any submissions received within the period mentioned in paragraph (a).

(a) the notice must be given in that House within 15 sitting days of that House after the copy of the rules was tabled in that House under Legislation Act 2003; andsection 38 of the

the resolution must be passed, in pursuance of the motion, within 15 sitting days of that House after the giving of that notice.

(a) notice of a motion to disallow the rules is given in a House of the Parliament within 15 sitting days of that House after the copy of the rules was tabled in that House under Legislation Act 2003; andsection 38 of the

at the end of 15 sitting days of that House after the giving of that notice of motion:

the notice has not been withdrawn and the motion has not been called on; or

the motion has been called on, moved and (where relevant) seconded and has not been withdrawn or otherwise disposed of;

if there is a relevant Commonwealth regulator that has functions relating to the security of those assets—the relevant Commonwealth regulator; or

in any other case—the Secretary;

sets out the reason why those assets are covered by subsection 30AB(4), (5) or (6); and

if a hazard had a significant relevant impact on one or more of those assets during the relevant period—includes a statement that:

identifies the hazard; and

evaluates the effectiveness of the action (if any) taken by the entity for the purposes of mitigating the significant relevant impact of the hazard on the assets concerned; and

is in the approved form; and

if the entity has a board, council or other governing body—is approved by the board, council or other governing body, as the case requires.

an entity is or was subject to a requirement under section 30BC or 30BD; and

the entity is or was a member of a related company group;

another member of the related company group is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the requirement; and

an officer, employee or agent of another member of the related company group is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the requirement.

(a) an entity (the first entity) is or was subject to a requirement under section 30BC or 30BD; and

(b) another entity (the contracted service provider) is or was:

a party to a contract with the first entity; and

responsible under the contract for the provision of services to the first entity;

the contracted service provider is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the requirement; and

an officer, employee or agent of the contracted service provider is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the requirement.

give ASD periodic reports of system information; or

give ASD event-based reports of system information; or

install software that transmits system information to ASD.

the system; and

cyber security incidents.

the costs that are likely to be incurred by the entity in complying with Subdivision B; and

the reasonableness and proportionality of applying the statutory incident response planning obligations to the entity in relation to:

the system; and

cyber security incidents; and

such other matters (if any) as the Secretary considers relevant.

the entity; and

if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator.

a determination is in force under section 30CB; and

notice of the determination was given to a particular entity.

an entity is the responsible entity for a system of national significance; and

the statutory incident response planning obligations apply to the entity in relation to:

the system; and

cyber security incidents;

adopt; and

maintain;

the system; and

cyber security incidents.

an entity is the responsible entity for a system of national significance; and

the entity has adopted an incident response plan that applies to the entity;

the incident response plan; or

if the plan has been varied on one or more occasions—the plan as varied.

an entity is the responsible entity for a system of national significance; and

the entity has adopted an incident response plan that applies to the entity;

an entity is the responsible entity for a system of national significance; and

the entity has adopted an incident response plan that applies to the entity;

an entity is the responsible entity for a system of national significance; and

the entity adopts an incident response plan that applies to the entity;

provide a copy of the incident response plan to the Secretary; and

do so as soon as practicable after the adoption.

an entity is the responsible entity for a system of national significance; and

the entity varies an incident response plan that applies to the entity;

provide a copy of the varied incident response plan to the Secretary; and

do so as soon as practicable after the variation.

that applies to an entity that is the responsible entity for a system of national significance; and

that relates to the system; and

that relates to cyber security incidents; and

the purpose of which is to plan for responding to cyber security incidents that could have a relevant impact on the system; and

that complies with such requirements (if any) as are specified in the rules.

may be of general application; or

may relate to one or more specified systems of national significance; or

may relate to one or more specified types of cyber security incidents.

revoking that adoption; and

adopting another incident response plan that applies to the entity.

undertake a cyber security exercise in relation to:

the system; and

all types of cyber security incidents; and

do so within the period specified in the notice.

undertake a cyber security exercise in relation to:

the system; and

one or more specified types of cyber security incidents; and

do so within the period specified in the notice.

