Commonwealth: Security Legislation Amendment (Critical Infrastructure) Act 2021 (Cth)

Security Legislation Amendment (Critical Infrastructure) Act 2021 No. 124, 2021 An Act to amend legislation relating to critical infrastructure, and for other purposes Contents 1 Short title 2 Commencement 3 Schedules Schedule 1—Security of critical infrastructure Part 1—General amendments Administrative Decisions (Judicial Review) Act 1977 Security of Critical Infrastructure Act 2018 Part 2—Application provisions Part 3—Amendments contingent on the commencement of the Federal Circuit and Family Court of Australia Act 2021 Security of Critical Infrastructure Act 2018 Part 4—Amendments contingent on the commencement of the National Emergency Declaration Act 2020 National Emergency Declaration Act 2020 Security of Critical Infrastructure Act 2018 Schedule 2—Australian Signals Directorate Criminal Code Act 1995 Security Legislation Amendment (Critical Infrastructure) Act 2021 No. 124, 2021 An Act to amend legislation relating to critical infrastructure, and for other purposes [Assented to 2 December 2021] The Parliament of Australia enacts: 1 Short title This Act is the Security Legislation Amendment (Critical Infrastructure) Act 2021. 2 Commencement (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms. Commencement information Column 1 Column 2 Column 3 Provisions Commencement Date/Details 1. Sections 1 to 3 and anything in this Act not elsewhere covered by this table The day this Act receives the Royal Assent. 2 December 2021 2. Schedule 1, Parts 1 and 2 The day after this Act receives the Royal Assent. 3 December 2021 3. Schedule 1, Part 3 The later of: 3 December 2021 (a) immediately after the commencement of the provisions covered by table item 2; and (paragraph (a) applies) (b) the commencement of the Federal Circuit and Family Court of Australia Act 2021. However, the provisions do not commence at all if the event mentioned in paragraph (b) does not occur. 4. Schedule 1, Part 4 The later of: 3 December 2021 (a) immediately after the commencement of the provisions covered by table item 2; and (paragraph (a) applies) (b) the commencement of the National Emergency Declaration Act 2020. However, the provisions do not commence at all if the event mentioned in paragraph (b) does not occur. 5. Schedule 2 The day after this Act receives the Royal Assent. 3 December 2021 Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act. (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act. 3 Schedules Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms. Schedule 1—Security of critical infrastructure Part 1—General amendments Administrative Decisions (Judicial Review) Act 1977 1 Before paragraph (da) of Schedule 1 Insert: (dae) decisions under Part 3A of the Security of Critical Infrastructure Act 2018; Security of Critical Infrastructure Act 2018 4 Section 3 Omit "to national security". 5 At the end of section 3 Add: ; and (e) providing a regime for the Commonwealth to respond to serious cyber security incidents. 6 Section 4 Repeal the section, substitute: 4 Simplified outline of this Act This Act creates a framework for managing risks relating to critical infrastructure. The framework consists of the following: (a) the keeping of a register of information in relation to critical infrastructure assets (the register will not be made public); (c) requiring notification of cyber security incidents; (e) requiring certain entities relating to a critical infrastructure asset to provide information in relation to the asset, and to notify if certain events occur in relation to the asset; (f) allowing the Minister to require certain entities relating to a critical infrastructure asset to do, or refrain from doing, an act or thing if the Minister is satisfied that there is a risk of an act or omission that would be prejudicial to security; (g) allowing the Secretary to require certain entities relating to a critical infrastructure asset to provide certain information or documents; (h) setting up a regime for the Commonwealth to respond to serious cyber security incidents; (i) allowing the Secretary to undertake an assessment of a critical infrastructure asset to determine if there is a risk to national security relating to the asset. Certain information obtained or generated under, or relating to the operation of, this Act is protected information. There are restrictions on when a person may make a record of, use or disclose protected information. Civil penalty provisions of this Act may be enforced using civil penalty orders, injunctions or infringement notices, and enforceable undertakings may be accepted in relation to compliance with civil penalty provisions. The Regulatory Powers Act is applied for these purposes. Certain provisions of this Act are subject to monitoring and investigation under the Regulatory Powers Act. Certain provisions of this Act may be enforced by imposing a criminal penalty. The Minister may privately declare an asset to be a critical infrastructure asset. The Secretary must give the Minister reports, for presentation to the Parliament, on the operation of this Act. 7 Section 5 Insert: access, in relation to a computer program, means the execution of the computer program. access to computer data means: (a) in a case where the computer data is held in a computer—the display of the data by the computer or any other output of the data from the computer; or (b) in a case where the computer data is held in a computer—the copying or moving of the data to: (i) any other location in the computer; or (ii) another computer; or (iii) a data storage device; or (c) in a case where the computer data is held in a data storage device—the copying or moving of the data to: (i) a computer; or (ii) another data storage device. aircraft operator has the same meaning as in the Aviation Transport Security Act 2004. airport has the same meaning as in the Aviation Transport Security Act 2004. airport operator has the same meaning as in the Aviation Transport Security Act 2004. air service has the same meaning as in the Aviation Transport Security Act 2004. approved staff member of the authorised agency has the meaning given by section 35BJ. ASD means the Australian Signals Directorate. asset includes: (a) a system; and (b) a network; and (c) a facility; and (d) a computer; and (e) a computer device; and (f) a computer program; and (g) computer data; and (h) premises; and (i) any other thing. associated entity has the same meaning as in the Corporations Act 2001. associated transmission facility means: (a) an antenna; or (b) a combiner; or (c) a feeder system; or (d) an apparatus; or (e) an item of equipment; or (f) a structure; or (g) a line; or (h) an electricity cable or wire; that is associated with a radiocommunications transmitter. AusCheck scheme has the same meaning as in the AusCheck Act 2007. Australia, when used in a geographical sense, includes the external Territories. Australian CS facility licence has the same meaning as in Chapter 7 of the Corporations Act 2001. Australian derivative trade repository licence has the same meaning as in Chapter 7 of the Corporations Act 2001. Australian market licence has the same meaning as in Chapter 7 of the Corporations Act 2001. authorised agency means ASD. authorised deposit‑taking institution has the same meaning as in the Banking Act 1959. background check has the same meaning as in the AusCheck Act 2007. banking business has the same meaning as in the Banking Act 1959. benchmark administrator licence