# Security of Critical Infrastructure Act 2018

Source: au:frl:C2018A00029
Version: C2025C00238
Commit: 029a33510660693a2308daf7590d2d93aff727af

<source-content>
<section id="navPoint_20"><h5 id="v0-p-1105"><strong>9</strong><strong>  </strong><strong>Meaning of </strong><em><strong>critical infrastructure asset</strong></em></h5><ul><li><span>(1)</span><p id="v0-p-1106">An asset is a <em><strong>critical infrastructure asset</strong></em> if it is:</p><ul><li><span>(a)</span><p id="v0-p-1107">a critical telecommunications asset; or</p></li><li><span>(b)</span><p id="v0-p-1108">a critical broadcasting asset; or</p></li><li><span>(c)</span><p id="v0-p-1109">a critical domain name system; or</p></li><li><span>(d)</span><p id="v0-p-1110">a critical data storage or processing asset; or</p></li><li><span>(da)</span><p id="v0-p-1111">a critical banking asset; or</p></li><li><span>(db)</span><p id="v0-p-1112">a critical superannuation asset; or</p></li><li><span>(dc)</span><p id="v0-p-1113">a critical insurance asset; or</p></li><li><span>(dd)</span><p id="v0-p-1114">a critical financial market infrastructure asset; or</p></li><li><span>(de)</span><p id="v0-p-1115">a critical water asset; or</p></li><li><span>(df)</span><p id="v0-p-1116">a critical electricity asset; or</p></li><li><span>(dg)</span><p id="v0-p-1117">a critical gas asset; or</p></li><li><span>(dh)</span><p id="v0-p-1118">a critical energy market operator asset; or</p></li><li><span>(di)</span><p id="v0-p-1119">a critical liquid fuel asset; or</p></li><li><span>(dj)</span><p id="v0-p-1120">a critical hospital; or</p></li><li><span>(dk)</span><p id="v0-p-1121">a critical education asset; or</p></li><li><span>(dl)</span><p id="v0-p-1122">a critical food and grocery asset; or</p></li><li><span>(dm)</span><p id="v0-p-1123">a critical port; or</p></li><li><span>(dn)</span><p id="v0-p-1124">a critical freight infrastructure asset; or</p></li><li><span>(do)</span><p id="v0-p-1125">a critical freight services asset; or</p></li><li><span>(dp)</span><p id="v0-p-1126">a critical public transport asset; or</p></li><li><span>(dq)</span><p id="v0-p-1127">a critical aviation asset; or</p></li><li><span>(dr)</span><p id="v0-p-1128">a critical defence industry asset; or</p></li><li><span>(e)</span><p id="v0-p-1129">an asset declared under section 51 to be a critical infrastructure asset; or</p></li><li><span>(f)</span><p id="v0-p-1130">an asset prescribed by the rules for the purposes of this paragraph.</p></li></ul><p id="v0-p-1131">Note 1: For prescription by class, see subsection 13(3) of the <em>Legislation Act 2003</em>.</p><p id="v0-p-1132">Note 2: Data storage systems that store or process business critical data are part of the critical infrastructure asset: see subsection (7).</p></li><li><span>(2)</span><p id="v0-p-1133">However, the rules may prescribe that a specified:</p><ul><li><span>(a)</span><p id="v0-p-1134">a critical telecommunications asset; or</p></li><li><span>(b)</span><p id="v0-p-1135">a critical broadcasting asset; or</p></li><li><span>(c)</span><p id="v0-p-1136">a critical domain name system; or</p></li><li><span>(d)</span><p id="v0-p-1137">a critical data storage or processing asset; or</p></li><li><span>(e)</span><p id="v0-p-1138">a critical banking asset; or</p></li><li><span>(f)</span><p id="v0-p-1139">a critical superannuation asset; or</p></li><li><span>(g)</span><p id="v0-p-1140">a critical insurance asset; or</p></li><li><span>(h)</span><p