allow one or more specified designated officers to observe the cyber security exercise;

provide those designated officers with access to premises for the purposes of observing the cyber security exercise;

provide those designated officers with reasonable assistance and facilities that are reasonably necessary to allow those designated officers to observe the cyber security exercise;

allow those designated officers to make such records as are reasonably necessary for the purposes of monitoring compliance with the notice;

give those designated officers reasonable notice of the time when the cyber security exercise will begin.

the costs that are likely to be incurred by the entity in complying with the notice; and

the reasonableness and proportionality of the requirement in the notice; and

such other matters (if any) as the Secretary considers relevant.

the entity; and

if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator.

that is undertaken by the responsible entity for a system of national significance; and

that relates to the system; and

that either:

relates to all types of cyber security incidents; or

relates to one or more specified types of cyber security incidents; and

if the exercise relates to all types of cyber security incidents—the purpose of which is to:

test the entity’s ability to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and

(ii) test the entity’s preparedness to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and

test the entity’s ability to mitigate the relevant impacts that all types of cyber security incidents could have on the system; and

if the exercise relates to one or more specified types of cyber security incidents—the purpose of which is to:

test the entity’s ability to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and

(ii) test the entity’s preparedness to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and

test the entity’s ability to mitigate the relevant impacts that those types of cyber security incidents could have on the system; and

that complies with such requirements (if any) as are specified in the rules.

may be of general application; or

may relate to one or more specified systems of national significance; or

may relate to one or more specified types of cyber security incidents.

do both of the following:

prepare an evaluation report relating to the cyber security exercise;

give a copy of the report to the Secretary; and

do so:

within 30 days after the completion of the exercise; or

if the Secretary allows a longer period—within that longer period.

all of the following conditions are satisfied:

the entity has prepared, or purported to prepare, an evaluation report under section 30CQ relating to the exercise;

the entity has given a copy of the report to the Secretary;

the Secretary has reasonable grounds to believe that the report was not prepared appropriately; or

the entity has contravened section 30CQ.

appoint an external auditor; and

(b) arrange for the external auditor to prepare an evaluation report (the new evaluation report) relating to the exercise; and

arrange for the external auditor to give the new evaluation report to the entity; and

give the Secretary a copy of the new evaluation report within:

the period specified in the notice; or

if the Secretary allows a longer period—that longer period.

the matters to be covered by the new evaluation report; and

the form of the new evaluation report and the kinds of details it is to contain.

the entity; and

if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator.

if the exercise relates to all types of cyber security incidents—the purpose of which is to:

evaluate the entity’s ability to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and

(ii) evaluate the entity’s preparedness to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and

evaluate the entity’s ability to mitigate the relevant impacts that all types of cyber security incidents could have on the system; and

if the exercise relates to one or more specified types of cyber security incidents—the purpose of which is to:

evaluate the entity’s ability to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and

(ii) evaluate the entity’s preparedness to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and

evaluate the entity’s ability to mitigate the relevant impacts that those types of cyber security incidents could have on the system; and

that complies with such requirements (if any) as are specified in the rules.

undertake, or cause to be undertaken, a vulnerability assessment in relation to:

the system; and

all types of cyber security incidents; and

do so within the period specified in the notice.

undertake, or cause to be undertaken, a vulnerability assessment in relation to:

the system; and

one or more specified types of cyber security incidents; and

do so within the period specified in the notice.

the costs that are likely to be incurred by the entity in complying with the notice; and

the reasonableness and proportionality of the requirement in the notice; and

such other matters (if any) as the Secretary considers relevant.

the entity; and

if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator.

an entity is the responsible entity for a system of national significance; and

either:

the Secretary has reasonable grounds to believe that if the entity were to be given a notice under subsection 30CU(1) or (2), the entity would not be capable of complying with the notice; or

the entity has not complied with a notice given to the entity under subsection 30CU(1) or (2).

undertake a vulnerability assessment in relation to:

the system; and

all types of cyber security incidents; and

do so within the period specified in the request.

undertake a vulnerability assessment in relation to:

the system; and

one or more specified types of cyber security incidents; and

do so within the period specified in the request.

the entity; and

if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator.