has the same meaning as in the Corporations Act 2001. broadcasting re‑transmission asset means: (a) a radiocommunications transmitter; or (b) a broadcasting transmission tower; or (c) an associated transmission facility; that is used in connection with the transmission of a service to which, as a result of section 212 of the Broadcasting Services Act 1992, the regulatory regime established by that Act does not apply. broadcasting service has the same meaning as in the Broadcasting Services Act 1992. broadcasting transmission asset means: (a) a radiocommunications transmitter; or (b) a broadcasting transmission tower; or (c) an associated transmission facility; that is used, or is capable of being used, in connection with the transmission of: (d) a national broadcasting service; or (e) a commercial radio broadcasting service; or (f) a commercial television broadcasting service. broadcasting transmission tower has the same meaning as in Schedule 4 to the Broadcasting Services Act 1992. business critical data means: (a) personal information (within the meaning of the Privacy Act 1988) that relates to at least 20,000 individuals; or (b) information relating to any research and development in relation to a critical infrastructure asset; or (c) information relating to any systems needed to operate a critical infrastructure asset; or (d) information needed to operate a critical infrastructure asset; or (e) information relating to risk management and business continuity (however described) in relation to a critical infrastructure asset. carriage service has the same meaning as in the Telecommunications Act 1997. carriage service provider has the same meaning as in the Telecommunications Act 1997. carrier has the same meaning as in the Telecommunications Act 1997. chief executive of the authorised agency means the Director‑General of ASD. clearing and settlement facility has the same meaning as in Chapter 7 of the Corporations Act 2001. commercial radio broadcasting service has the same meaning as in the Broadcasting Services Act 1992. commercial television broadcasting service has the same meaning as in the Broadcasting Services Act 1992. communications sector means the sector of the Australian economy that involves: (a) supplying a carriage service; or (b) providing a broadcasting service; or (c) owning or operating assets that are used in connection with the supply of a carriage service; or (d) owning or operating assets that are used in connection with the transmission of a broadcasting service; or (e) administering an Australian domain name system. computer means all or part of: (a) one or more computers; or (b) one or more computer systems; or (c) one or more computer networks; or (d) any combination of the above. computer data means data held in: (a) a computer; or (b) a data storage device. computer device means a device connected to a computer. connected includes connection otherwise than by means of physical contact, for example, a connection by means of radiocommunication. constable has the same meaning as in the Crimes Act 1914. credit facility has the meaning given by regulations made for the purposes of paragraph 12BAA(7)(k) of the Australian Securities and Investments Commission Act 2001. credit facility business means a business that offers, or provides services in relation to, a credit facility. critical aviation asset means: (a) an asset that: (i) is used in connection with the provision of an air service; and (ii) is owned or operated by an aircraft operator; or (b) an asset that: (i) is used in connection with the provision of an air service; and (ii) is owned or operated by a regulated air cargo agent; or (c) an asset that is used by an airport operator in connection with the operation of an airport. Note: The rules may prescribe that a specified critical aviation asset is not a critical infrastructure asset (see section 9). critical banking asset has the meaning given by section 12G. Note: The rules may prescribe that a specified critical banking asset is not a critical infrastructure asset (see section 9). critical broadcasting asset has the meaning given by section 12E. Note: The rules may prescribe that a specified critical broadcasting asset is not a critical infrastructure asset (see section 9). critical data storage or processing asset has the meaning given by section 12F. Note: The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset (see section 9). critical defence capability includes: (a) materiel; and (b) technology; and (c) a platform; and (d) a network; and (e) a system; and (f) a service; that is required in connection with: (g) the defence of Australia; or (h) national security. critical defence industry asset means an asset that: (a) is being, or will be, supplied by an entity to the Defence Department, or the Australian Defence Force, under a contract; and (b) consists of, or enables, a critical defence capability. Note: The rules may prescribe that a specified critical defence industry asset is not a critical infrastructure asset (see section 9). critical domain name system has the meaning given by section 12KA. Note: The rules may prescribe that a specified critical domain name system is not a critical infrastructure asset (see section 9). critical education asset means a university that is owned or operated by an entity that is registered in the Australian university category of the National Register of Higher Education Providers. Note: The rules may prescribe that a specified critical education asset is not a critical infrastructure asset (see section 9). critical energy market operator asset means an asset that: (a) is owned or operated by: (i) Australian Energy Market Operator Limited (ACN 072 010 327); or (ii) Power and Water Corporation; or (iii) Regional Power Corporation; or (iv) Electricity Networks Corporation; and (b) is used in connection with the operation of an energy market or system; and (c) is critical to ensuring the security and reliability of an energy market; but does not include: (d) a critical electricity asset; or (e) a critical gas asset; or (f) a critical liquid fuel asset. Note: The rules may prescribe that a specified critical energy market operator asset is not a critical infrastructure asset (see section 9). critical financial market infrastructure asset has the meaning given by section 12D. Note: The rules may prescribe that a specified critical financial market infrastructure asset is not a critical infrastructure asset (see section 9). critical food and grocery asset has the meaning given by section 12K. Note: The rules may prescribe that a specified critical food and grocery asset is not a critical infrastructure asset (see section 9). critical freight infrastructure asset has the meaning given by section 12B. Note: The rules may prescribe that a specified critical freight infrastructure asset is not a critical infrastructure asset (see section 9). critical freight services asset has the meaning given by section 12C. Note: The rules may prescribe that a specified critical freight services asset is not a critical infrastructure asset (see section 9). critical hospital means a hospital that has a general intensive care unit. Note: The rules may prescribe that a specified critical hospital is not a critical infrastructure asset (see section 9). critical infrastructure sector has the meaning given by section 8D. critical infrastructure sector asset has the meaning given by subsection 8E(1). critical insurance asset has the meaning given by section 12H. Note: The