id="v0-p-1141">a critical financial market infrastructure asset; or</p></li><li><span>(i)</span><p id="v0-p-1142">a critical water asset; or</p></li><li><span>(j)</span><p id="v0-p-1143">a critical electricity asset; or</p></li><li><span>(k)</span><p id="v0-p-1144">a critical gas asset; or</p></li><li><span>(l)</span><p id="v0-p-1145">a critical energy market operator asset; or</p></li><li><span>(m)</span><p id="v0-p-1146">a critical liquid fuel asset; or</p></li><li><span>(n)</span><p id="v0-p-1147">a critical hospital; or</p></li><li><span>(o)</span><p id="v0-p-1148">a critical education asset; or</p></li><li><span>(p)</span><p id="v0-p-1149">a critical food and grocery asset; or</p></li><li><span>(q)</span><p id="v0-p-1150">a critical port; or</p></li><li><span>(r)</span><p id="v0-p-1151">a critical freight infrastructure asset; or</p></li><li><span>(s)</span><p id="v0-p-1152">a critical freight services asset; or</p></li><li><span>(t)</span><p id="v0-p-1153">a critical public transport asset; or</p></li><li><span>(u)</span><p id="v0-p-1154">a critical aviation asset; or</p></li><li><span>(v)</span><p id="v0-p-1155">a critical defence industry asset;</p></li></ul><p id="v0-p-1156">is not a critical infrastructure asset.</p><p id="v0-p-1157">Note: For prescription by class, see subsection 13(3) of the <em>Legislation Act 2003</em>.</p></li><li><span>(2A)</span><p id="v0-p-1158">If an asset is owned by:</p><ul><li><span>(a)</span><p id="v0-p-1159">the Commonwealth; or</p></li><li><span>(b)</span><p id="v0-p-1160">a body corporate established by a law of the Commonwealth (other than a government business enterprise);</p></li></ul><p id="v0-p-1161">the asset is not a critical infrastructure asset unless:</p><ul><li><span>(c)</span><p id="v0-p-1162">the asset is declared under section 51 to be a critical infrastructure asset; or</p></li><li><span>(d)</span><p id="v0-p-1163">the asset is prescribed by the rules for the purposes of paragraph (1)(f).</p></li></ul></li><li><span>(2B)</span><p id="v0-p-1164">Subject to subsections (2C) and (2D), an asset is not a critical infrastructure asset if, or to the extent to which, the asset is located outside Australia.</p></li><li><span>(2C)</span><p id="v0-p-1165">Subsection (2B) does not apply for the purposes of working out whether a satellite‑based facility is a critical telecommunications asset if the satellite‑based facility is in a satellite to which either or both of the following apply:</p><ul><li><span>(a)</span><p id="v0-p-1166">the satellite is included in the Register of Space Objects kept under section 76 of the <em>Space (Launches and Returns) Act 2018</em>;</p></li><li><span>(b)</span><p id="v0-p-1167">Australia is the appropriate State Party for the purposes of undertaking the authorisation and continuing supervision required in respect of the satellite under Article VI of the Outer Space Treaty.</p></li></ul><p id="v0-p-1168">Note: For the definitions of <em><strong>Outer Space Treaty</strong></em> and <em><strong>satellite</strong></em><em><strong>‑</strong></em><em><strong>based facility</strong></em>, see section 5.</p></li><li><span>(2D)</span><p id="v0-p-1169">Subsection (2B) does not apply for the purposes of working out whether a submarine cable is a critical telecommunications asset if the submarine cable is installed in Australian waters.</p><p id="v0-p-1170">Note: For the definitions of <em><strong>submarine cable</strong></em> and <em><strong>Australian waters</strong></em>, see section 5.