provide the designated officer with access to premises for the purposes of undertaking the vulnerability assessment;

provide the designated officer with access to computers for the purposes of undertaking the vulnerability assessment;

provide the designated officer with reasonable assistance and facilities that are reasonably necessary to allow the designated officer to undertake the vulnerability assessment.

that relates to a system of national significance; and

that either:

relates to all types of cyber security incidents; or

relates to one or more specified types of cyber security incidents; and

if the assessment relates to all types of cyber security incidents—the purpose of which is to test the vulnerability of the system to all types of cyber security incidents; and

if the assessment relates to one or more specified types of cyber security incidents—the purpose of which is to test the vulnerability of the system to those types of cyber security incidents; and

that complies with such requirements (if any) as are specified in the rules.

may be of general application; or

may relate to one or more specified systems of national significance; or

may relate to one or more specified types of cyber security incidents.

do both of the following:

prepare, or cause to be prepared, a vulnerability assessment report relating to the assessment;

give a copy of the report to the Secretary; and

do so:

within 30 days after the completion of the assessment; or

if the Secretary allows a longer period—within that longer period.

do both of the following:

prepare a vulnerability assessment report relating to the assessment;

give a copy of the report to the Secretary; and

do so:

within 30 days after the completion of the assessment; or

if the Secretary allows a longer period—within that longer period.

if the assessment relates to all types of cyber security incidents—the purpose of which is to assess the vulnerability of the system to all types of cyber security incidents; and

if the assessment relates to one or more specified types of cyber security incidents—the purpose of which is to assess the vulnerability of the system to those types of cyber security incidents; and

that complies with such requirements (if any) as are specified in the rules.

a computer:

is needed to operate a system of national significance; or

is a system of national significance; and

the Secretary believes on reasonable grounds that a relevant entity for the system of national significance is technically capable of preparing periodic reports consisting of information that:

relates to the operation of the computer; and

may assist with determining whether a power under this Act should be exercised in relation to the system of national significance; and

(iii) is not personal information (within the meaning of the Privacy Act 1988).

prepare periodic reports that:

consist of any such information; and

relate to such regular intervals as are specified in the notice; and

prepare those periodic reports:

in the manner and form specified in the notice; and

in accordance with the information technology requirements specified in the notice; and

give each of those periodic reports to ASD within the period ascertained in accordance with the notice in relation to the periodic report concerned.

the costs that are likely to be incurred by the entity in complying with the notice; and

the reasonableness and proportionality of the requirements in the notice; and

such other matters (if any) as the Secretary considers relevant.

a computer:

is needed to operate a system of national significance; or

is a system of national significance; and

the Secretary believes on reasonable grounds that, each time a particular kind of event occurs, a relevant entity for the system of national significance will be technically capable of preparing a report consisting of information that:

relates to the operation of the computer; and

may assist with determining whether a power under this Act should be exercised in relation to the system of national significance; and

(iii) is not personal information (within the meaning of the Privacy Act 1988).

prepare a report that consists of any such information;

prepare that report:

in the manner and form specified in the notice; and

in accordance with the information technology requirements specified in the notice;

give that report to ASD as soon as practicable after the event occurs.

the costs that are likely to be incurred by the entity in complying with the notice; and

the reasonableness and proportionality of the requirements in the notice; and

such other matters (if any) as the Secretary considers relevant.

a system information periodic reporting notice; or

a system information event-based reporting notice;

the relevant entity; and

if the relevant entity is not the responsible entity for the system of national significance—the responsible entity for the system of national significance.

comes into force:

when it is given; or

if a later time is specified in the notice—at that later time; and

remains in force for the period specified in the notice.

is in the same, or substantially the same, terms as the original notice; and

comes into force immediately after the expiry of the original notice.

is in the same, or substantially the same, terms as the original notice; and

comes into force immediately after the expiry of the original notice.

a system information periodic reporting notice; or

a system information event-based reporting notice;

the report; or

giving the report;

(c) in criminal proceedings other than proceedings for an offence against Criminal Code that relates to this Act; orsection 137.2 of the

in civil proceedings other than proceedings for recovery of a penalty in relation to a contravention of section 30DF.