rules may prescribe that a specified critical insurance asset is not a critical infrastructure asset (see section 9). critical liquid fuel asset has the meaning given by section 12A. Note: The rules may prescribe that a specified critical liquid fuel asset is not a critical infrastructure asset (see section 9). critical public transport asset means a public transport network or system that: (a) is managed by a single entity; and (b) is capable of handling at least 5 million passenger journeys per month; but does not include a critical aviation asset. Note: The rules may prescribe that a specified critical public transport asset is not a critical infrastructure asset (see section 9). critical superannuation asset has the meaning given by section 12J. Note: The rules may prescribe that a specified critical superannuation asset is not a critical infrastructure asset (see section 9). critical telecommunications asset means: (a) a telecommunications network that is: (i) owned or operated by a carrier; and (ii) used to supply a carriage service; or (b) a telecommunications network, or any other asset, that is: (i) owned or operated by a carriage service provider; and (ii) used in connection with the supply of a carriage service. Note: The rules may prescribe that a specified critical telecommunications asset is not a critical infrastructure asset (see section 9). cyber security incident has the meaning given by section 12M. data includes information in any form. data storage means data storage that involves information technology, and includes data back‑up. data storage device means a thing (for example, a disk or file server) containing (whether temporarily or permanently), or designed to contain (whether temporarily or permanently), data for use by a computer. data storage or processing provider means an entity that provides a data storage or processing service. data storage or processing sector means the sector of the Australian economy that involves providing data storage or processing services. data storage or processing service means: (a) a service that enables end‑users to store or back‑up data; or (b) a data processing service. Defence Department means the Department of State that deals with defence and that is administered by the Defence Minister. defence industry sector means the sector of the Australian economy that involves the provision of critical defence capabilities. Defence Minister means the Minister administering section 1 of the Defence Act 1903. derivative trade repository has the same meaning as in Chapter 7 of the Corporations Act 2001. Electricity Networks Corporation means the Electricity Networks Corporation established by section 4 of the Electricity Corporations Act 2005 (WA). electronic communication means a communication of information in any form by means of guided or unguided electromagnetic energy. energy sector means the sector of the Australian economy that involves: (a) the production, transmission, distribution or supply of electricity; or (b) the production, processing, transmission, distribution or supply of gas; or (c) the production, processing, transmission, distribution or supply of liquid fuel. engage in conduct means: (a) do an act or thing; or (b) omit to perform an act or thing. financial benchmark has the same meaning as in Part 7.5B of the Corporations Act 2001. financial market has the same meaning as in Chapter 7 of the Corporations Act 2001. financial services and markets sector means the sector of the Australian economy that involves: (a) carrying on banking business; or (b) operating a superannuation fund; or (c) carrying on insurance business; or (d) carrying on life insurance business; or (e) carrying on health insurance business; or (f) operating a financial market; or (g) operating a clearing and settlement facility; (h) operating a derivative trade repository; or (i) administering a financial benchmark; or (j) operating a payment system; or (k) carrying on financial services business; or (l) carrying on credit facility business. financial services business has the same meaning as in Chapter 7 of the Corporations Act 2001. food means food for human consumption. food and grocery sector means the sector of the Australian economy that involves: (a) manufacturing; or (b) processing; or (c) packaging; or (d) distributing; or (e) supplying; food or groceries on a commercial basis. gas means a substance that: (a) is in a gaseous state at standard temperature and pressure; and (b) consists of naturally occurring hydrocarbons, or a naturally occurring mixture of hydrocarbons and non‑hydrocarbons, the principal constituent of which is methane; and (c) is suitable for consumption. general intensive care unit means an area within a hospital that: (a) is equipped and staffed so that it is capable of providing to a patient: (i) mechanical ventilation for a period of several days; and (ii) invasive cardiovascular monitoring; and (b) is supported by: (i) during normal working hours—at least one specialist, or consultant physician, in the specialty of intensive care, who is immediately available, and exclusively rostered, to that area; and (ii) at all times—at least one medical practitioner who is present in the hospital and immediately available to that area; and (iii) at least 18 hours each day—at least one nurse; and (c) has admission and discharge policies in operation. government business enterprise has the same meaning as in the Public Governance, Performance and Accountability Act 2013. health care includes: (a) services provided by individuals who practise in any of the following professions or occupations: (i) dental (including the profession of a dentist, dental therapist, dental hygienist, dental prosthetist and oral health therapist); (ii) medical; (iii) medical radiation practice; (iv) nursing; (v) midwifery; (vi) occupational therapy; (vii) optometry; (viii) pharmacy; (ix) physiotherapy; (x) podiatry; (xi) psychology; (xii) a profession or occupation specified in the rules; and (b) treatment and maintenance as a patient at a hospital. health care and medical sector means the sector of the Australian economy that involves: (a) the provision of health care; or (b) the production, distribution or supply of medical supplies. health insurance business has the same meaning as in the Private Health Insurance Act 2007. higher education and research sector means the sector of the Australian economy that involves: (a) being a higher education provider; or (b) undertaking a program of research that: (i) is supported financially (in whole or in part) by the Commonwealth; or (ii) is relevant to a critical infrastructure sector (other than the higher education and research sector). higher education provider has the same meaning as in the Tertiary Education Quality and Standards Agency Act 2011. hospital has the same meaning as in the Private Health Insurance Act 2007. IGIS official means: (a) the Inspector‑General of Intelligence and Security; or (b) any other person covered by subsection 32(1) of the Inspector‑General of Intelligence and Security Act 1986. impairment of electronic communication to or from a computer includes: (a) the prevention of any such communication; and (b) the impairment of any such communication on an electronic link or network used by the computer; but does not include a mere interception of any such communication. inland waters means waters within Australia other than waters of the sea. insurance business has the same meaning as in the Insurance Act 1973. internet carriage