{"type":"doc","content":[{"type":"section","attrs":{"id":"navPoint_92"},"content":[{"type":"heading","attrs":{"id":"v0-p-2215","level":5},"content":[{"type":"text","text":"30BC","marks":[{"type":"bold"}]},{"type":"text","text":"  ","marks":[{"type":"bold"}]},{"type":"text","text":"Notification of critical cyber security incidents","marks":[{"type":"bold"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(1)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2216"},"content":[{"type":"text","text":"If:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2217"},"content":[{"type":"text","text":"an entity is the responsible entity for a critical infrastructure asset; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2218"},"content":[{"type":"text","text":"the entity becomes aware that:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2219"},"content":[{"type":"text","text":"a cyber security incident has occurred or is occurring; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2220"},"content":[{"type":"text","text":"the incident has had, or is having, a significant impact (whether direct or indirect) on the availability of the asset;"}]}]}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-2221"},"content":[{"type":"text","text":"the entity must:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2222"},"content":[{"type":"text","text":"give the relevant Commonwealth body (see section"},{"type":"text","text":" "},{"type":"text","text":"30BF) a report that:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2223"},"content":[{"type":"text","text":"is about the incident; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2224"},"content":[{"type":"text","text":"includes such information (if any) as is prescribed by the rules; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(d)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2225"},"content":[{"type":"text","text":"do so as soon as practicable, and in any event within 12 hours, after the entity becomes so aware."}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-2226"},"content":[{"type":"text","text":"Civil penalty:"},{"type":"text","text":" "},{"type":"text","text":"50 penalty units."}]}]}]},{"type":"heading","attrs":{"id":"v0-p-2227","level":6},"content":[{"type":"text","text":"Form of report etc.","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(2)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2228"},"content":[{"type":"text","text":"A report under subsection"},{"type":"text","text":" "},{"type":"text","text":"(1) may be given:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2229"},"content":[{"type":"text","text":"orally; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2230"},"content":[{"type":"text","text":"in writing."}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(3)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2231"},"content":[{"type":"text","text":"If a report under subsection"},{"type":"text","text":" "},{"type":"text","text":"(1) is given orally, the entity must:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2232"},"content":[{"type":"text","text":"do both of the following:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2233"},"content":[{"type":"text","text":"make a written record of the report in the approved form;"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2234"},"content":[{"type":"text","text":"give a copy of the written record of the report to the relevant Commonwealth body (see section"},{"type":"text","text":" "},{"type":"text","text":"30BF); and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2235"},"content":[{"type":"text","text":"do so within 84 hours after the report is given."}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-2236"},"content":[{"type":"text","text":"Civil penalty:"},{"type":"text","text":" "},{"type":"text","text":"50 penalty units."}]}]},{"type":"legalListItem","attrs":{"marker":"(4)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2237"},"content":[{"type":"text","text":"If the report is given in writing, the entity must ensure that the report is in the approved form."}]},{"type":"paragraph","attrs":{"id":"v0-p-2238"},"content":[{"type":"text","text":"Civil penalty:"},{"type":"text","text":" "},{"type":"text","text":"50 penalty units."}]}]}]},{"type":"heading","attrs":{"id":"v0-p-2239","level":6},"content":[{"type":"text","text":"Exemption—written record","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(5)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2240"},"content":[{"type":"text","text":"The head (however described) of the relevant Commonwealth body (see section"},{"type":"text","text":" "},{"type":"text","text":"30BF) may, by written notice given to an entity, exempt the entity from subsection"},{"type":"text","text":" "},{"type":"text","text":"(3) in relation to a report about a specified cyber security incident."}]},{"type":"paragraph","attrs":{"id":"v0-p-2241"},"content":[{"type":"text","text":"Note:"},{"type":"text","text":" "},{"type":"text","text":"For specification by class, see subsection"},{"type":"text","text":" "},{"type":"text","text":"13(3) of the "},{"type":"text","text":"Legislation Act 2003","marks":[{"type":"italic"}]},{"type":"text","text":"."}]}]},{"type":"legalListItem","attrs":{"marker":"(6)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2242"},"content":[{"type":"text","text":"A notice under subsection"},{"type":"text","text":" "},{"type":"text","text":"(5) is not a legislative instrument."}]}]},{"type":"legalListItem","attrs":{"marker":"(7)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2243"},"content":[{"type":"text","text":"The head (however described) of the relevant Commonwealth body (see section"},{"type":"text","text":" "},{"type":"text","text":"30BF) may, by writing, delegate any or all of the head’s powers under subsection"},{"type":"text","text":" "},{"type":"text","text":"(5) to a person who:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2244"},"content":[{"type":"text","text":"is an SES employee, or acting SES employee, in the relevant Commonwealth body; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2245"},"content":[{"type":"text","text":"holds, or is acting in, a position in the relevant Commonwealth body that is equivalent to, or higher than, a position occupied by an SES employee."}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-2246"},"content":[{"type":"text","text":"Note:"},{"type":"text","text":" "},{"type":"text","text":"The expressions "},{"type":"text","text":"SES employee","marks":[{"type":"bold"},{"type":"italic"}]},{"type":"text","text":" and "},{"type":"text","text":"acting SES employee","marks":[{"type":"bold"},{"type":"italic"}]},{"type":"text","text":" are defined in section"},{"type":"text","text":" "},{"type":"text","text":"2B of the "},{"type":"text","text":"Acts Interpretation Act 1901","marks":[{"type":"italic"}]},{"type":"text","text":"."}]}]},{"type":"legalListItem","attrs":{"marker":"(8)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2247"},"content":[{"type":"text","text":"In exercising powers under a delegation, the delegate must comply with any directions of the head (however described) of the relevant Commonwealth body."}]}]}]}]}]}