a computer:

is needed to operate a system of national significance; or

is a system of national significance; and

the Secretary believes on reasonable grounds that a relevant entity for the system of national significance would not be technically capable of preparing reports under section 30DB or 30DC consisting of information that:

relates to the operation of the computer; and

may assist with determining whether a power under this Act should be exercised in relation to the system of national significance; and

(iii) is not personal information (within the meaning of the Privacy Act 1988).

both:

install a specified computer program on the computer; and

do so within the period specified in the notice; and

maintain the computer program installed in accordance with paragraph (a); and

take all reasonable steps to ensure that the computer is continuously supplied with an internet carriage service that enables the computer program to function.

the costs that are likely to be incurred by the entity in complying with the notice; and

the reasonableness and proportionality of the requirements in the notice; and

such other matters (if any) as the Secretary considers relevant.

collect and record information that:

relates to the operation of the computer; and

may assist with determining whether a power under this Act should be exercised in relation to the system of national significance; and

(iii) is not personal information (within the meaning of the Privacy Act 1988); and

cause the information to be transmitted electronically to ASD.

the relevant entity; and

if the relevant entity is not the responsible entity for the system of national significance—the responsible entity for the system of national significance.

comes into force:

when it is given; or

if a later time is specified in the notice—at that later time; and

remains in force for the period specified in the notice.

is in the same, or substantially the same, terms as the original notice; and

comes into force immediately after the expiry of the original notice.

a computer program is installed in compliance with a system information software notice; and

information is transmitted to ASD as a result of the operation of the computer program;

in criminal proceedings; or

in civil proceedings other than proceedings for recovery of a penalty in relation to a contravention of section 30DM.

the individual is a Departmental employee; or

both:

the individual is a staff member of ASD; and

the Director-General of ASD has agreed to the appointment.

an entity is or was subject to a direction under subsection 32(2); and

the entity is or was a member of a related company group;

another member of the related company group is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the direction; and

an officer, employee or agent of another member of the related company group is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the direction.

(a) an entity (the first entity) is or was subject to a direction under subsection 32(2); and

(b) another entity (the contracted service provider) is or was:

a party to a contract with the first entity; and

responsible under the contract for the provision of services to the first entity;

the contracted service provider is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the direction; and

an officer, employee or agent of the contracted service provider is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the direction.

an entity is or was subject to a direction given under section 35AQ; and

the entity is or was a member of a related company group;

another member of the related company group is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the direction; and

an officer, employee or agent of another member of the related company group is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the direction.

(a) an entity (the first entity) is or was subject to a direction given under section 35AQ; and

(b) another entity (the contracted service provider) is or was:

a party to a contract with the first entity; and

responsible under the contract for the provision of services to the first entity;

the contracted service provider is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the direction; and

an officer, employee or agent of the contracted service provider is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the direction.

an entity is or was subject to a requirement under subsection (1); and

the entity is or was a member of a related company group;

another member of the related company group is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the requirement; and

an officer, employee or agent of another member of the related company group is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the requirement.

(a) an entity (the first entity) is or was subject to a requirement under subsection (1); and

(b) another entity (the contracted service provider) is or was:

a party to a contract with the first entity; and

responsible under the contract for the provision of services to the first entity;

the contracted service provider is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the requirement; and

an officer, employee or agent of the contracted service provider is not liable to an action or other proceeding for damages for or in relation to an act done or omitted in good faith for the purposes of ensuring or facilitating compliance with the requirement.

disclose protected information to an entity for the purposes of developing or assessing:

proposed amendments of this Act; or

proposed rules; or

proposed amendments of the rules; and

make a record of or use protected information for the purpose of that disclosure.

disclose protected information to an Ombudsman official for the purposes of exercising powers, or performing duties or functions, as an Ombudsman official; and

make a record of or use protected information for the purpose of that disclosure.

the entity is the entity to whom the protected information relates; and

the entity discloses the protected information to:

a Minister of the Commonwealth who has responsibility for the regulation or oversight of the relevant critical infrastructure sector to which the protected information relates;

a Minister of a State, the Australian Capital Territory, or the Northern Territory, who has responsibility for the regulation or oversight of the relevant critical infrastructure sector to which the protected information relates;

a person employed as a member of staff of a Minister mentioned in subparagraph (i) or (ii);

the head of an agency (including a Department) administered by a Minister mentioned in subparagraph (i) or (ii), or an officer or employee of that agency; and

the disclosure to the person mentioned in paragraph (b) is for the purposes of enabling or assisting the person to exercise the person’s powers or perform the person’s functions or duties.