service means a listed carriage service that enables end‑users to access the internet. life insurance business has the same meaning as in the Life Insurance Act 1995. liquid fuel has the same meaning as in the Liquid Fuel Emergency Act 1984. listed carriage service has the same meaning as in the Telecommunications Act 1997. local hospital network has the same meaning as in the National Health Reform Act 2011. managed service provider, in relation to an asset, means an entity that: (a) manages: (i) the asset; or (ii) a part of the asset; or (b) manages an aspect of: (i) the asset; or (ii) a part of the asset; or (c) manages an aspect of the operation of: (i) the asset; or (ii) a part of the asset. medical supplies includes: (a) goods for therapeutic use; and (b) things specified in the rules. Ministerial authorisation means an authorisation under section 35AB. modification: (a) in respect of computer data—means: (i) the alteration or removal of the data; or (ii) an addition to the data; or (b) in respect of a computer program—means: (i) the alteration or removal of the program; or (ii) an addition to the program. national broadcasting service has the same meaning as in the Broadcasting Services Act 1992. National Register of Higher Education Providers means the register established and maintained under section 198 of the Tertiary Education Quality and Standards Agency Act 2011. notification provision means: (a) subsection 35AE(3); or (b) subsection 35AE(4); or (c) subsection 35AE(5); or (d) subsection 35AE(6); or (e) subsection 35AE(7); or (f) subsection 35AE(8); or (g) subsection 35AH(5); or (h) subsection 35AH(6); or (i) subsection 35AH(7); or (j) subsection 35AY(3); or (k) subsection 35AY(4); or (l) subsection 35AY(5); or (m) subsection 35AY(6); or (n) subsection 35AY(7); or (o) subsection 35AY(8); or (p) subsection 51(3); or (q) subsection 52(4). Ombudsman official means: (a) the Ombudsman; or (b) a Deputy Commonwealth Ombudsman; or (c) a person who is a member of the staff referred to in subsection 31(1) of the Ombudsman Act 1976. 8 Section 5 (paragraph (b) of the definition of operator) Repeal the paragraph, substitute: (b) for a critical infrastructure asset other than a critical port—an entity that operates the asset or part of the asset. 9 Section 5 Insert: payment system has the same meaning as in the Payment Systems (Regulation) Act 1998. 10 Section 5 Insert: Power and Water Corporation means the Power and Water Corporation established by section 4 of the Power and Water Corporation Act 1987 (NT). 11 Section 5 (after paragraph (b) of the definition of protected information) Insert: (bb) records or is the fact that the Minister has: (i) given a Ministerial authorisation; or (ii) revoked a Ministerial authorisation; or (be) is, or is included in, a report under section 30BC or 30BD; or (bi) is, or is included in, a report prepared in compliance with: (i) a system information periodic reporting notice; or (ii) a system information event‑based reporting notice; or (bj) records or is the fact that the Secretary has: (i) given a direction under section 35AK; or (ii) revoked such a direction; or (bk) records or is the fact that the Secretary has: (i) given a direction under section 35AQ; or (ii) revoked such a direction; or (bl) records or is the fact that the Secretary has: (i) given a request under section 35AX; or (ii) revoked such a request; or 12 Section 5 (paragraph (c) of the definition of protected information) Omit "or (b)", substitute ", (b), (ba), (bb), (bc), (bd), (be), (bf), (bg), (bh), (bi), (bj), (bk) or (bl)". 13 Section 5 Insert: radiocommunications transmitter has the same meaning as in the Radiocommunications Act 1992. regional centre means a city, or a town that has a population of 10,000 or more people. Regional Power Corporation means the Regional Power Corporation established by section 4 of the Electricity Corporations Act 2005 (WA). registrable superannuation entity has the same meaning as in the Superannuation Industry (Supervision) Act 1993. regulated air cargo agent has the same meaning as in the Aviation Transport Security Act 2004. related body corporate has the same meaning as in the Corporations Act 2001. relevant Commonwealth regulator means: (a) a Department that is specified in the rules; or (b) a body that is: (i) established by a law of the Commonwealth; and (ii) specified in the rules. relevant entity, in relation to an asset, means an entity that: (a) is the responsible entity for the asset; or (b) is a direct interest holder in relation to the asset; or (c) is an operator of the asset; or (d) is a managed service provider for the asset. relevant impact has the meaning given by section 8G. 14 Section 5 (definition of relevant industry) Repeal the definition. 15 Section 5 (definition of responsible entity) Repeal the definition, substitute: responsible entity, for an asset, has the meaning given by section 12L. 16 Section 5 (paragraph (a) of the definition of security) Omit "sections 10 and 12", substitute "the definition of critical energy market operator asset and sections 10, 12, 12A, 12D, 12G, 12H, 12J, 12M and 12N". 17 Section 5 (paragraph (b) of the definition of security) Omit "sections 10 and 12", substitute "the definition of critical energy market operator asset and sections 10, 12, 12A, 12D, 12G, 12H, 12J, 12M and 12N". 18 Section 5 Insert: significant financial benchmark has the same meaning as in the Corporations Act 2001. space technology sector means the sector of the Australian economy that involves the commercial provision of space‑related services. Note: The following are examples of space‑related services: (a) position, navigation and timing services in relation to space objects; (b) space situational awareness services; (c) space weather monitoring and forecasting; (d) communications, tracking, telemetry and control in relation to space objects; (e) remote sensing earth observations from space; (f) facilitating access to space. staff member, in relation to the authorised agency, means a staff member of ASD (within the meaning of the Intelligence Services Act 2001). technical assistance notice has the same meaning as in Part 15 of the Telecommunications Act 1997. technical assistance request has the same meaning as in Part 15 of the Telecommunications Act 1997. technical capability notice has the same meaning as in Part 15 of the Telecommunications Act 1997. telecommunications network has the same meaning as in the Telecommunications Act 1997. therapeutic use has the same meaning as in the Therapeutic Goods Act 1989. transport sector means the sector of the Australian economy that involves: (a) owning or operating assets that are used in connection with the transport of goods or passengers on a commercial basis; or (b) the transport of goods or passengers on a commercial basis. unauthorised access, modification or impairment has the meaning given by section 12N. water and sewerage sector means the sector of the Australian economy that involves: (a) operating water or sewerage systems or networks; or (b) manufacturing or supplying goods, or providing services, for use in connection with the operation of water or sewerage systems or networks. 19 Section 5 (definition of water utility) After "water services", insert "or sewerage services, or both". 