</p></li></ul><h6 id="v0-p-1171"><em>Prescribing an asset as a critical infrastructure asset</em></h6><ul><li><span>(3)</span><p id="v0-p-1172">The Minister must not prescribe an asset for the purposes of paragraph (1)(f) unless the Minister is satisfied that:</p><ul><li><span>(a)</span><p id="v0-p-1173">the asset is critical to:</p><ul><li><span>(i)</span><p id="v0-p-1174">the social or economic stability of Australia or its people; or</p></li><li><span>(ii)</span><p id="v0-p-1175">the defence of Australia; or</p></li><li><span>(iii)</span><p id="v0-p-1176">national security; and</p></li></ul></li><li><span>(b)</span><p id="v0-p-1177">the asset relates to a critical infrastructure sector.</p></li></ul></li></ul><h6 id="v0-p-1178"><em>Consultation with State and Territory Ministers</em></h6><ul><li><span>(4)</span><p id="v0-p-1179">The Minister (the <em><strong>Commonwealth Minister</strong></em>) also must not prescribe the asset unless the Commonwealth Minister has:</p><ul><li><span>(a)</span><p id="v0-p-1180">consulted the following persons (the <em><strong>consulted Minister</strong></em>):</p><ul><li><span>(i)</span><p id="v0-p-1181">the First Minister of the State, the Australian Capital Territory or the Northern Territory in which the critical infrastructure asset is wholly or partly located;</p></li><li><span>(ii)</span><p id="v0-p-1182">each Minister of a State, the Australian Capital Territory, or the Northern Territory, who has responsibility for the regulation or oversight of the relevant critical infrastructure sector in that State or Territory; and</p></li></ul></li><li><span>(b)</span><p id="v0-p-1183">given each consulted Minister written notice of the proposal to prescribe the asset; and</p></li><li><span>(c)</span><p id="v0-p-1184">had regard to any representations given by a consulted Minister under subsection (5) within the period specified for that purpose.</p></li></ul></li><li><span>(5)</span><p id="v0-p-1185">The notice must invite each consulted Minister to make written representations to the Commonwealth Minister in relation to the proposal to prescribe the asset within the period specified in the notice, which must be:</p><ul><li><span>(a)</span><p id="v0-p-1186">at least 28 days after the notice is given; or</p></li><li><span>(b)</span><p id="v0-p-1187">a shorter period if the Commonwealth Minister considers the shorter period is necessary because of urgent circumstances.</p></li></ul></li><li><span>(6)</span><p id="v0-p-1188">Subsection (4) does not limit the persons with whom the Commonwealth Minister may consult.</p></li></ul><h6 id="v0-p-1189"><em>Data storage systems</em></h6><ul><li><span>(7)</span><p id="v0-p-1190">If, under this section, an asset is a critical infrastructure asset, then a data storage system in respect of which all of the following requirements are satisfied is taken to be part of the critical infrastructure asset:</p><ul><li><span>(a)</span><p id="v0-p-1191">the responsible entity for the critical infrastructure asset owns or operates the data storage system;</p></li><li><span>(b)</span><p id="v0-p-1192">the data storage system is used, or is to be used, in connection with the critical infrastructure asset;</p></li><li><span>(c)</span><p id="v0-p-1193">business critical data is stored, or is processed in or by, the data storage system (whether or not other information is also stored, or is processed in or by, the data storage system);</p></li><li><span>(d)</span><p id="v0-p-1194">for a hazard where there is a material risk that the occurrence of the hazard could have an impact on the data storage system, there is also a material risk that the occurrence of the hazard could have a relevant impact on the critical infrastructure asset.