the entity is the entity to whom the protected information relates; and

the protected information is covered by:

(i) any of paragraphs (b) to (bl) of the definition of protected information in section 5; or

paragraph (c) of that definition so far as that definition relates to any of paragraphs (b) to (bl) of that definition; and

the Secretary has consented, in writing, to the disclosure; and

if the Secretary’s consent is subject to one or more conditions—those conditions are satisfied.

the entity is the entity to whom the protected information relates; and

the protected information is not covered by:

(i) any of paragraphs (b) to (bl) of the definition of protected information in section 5; or

paragraph (c) of that definition so far as that definition relates to any of paragraphs (b) to (bl) of that definition.

determine that Part 2A applies to the asset;

the asset is a critical infrastructure asset; and

the Minister is satisfied that the asset is of national significance.

the consequences that would arise for:

the social or economic stability of Australia or its people; or

the defence of Australia; or

national security;

if the Minister is aware of one or more interdependencies between the asset and one or more other critical infrastructure assets—the nature and extent of those interdependencies; and

such other matters (if any) as the Minister considers relevant.

each reporting entity for the asset;

the Parliamentary Joint Committee on Intelligence and Security;

if the asset is a tangible asset located (wholly or partly) in a State, the Australian Capital Territory or the Northern Territory—the First Minister of the State, the Australian Capital Territory or the Northern Territory, as the case requires.

setting out the proposed declaration; and

inviting the entity to make submissions to the Minister about the proposed declaration within:

28 days after the notice is given; or

if a shorter period is specified in the notice—that shorter period.

the 28-day period mentioned in subparagraph (1)(b)(i); or

if a shorter period is specified in the notice—that shorter period.

ceases to be a reporting entity for the asset; or

becomes aware of another reporting entity for the asset (whether or not as a result of the first entity ceasing to be a reporting entity).

the fact in paragraph (1)(a) or (b) (as the case requires);

if another entity is a reporting entity for the asset—the name of each other entity and the address of each other entity’s head office or principal place of business (to the extent known by the first entity).

review whether the asset is of national significance; and

give the Minister:

a report of the review; and

a statement setting out the Secretary’s findings.

the consequences that would arise for:

the social or economic stability of Australia or its people; or

the defence of Australia; or

national security;

if the Secretary is aware of one or more interdependencies between the asset and one or more other critical infrastructure assets—the nature and extent of those interdependencies; and

such other matters (if any) as the Secretary considers relevant.

a declaration under subsection 52B(1) is in force in relation to an asset; and

the Minister is no longer satisfied that the asset is of national significance.

the number of annual reports given under section 30AG during the financial year; and

the number of annual reports given under section 30AG during the financial year that included a statement to the effect that a critical infrastructure risk management program was up to date at the end of the financial year; and

the number of annual reports given under section 30AQ during the financial year; and

the number of notices given to entities under section 30CB during the financial year; and

the number of notices given to entities under section 30CM during the financial year; and

the number of notices given to entities under section 30CU during the financial year; and

the number of notices given to entities under Division 5 of Part 2C during the financial year; and

(a) the amendments made by the Security Legislation Amendment (Critical Infrastructure Protection) Act 2022; and

(b) the amendments of this Act made by the Security Legislation Amendment (Critical Infrastructure) Act 2021;

the period beginning at the commencement of this section and ending at the earlier of the following times:

the end of the 6-month period that began at the commencement of this section;

the time when the Parliamentary Joint Committee on Intelligence and Security began to conduct a review under section 60B; or

the period beginning immediately after the end of the immediately preceding designated reporting period and ending at the earlier of the following times:

the end of the 6-month period that began immediately after the end of the immediately preceding designated reporting period;

the time when the Parliamentary Joint Committee on Intelligence and Security began to conduct a review under section 60B.

give the Minister a written report of the review; and

do so within 12 months after the commencement of the review.