20 At the end of section 6 Add: Interest and control information provided by the Commonwealth (5) If the first entity: (a) is the Governor‑General, the Prime Minister or a Minister; and (b) is a direct interest holder in relation to an asset because of paragraph 8(1)(b); the first entity is not required to provide any interest and control information. Note: The expression Minister is defined in section 2B of the Acts Interpretation Act 1901. (6) However, subsection (5) does not affect the obligation of the Commonwealth to provide interest and control information in relation to the asset if the Commonwealth is also a direct interest holder in relation to the asset because of paragraph 8(1)(a) or (b). 21 After section 8C Insert: 8D Meaning of critical infrastructure sector Each of the following sectors of the Australian economy is a critical infrastructure sector: (a) the communications sector; (b) the data storage or processing sector; (c) the financial services and markets sector; (d) the water and sewerage sector; (e) the energy sector; (f) the health care and medical sector; (g) the higher education and research sector; (h) the food and grocery sector; (i) the transport sector; (j) the space technology sector; (k) the defence industry sector. 8E Meaning of critical infrastructure sector asset (1) An asset is a critical infrastructure sector asset if it is an asset that relates to a critical infrastructure sector. Deeming—when asset relates to a sector (2) For the purposes of this Act, each of the following assets is taken to relate to the communications sector: (a) a critical telecommunications asset; (b) a critical broadcasting asset; (c) a critical domain name system. (3) For the purposes of this Act, a critical data storage or processing asset is taken to relate to the data storage or processing sector. (4) For the purposes of this Act, each of the following assets is taken to relate to the financial services and markets sector: (a) a critical banking asset; (b) a critical superannuation asset; (c) a critical insurance asset; (d) a critical financial market infrastructure asset. (5) For the purposes of this Act, a critical water asset is taken to relate to the water and sewerage sector. (6) For the purposes of this Act, each of the following assets is taken to relate to the energy sector: (a) a critical electricity asset; (b) a critical gas asset; (c) a critical energy market operator asset; (d) a critical liquid fuel asset. (7) For the purposes of this Act, a critical hospital is taken to relate to the health care and medical sector. (8) For the purposes of this Act, a critical education asset is taken to relate to the higher education and research sector. (9) For the purposes of this Act, a critical food and grocery asset is taken to relate to the food and grocery sector. (10) For the purposes of this Act, each of the following assets is taken to relate to the transport sector: (a) a critical port; (b) a critical freight infrastructure asset; (c) a critical freight services asset; (d) a critical public transport asset; (e) a critical aviation asset. (11) For the purposes of this Act, a critical defence industry asset is taken to relate to the defence industry sector. 8F Critical infrastructure sector for a critical infrastructure asset For the purposes of this Act, the critical infrastructure sector for a critical infrastructure asset is the critical infrastructure sector to which the asset relates. 8G Meaning of relevant impact (1) Each of the following is a relevant impact of a hazard on a critical infrastructure asset: (a) the impact (whether direct or indirect) of the hazard on the availability of the asset; (b) the impact (whether direct or indirect) of the hazard on the integrity of the asset; (c) the impact (whether direct or indirect) of the hazard on the reliability of the asset; (d) the impact (whether direct or indirect) of the hazard on the confidentiality of: (i) information about the asset; or (ii) if information is stored in the asset—the information; or (iii) if the asset is computer data—the computer data. (2) Each of the following is a relevant impact of a cyber security incident on a critical infrastructure asset: (a) the impact (whether direct or indirect) of the incident on the availability of the asset; (b) the impact (whether direct or indirect) of the incident on the integrity of the asset; (c) the impact (whether direct or indirect) of the incident on the reliability of the asset; (d) the impact (whether direct or indirect) of the incident on the confidentiality of: (i) information about the asset; or (ii) if information is stored in the asset—the information; or (iii) if the asset is computer data—the computer data. 22 Paragraphs 9(1)(a), (b), (c) and (d) Repeal the paragraphs, substitute: (a) a critical telecommunications asset; or (b) a critical broadcasting asset; or (c) a critical domain name system; or (d) a critical data storage or processing asset; or (da) a critical banking asset; or (db) a critical superannuation asset; or (dc) a critical insurance asset; or (dd) a critical financial market infrastructure asset; or (de) a critical water asset; or (df) a critical electricity asset; or (dg) a critical gas asset; or (dh) a critical energy market operator asset; or (di) a critical liquid fuel asset; or (dj) a critical hospital; or (dk) a critical education asset; or (dl) a critical food and grocery asset; or (dm) a critical port; or (dn) a critical freight infrastructure asset; or (do) a critical freight services asset; or (dp) a critical public transport asset; or (dq) a critical aviation asset; or (dr) a critical defence industry asset; or 23 At the end of subsection 9(1) Add: Note: For prescription by class, see subsection 13(3) of the Legislation Act 2003. 24 Paragraphs 9(2)(a), (b), (c) and (d) Repeal the paragraphs, substitute: (a) a critical telecommunications asset; or (b) a critical broadcasting asset; or (c) a critical domain name system; or (d) a critical data storage or processing asset; or (e) a critical banking asset; or (f) a critical superannuation asset; or (g) a critical insurance asset; or (h) a critical financial market infrastructure asset; or (i) a critical water asset; or (j) a critical electricity asset; or (k) a critical gas asset; or (l) a critical energy market operator asset; or (m) a critical liquid fuel asset; or (n) a critical hospital; or (o) a critical education asset; or (p) a critical food and grocery asset; or (q) a critical port; or (r) a critical freight infrastructure asset; or (s) a critical freight services asset; or (t) a critical public transport asset; or (u) a critical aviation asset; or (v) a critical defence industry asset; 25 At the end of subsection 9(2) Add: Note: For prescription by class, see subsection 13(3) of the Legislation Act 2003. 26 After subsection 9(2) Insert: (2A) If an asset is owned by: (a) the Commonwealth; or (b) a body corporate established by a law of the Commonwealth (other than a government business enterprise); the asset is not a critical infrastructure asset unless: (c) the asset is declared under section 51 to be a critical infrastructure asset; or (d) the asset is prescribed by the rules for the purposes of paragraph (1)(f). (2B) An asset is not a critical infrastructure asset if, or to the extent to which, the asset is located outside Australia. 27 Paragraph 9(3)(b) Repeal the paragraph, substitute: (b) the asset relates to a critical infrastructure sector. 28 Subparagraph 9(4)(a)(i) Before "located", insert "wholly or partly". 29 Subparagraph 9(4)(a)(ii) Omit "industry for the asset", substitute "critical infrastructure sector". 30 Paragraph 10(1)(a) After "customers", insert "or any other number of customers prescribed by the rules". 