</p></li></ul><p id="v0-p-1195">Note: The effect of this subsection is, for example, that:</p><ul><li><span>(a)</span><p id="v0-p-1196">obligations under Part 2 in relation to a critical infrastructure asset will also need to take into account the data storage system; and</p></li><li><span>(b)</span><p id="v0-p-1197">a critical infrastructure risk management program under Part 2A in relation to a critical infrastructure asset will also need to cover the data storage system; and</p></li><li><span>(c)</span><p id="v0-p-1198">notification obligations under Part 2B of cyber security incidents relating to any relevant impact on a critical infrastructure asset will also need to take into account any relevant impact on the data storage system.</p></li></ul></li></ul></section>
</source-content>



Evidence: e-58e6114205b9e6c0ba6649c1a10271b5be0cf3d16e07a49fca85fd39327d8640 (Official Word document (original revision); file 6cc99b7f2c8350a52b9c37816bdf7e1e886defa06768db74c5b9f86551a40070)
Evidence: e-9720c1fed60505ba0ba06be6819b076faed60ab8a7da619ec5ee7226b4203566 (Official PDF (original revision); file 202268babdf7a3a14762336f46740469ec2140cf85d1de613c0298447c112aad)
Evidence: e-cf3848f9b1d9b10a29d8db7c7dee3c4b341fe7c21bf6e6c0e813122bdf67dffc (Official source HTML; file e743ab13aef66f650871b056fafee9d9d007f717764fc114a675f9d7cfb4b935)
Evidence: e-5af1740fabea6daefffdec7b60ecad33b1c1824fff8891d544270aea1c53bf41 (Original stylesheet; file 9b44dc931c36df5f18981e5c446f246ba2879f4bcdd177df12ad1cc38d30ea16)
Evidence: e-9b9a285f56a7a2bf7e5b886fa766a0701b401ff9e91ab3597b27a0f911b16684 (Commonwealth Coat of Arms; file 154911fcca780323e2367b03d8d81318f956046ed9bc79062c522edd814248b4)
Evidence: e-8932559d88335593310941975770a73241715c052989fab9f1be4ac55bfd6b06 (Original structured document; file 9ac2deca18054d563d19693299f407ec6662d61693530d0775f93da1f1370e1b)
Evidence: e-f943f8ddceaa6260cb2d8453269489b74563665c66dcaf4f2711a394dd8ddb50 (Original provenance metadata; file 786e917e3c8a5875459bd2003065de9e9eacf9fe119d27b1cd086a8e13de8e2e)
Evidence: e-ed16c6eb3ca7f9041ccc569c70802773c595622049a9388c9501f988317d24a6 (Original document validation; file c35b76198bec501818a1a48ed89198262e0e928c757e473b7231f9a3b8fe350b)
Evidence: e-00424709ef1981dd20c16b4f54277ed8dfef13453fea759e60d460bb161de6b4 (Original source paragraphs; file 4a1cf510a98a5208bfa2dad17b29c30bf8b43bf8f80349a5eb1d2aea5b9fb181)
Evidence: e-ab7b62608fa9315e3725ed92791660aebf45e9cc54fe0a638386c5afc9ac2fa9 (Original import manifest; file a3a29090cdcd1d6d073a9408d03cf5e760c167cb79f7826172e34f7eaa7b8419)
Evidence: e-ece0bb12deb20dd0391b4368e3f6fa5e24b545041bb5dc8b6f90a5dfaff1b652 (Retained publication provenance; file 05ebaa47d26c1515a2f2e40741877bfd5fa9a7c3cba046ab8e45df2e1288f4c7)
Evidence: e-e825ba4321582aa28bd076e7f58a11a4cd3b79324f226fd5224768d6f649eaaf (Official Word document (current revision); file 0c6af2c493b4cef958d8c93bb532fa9bee99173e4fd9f1f5fd258ec7bcc6c0e0)
Evidence: e-80f83290098701c40d8a1a211e71212f92bdb6e5721a7b74e10dc09707760a29 (Official PDF (current revision); file 863bd718d0348ffccf1fff803566f455ef5eb84d4188c3889ac056507ec3703f)