31 Paragraph 12(1)(b) Repeal the paragraph, substitute: (b) a gas storage facility that has a maximum daily withdrawal capacity of at least 75 terajoules per day or any other maximum daily withdrawal capacity prescribed by the rules; 32 After section 12 Insert: 12A Meaning of critical liquid fuel asset (1) An asset is a critical liquid fuel asset if it is any of the following: (a) a liquid fuel refinery that is critical to ensuring the security and reliability of a liquid fuel market, in accordance with subsection (2); (b) a liquid fuel pipeline that is critical to ensuring the security and reliability of a liquid fuel market, in accordance with subsection (3); (c) a liquid fuel storage facility that is critical to ensuring the security and reliability of a liquid fuel market, in accordance with subsection (4). Note: The rules may prescribe that a specified critical liquid fuel asset is not a critical infrastructure asset (see section 9). (2) For the purposes of paragraph (1)(a), the rules may prescribe: (a) specified liquid fuel refineries that are critical to ensuring the security and reliability of a liquid fuel market; or (b) requirements for a liquid fuel refinery to be critical to ensuring the security and reliability of a liquid fuel market. (3) For the purposes of paragraph (1)(b), the rules may prescribe: (a) specified liquid fuel pipelines that are critical to ensuring the security and reliability of a liquid fuel market; or (b) requirements for a liquid fuel pipeline to be critical to ensuring the security and reliability of a liquid fuel market. (4) For the purposes of paragraph (1)(c), the rules may prescribe: (a) specified liquid fuel storage facilities that are critical to ensuring the security and reliability of a liquid fuel market; or (b) requirements for a liquid fuel storage facility to be critical to ensuring the security and reliability of a liquid fuel market. 12B Meaning of critical freight infrastructure asset (1) An asset is a critical freight infrastructure asset if it is any of the following: (a) a road network that, in accordance with subsection (2), functions as a critical corridor for the transportation of goods between: (i) 2 States; or (ii) a State and a Territory; or (iii) 2 Territories; or (iv) 2 regional centres; (b) a rail network that, in accordance with subsection (3), functions as a critical corridor for the transportation of goods between: (i) 2 States; or (ii) a State and a Territory; or (iii) 2 Territories; or (iv) 2 regional centres; (c) an intermodal transfer facility that, in accordance with subsection (4), is critical to the transportation of goods between: (i) 2 States; or (ii) a State and a Territory; or (iii) 2 Territories; or (iv) 2 regional centres. Note: The rules may prescribe that a specified critical freight infrastructure asset is not a critical infrastructure asset (see section 9). (2) For the purposes of paragraph (1)(a), the rules may prescribe: (a) specified road networks that function as a critical corridor for the transportation of goods between: (i) 2 States; or (ii) a State and a Territory; or (iii) 2 Territories; or (iv) 2 regional centres; or (b) requirements for a road network to function as a critical corridor for the transportation of goods between: (i) 2 States; or (ii) a State and a Territory; or (iii) 2 Territories; or (iv) 2 regional centres. (3) For the purposes of paragraph (1)(b), the rules may prescribe: (a) specified rail networks that function as a critical corridor for the transportation of goods between: (i) 2 States; or (ii) a State and a Territory; or (iii) 2 Territories; or (iv) 2 regional centres; or (b) requirements for a rail network to function as a critical corridor for the transportation of goods between: (i) 2 States; or (ii) a State and a Territory; or (iii) 2 Territories; or (iv) 2 regional centres. (4) For the purposes of paragraph (1)(c), the rules may prescribe: (a) specified intermodal transfer facilities that are critical to the transportation of goods between: (i) 2 States; or (ii) a State and a Territory; or (iii) 2 Territories; or (iv) 2 regional centres; or (b) requirements for an intermodal transfer facility to be critical to the transportation of goods between: (i) 2 States; or (ii) a State and a Territory; or (iii) 2 Territories; or (iv) 2 regional centres. (5) For the purposes of this section, road network includes a part of a road network. (6) For the purposes of this section, rail network includes a part of a rail network. 12C Meaning of critical freight services asset (1) An asset is a critical freight services asset if it is a network that is used by an entity carrying on a business that, in accordance with subsection (2), is critical to the transportation of goods by any or all of the following: (a) road; (b) rail; (c) inland waters; (d) sea. Note: The rules may prescribe that a specified critical freight services asset is not a critical infrastructure asset (see section 9). (2) For the purposes of subsection (1), the rules may prescribe: (a) specified businesses that are critical to the transportation of goods by any or all of the following: (i) road; (ii) rail; (iii) inland waters; (iv) sea; or (b) requirements for a business to be critical to the transportation of goods by any or all of the following: (i) road; (ii) rail; (iii) inland waters; (iv) sea. 12D Meaning of critical financial market infrastructure asset (1) An asset is a critical financial market infrastructure asset if it is any of the following assets: (a) an asset that: (i) is owned or operated by an Australian body corporate that holds an Australian market licence; and (ii) is used in connection with the operation of a financial market that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector; (b) an asset that: (i) is owned or operated by an associated entity of an Australian body corporate that holds an Australian market licence; and (ii) is used in connection with the operation of a financial market that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector; (c) an asset that: (i) is owned or operated by an Australian body corporate that holds an Australian CS facility licence; and (ii) is used in connection with the operation of a clearing and settlement facility that, in accordance with subsection (3), is critical to the security and reliability of the financial services and markets sector; (d) an asset that: (i) is owned or operated by an associated entity of an Australian body corporate that holds an Australian CS facility licence; and (ii) is used in connection with the operation of a clearing and settlement facility that, in accordance with subsection (3), is critical to the security and reliability of the financial services and markets sector; (e) an asset that: (i) is owned or operated by an Australian body corporate that holds a benchmark administrator licence; and (ii) is used in connection with the administration of a significant financial benchmark that, in accordance with subsection (4), is critical to the security and reliability of the financial services and markets sector; (f) an asset that: (i) is owned or operated by an associated entity of an Australian body corporate that holds a benchmark administrator licence; and (ii) is used in connection with the administration of a significant financial benchmark that, in accordance with subsection (4), is critical to the security and reliability of the financial services and markets sector; (g) an asset that: (i) is owned or operated by an Australian body corporate that holds an Australian derivative trade repository licence; and (ii) is used in connection with the operation of a derivative trade repository that, in accordance with subsection (5), is critical to the security and reliability of the financial services and markets sector; (h) an asset that: (i) is owned or operated by an associated entity of an Australian body corporate that holds an Australian derivative trade repository licence; and (ii) is used in connection with the operation of a derivative trade repository that, in accordance with subsection (5), is critical to the security and reliability of the financial services and markets sector; (i) an asset that is used in connection with the operation of a payment system that, in accordance with subsection (6), is critical to the security and reliability of the financial services and markets sector. Note: The rules may prescribe that a specified critical financial market infrastructure asset is not a critical infrastructure asset (see section 9). (2) For the purposes of paragraphs (1)(a) and (b), the rules may prescribe: (a) specified financial markets that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for a financial market to be critical to the security and reliability of the financial services and markets sector. (3) For the purposes of paragraphs (1)(c) and (d), the rules may prescribe: (a) specified clearing and settlement facilities that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for a clearing and settlement facility to be critical to the security and reliability of the financial services and markets sector. (4) For the purposes of paragraphs (1)(e) and (f), the rules may prescribe: (a) specified significant financial benchmarks that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for a significant financial benchmark to be critical to the security and reliability of the financial services and markets sector. (5) For the purposes of paragraphs (1)(g) and (h), the rules may prescribe: (a) specified derivative trade repositories that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for a derivative trade repository to be critical to the security and reliability of the financial services and markets sector. (6) For the purposes of paragraph (1)(i), the rules may prescribe: (a) specified payment systems that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for a payment system to be critical to the security and reliability of the financial services and markets sector. (7) For the purposes of this section, Australian body corporate means a body corporate that is incorporated in Australia. 12E Meaning of critical broadcasting asset (1) One or more broadcasting transmission assets are a critical broadcasting asset if: (a) the broadcasting transmission assets are: (i) owned or operated by the same entity; and (ii) located on a site that, in accordance with subsection (2), is a critical transmission site; or (b) the broadcasting transmission assets are: (i) owned or operated by the same entity; and (ii) located on at least 50 different sites; and (iii) not broadcasting re‑transmission assets; or (c) the broadcasting transmission assets are owned or operated by an entity that, in accordance with subsection (3), is critical to the transmission of a broadcasting service. Note: The rules may prescribe that a specified critical broadcasting asset is not a critical infrastructure asset (see section 9). (2) For the purposes of paragraph (1)(a), the rules may prescribe: (a) specified sites that are critical transmission sites; or (b) requirements for sites to be critical transmission sites. (3) For the purposes of paragraph (1)(c), the rules may prescribe: (a) specified entities that are critical to the transmission of a broadcasting service; or (b) requirements for an entity to be critical to the transmission of a broadcasting service. 12F Meaning of critical data storage or processing asset (1) An asset is a critical data storage or processing asset if: (a) it is owned or operated by an entity that is a data storage or processing provider; and (b) it is used wholly or primarily to provide a data storage or processing service that is provided by the entity on a commercial basis to an end‑user that is: (i) the Commonwealth; or (ii) a body corporate established by a law of the Commonwealth; or (iii) a State; or (iv) a body corporate established by a law of a State; or (v) a Territory; or (vi) a body corporate established by a law of a Territory; and (c) the entity knows that the asset is used as described in paragraph (b). Note: The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset (see section 9). (2) An asset is a critical data storage or processing asset if: (a) it is owned or operated by an entity that is a data storage or processing provider; and (b) it is used wholly or primarily to provide a data storage or processing service that: (i) is provided by the entity on a commercial basis to an end‑user that is the responsible entity for a critical infrastructure asset; and (ii) relates to business critical data; and (c) the entity knows that the asset is used as described in paragraph (b). Note: The rules may prescribe that a specified critical data storage or processing asset is not a critical infrastructure asset (see section 9). (3) If: (a) an entity (the first entity) is the responsible entity for a critical infrastructure asset; and (b) the first entity becomes aware that a data storage or processing service: (i) is provided by another entity on a commercial basis to the first entity; and (ii) relates to business critical data; the first entity must: (c) take reasonable steps to inform that other entity that the first entity has become aware that the data storage or processing service: (i) is provided by the other entity on a commercial basis to the first entity; and (ii) relates to business critical data; and (d) do so as soon as practicable after becoming so aware. Civil penalty for contravention of this subsection: 50 penalty units. 12G Meaning of critical banking asset (1) An asset is a critical banking asset if it is any of the following assets: (a) an asset where the following conditions are satisfied: (i) the asset is owned or operated by an authorised deposit‑taking institution; (ii) the authorised deposit‑taking institution is an authorised deposit‑taking institution that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector; (iii) the asset is used in connection with the carrying on of banking business; (b) an asset where the following conditions are satisfied: (i) the asset is owned or operated by a body corporate that is a related body corporate of an authorised deposit‑taking institution; (ii) the body corporate is a body corporate that, in accordance with subsection (3), is critical to the security and reliability of the financial services and markets sector; (iii) the asset is used in connection with the carrying on of banking business. Note: The rules may prescribe that a specified critical banking asset is not a critical infrastructure asset (see section 9). (2) For the purposes of subparagraph (1)(a)(ii), the rules may prescribe: (a) specified authorised deposit‑taking institutions that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for an authorised deposit‑taking institution to be critical to the security and reliability of the financial services and markets sector. (3) For the purposes of subparagraph (1)(b)(ii), the rules may prescribe: (a) specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector. 