Evidence: e-4455f382852e9cadd8970041a983ed634aa882178ad4546f343ab5773003e280 (Official Word document (original revision); file f428a88036bc4a9268f86ce488e7afa9f6b0527337b371707dad0d89ef325b93)
Evidence: e-dfebbabf990a79807e47a661208714c056e723edd06ec795db155c6f12713f28 (Official PDF (original revision); file 3a0a2c0a2b49efe9cd30072d7a5c2c177b8ebac2ab17e363bb152e7d831115af)
Evidence: e-fbf43defd7f79d2a4dbb007fa3f6ca820fa5abd3f35168648a8327877fc59f6b (Official EPUB (original revision); file f56f5b52c6fb936fd7c7b6e75fa228da74bbe66f58d71b76056d8ebd600ca9ef)
Evidence: e-487a9df7ad31d5f3ccc608212f9d27e12cd4566ce2af0eb39323013d4f231ac9 (Official source HTML; file f6a8dd06cbdeb355bf79b3ee800f26607ebdf213a18f1ba82184f79748cc6f18)
Evidence: e-a0d2a0fd6a86bee96b6bd5b982670521f65d3774d9aa97504d6651eab7288fb9 (Original stylesheet; file ffdb9181f16a83f3392ff5a975055423d2d3601872ac649ca26adb1e1490bb84)
Evidence: e-b47bed8fab101243cdea1ecac219e3ec9e229a9bc437858b5a654c257f1dbf05 (Commonwealth Coat of Arms; file ca304523ec1a65ffdf482c017915ad9b5fd6e441785fc2dcc78c7e1c8be0ecc1)
Evidence: e-2f1a4282be9de2bb3d8aa6a4a41ee42ac17b3723fb82d8dd30a03a032872bb9b (Original structured document; file 718d24c71d268fc40f8b2a76691e663c177f383c4e9dd536aff22baf471c8198)
Evidence: e-0e51e58a9ee73c6dc1a26e73992f098351ea181a0abe9f8ca6972153b75c75be (Original provenance metadata; file 397890fb4251d1cc858a59381fb47efcac2c17fda225fdff32a0eabbe7e801a0)
Evidence: e-8758c662b7ee97afdacb2977d7415bee9562332da8cc33db132962e235cd9dca (Original document validation; file 9e736d7fcdcafe87883f8ee3248663e6eef0fb6ee36d1a55421f7621f7a1772f)
Evidence: e-88adeb460f53d4b13c88e999880f4fdd3d5afa75f0b2ec7c31880ca1acbfae3b (Original source paragraphs; file 0bc3e5bbfef546528217c779504fa9e8cfac9af86a7c06eb178bf5045fea4654)
Evidence: e-d1525d85271580753cf110099f77f299c8401eb297633d906dafe7f232520ff3 (Original import manifest; file a25f9027894e99a402a35cd1db029d7dec1240fac2ec31ebe66458446e6279f4)
Evidence: e-f2eee0cd7e827fbbd60cf65eceb4e089f5e455fed6342e8d9e60fe318c90cfc5 (Retained publication provenance; file 57ce201878423d26bda8d491862b3d9e192e573e9f2bb23c3688afd8a9671047)
Evidence: e-28ccf2e15c63edaac0c76a8b73b918a0e6de33f5d9bc7bb2934ecfc4b1541da5 (Retained legislative events catalogue; file a7c765d2678ac6d1e29cea7a469b79e086cfc6b115a95f47e4dc6287d37ca616)
Evidence: e-772579cae1da957e8637199f364da8db89d297cdbf7602b7709cbd498d22888d (Retained legislative publication record; file 06b68f05cc7984892ac6f216a2f72cf4b80996dbd98387deddbb2333894ecab1)
Evidence: e-f171e8096135b6c246af03bd1275c7e291c29ef657a71aa9788fc424ffd00049 (As-made Act PDF: Security of Critical Infrastructure Act 2018; file c99f9a3e3edf5e23086a601dacc4fa6edc901e8927c61d28ec8805b461d4a896)
Evidence: e-5aa20a7e82cac98adb8af7c64d58378972c5c4645024649cfce25b126cf9e045 (As-made Act PDF: Security of Critical Infrastructure and Other Legislation Amendment (Enhanced Response and Prevention) Act 2024; file ae00333cb66ca6f5fd80b0da7dc98b1986cefcd078b7c7198b95ca192e4d168c)
Evidence: e-724ecc4bb31e9b369933d8578356dbe7f7837ecf78f63274b836952e045f8f25 (AI draft (@cf/meta/llama-3.3-70b-instruct-fp8-fast); file 18478600c97acd0503406ffdcaeee54a92818612f2e4046ca964039ec9970b9f)
Evidence: e-4d59c56a93ca6c2d2a9c173487935b0f93372f71b510a95931515977d7239b73 (Retained AI review and publication record; file bca92734ee10ba895742d99232e021751d145db017a14d4d53bc5d8d25d56724)