12H Meaning of critical insurance asset (1) An asset is a critical insurance asset if it is any of the following assets: (a) an asset where the following conditions are satisfied: (i) the asset is owned or operated by an entity that carries on insurance business; (ii) the entity is an entity that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector; (iii) the asset is used in connection with the carrying on of insurance business; (b) an asset where the following conditions are satisfied: (i) the asset is owned or operated by a body corporate that is a related body corporate of an entity that carries on insurance business; (ii) the body corporate is a body corporate that, in accordance with subsection (3), is critical to the security and reliability of the financial services and markets sector; (iii) the asset is used in connection with the carrying on of insurance business; (c) an asset where the following conditions are satisfied: (i) the asset is owned or operated by an entity that carries on life insurance business; (ii) the entity is an entity that, in accordance with subsection (4), is critical to the security and reliability of the financial services and markets sector; (iii) the asset is used in connection with the carrying on of life insurance business; (d) an asset where the following conditions are satisfied: (i) the asset is owned or operated by a body corporate that is a related body corporate of an entity that carries on life insurance business; (ii) the body corporate is a body corporate that, in accordance with subsection (5), is critical to the security and reliability of the financial services and markets sector; (iii) the asset is used in connection with the carrying on of life insurance business; (e) an asset where the following conditions are satisfied: (i) the asset is owned or operated by an entity that carries on health insurance business; (ii) the entity is an entity that, in accordance with subsection (6), is critical to the security and reliability of the financial services and markets sector; (iii) the asset is used in connection with the carrying on of health insurance business; (f) an asset where the following conditions are satisfied: (i) the asset is owned or operated by a body corporate that is a related body corporate of an entity that carries on health insurance business; (ii) the body corporate is a body corporate that, in accordance with subsection (7), is critical to the security and reliability of the financial services and markets sector; (iii) the asset is used in connection with the carrying on of health insurance business. Note: The rules may prescribe that a specified critical insurance asset is not a critical infrastructure asset (see section 9). (2) For the purposes of subparagraph (1)(a)(ii), the rules may prescribe: (a) specified entities that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for an entity to be critical to the security and reliability of the financial services and markets sector. (3) For the purposes of subparagraph (1)(b)(ii), the rules may prescribe: (a) specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector. (4) For the purposes of subparagraph (1)(c)(ii), the rules may prescribe: (a) specified entities that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for an entity to be critical to the security and reliability of the financial services and markets sector. (5) For the purposes of subparagraph (1)(d)(ii), the rules may prescribe: (a) specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector. (6) For the purposes of subparagraph (1)(e)(ii), the rules may prescribe: (a) specified entities that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for an entity to be critical to the security and reliability of the financial services and markets sector. (7) For the purposes of subparagraph (1)(f)(ii), the rules may prescribe: (a) specified bodies corporate that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for a body corporate to be critical to the security and reliability of the financial services and markets sector. 12J Meaning of critical superannuation asset (1) An asset is a critical superannuation asset if: (a) it is owned or operated by a registrable superannuation entity that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector; and (b) it is used in connection with the operation of a superannuation fund. Note: The rules may prescribe that a specified critical superannuation asset is not a critical infrastructure asset (see section 9). (2) For the purposes of paragraph (1)(a), the rules may prescribe: (a) specified registrable superannuation entities that are critical to the security and reliability of the financial services and markets sector; or (b) requirements for a registrable superannuation entity to be critical to the security and reliability of the financial services and markets sector. 12K Meaning of critical food and grocery asset (1) An asset is a critical food and grocery asset if it is a network that: (a) is used for the distribution or supply of: (i) food; or (ii) groceries; and (b) is owned or operated by an entity that is: (i) a critical supermarket retailer, in accordance with subsection (2); or (ii) a critical food wholesaler, in accordance with subsection (3); or (iii) a critical grocery wholesaler, in accordance with subsection (4). Note: The rules may prescribe that a specified critical food and grocery asset is not a critical infrastructure asset (see section 9). (2) For the purposes of subparagraph (1)(b)(i), the rules may prescribe: (a) specified entities that are critical supermarket retailers; or (b) requirements for an entity to be a critical supermarket retailer. (3) For the purposes of subparagraph (1)(b)(ii), the rules may prescribe: (a) specified entities that are critical food wholesalers; or (b) requirements for an entity to be a critical food wholesaler. (4) For the purposes of subparagraph (1)(b)(iii), the rules may prescribe: (a) specified entities that are critical grocery wholesalers; or (b) requirements for an entity to be a critical grocery wholesaler. 12KA Meaning of critical domain name system (1) An asset is a critical domain name system if it: (a) is managed by an entity that, in accordance with subsection (2), is critical to the administration of an Australian domain name system; and (b) is used in connection with the administration of an Australian domain name system. Note: The rules may prescribe that a specified critical domain name system is not a critical infrastructure asset (see section 9). (2) For the purposes of paragraph (1)(a), the rules may prescribe: (a) specified entities that are critical to the administration of an Australian domain name system; or (b) requirements for an entity to be critical to the administration of an Australian domain name system. 12L Meaning of responsible entity Critical telecommunications asset (1) The responsible entity for a critical telecommunications asset is: (a) whichever of the following is applicable: (i) if the critical telecommunications asset is owned or operated by a carrier—the carrier; (ii) if the critical telecommunications asset is owned or operated by a carriage service provider—the carriage service provider; or (b) if another entity is prescribed by the rules in relation to the asset—that other entity. Critical broadcasting asset (2) The responsible entity for a critical broadcasting asset is: (a) the entity referred to in whichever of the following provisions is applicable: (i) subparagraph 12E(1)(a)(i); (ii) subparagraph 12E(1)(b)(i); (iii) paragraph 12E(1)(c); or (b