30BC  Notification of critical cyber security incidents

• (1)

  If:

  • (a)

    an entity is the responsible entity for a critical infrastructure asset; and

  • (b)

    the entity becomes aware that:

    • (i)

      a cyber security incident has occurred or is occurring; and

    • (ii)

      the incident has had, or is having, a significant impact (whether direct or indirect) on the availability of the asset;

  the entity must:

  • (c)

    give the relevant Commonwealth body (see section 30BF) a report that:

    • (i)

      is about the incident; and

    • (ii)

      includes such information (if any) as is prescribed by the rules; and

  • (d)

    do so as soon as practicable, and in any event within 12 hours, after the entity becomes so aware.

  Civil penalty: 50 penalty units.

Form of report etc.

• (2)

  A report under subsection (1) may be given:

  • (a)

    orally; or

  • (b)

    in writing.

• (3)

  If a report under subsection (1) is given orally, the entity must:

  • (a)

    do both of the following:

    • (i)

      make a written record of the report in the approved form;

    • (ii)

      give a copy of the written record of the report to the relevant Commonwealth body (see section 30BF); and

  • (b)

    do so within 84 hours after the report is given.

  Civil penalty: 50 penalty units.

• (4)

  If the report is given in writing, the entity must ensure that the report is in the approved form.

  Civil penalty: 50 penalty units.

Exemption—written record

• (5)

  The head (however described) of the relevant Commonwealth body (see section 30BF) may, by written notice given to an entity, exempt the entity from subsection (3) in relation to a report about a specified cyber security incident.

  Note: For specification by class, see subsection 13(3) of the Legislation Act 2003.

• (6)

  A notice under subsection (5) is not a legislative instrument.

• (7)

  The head (however described) of the relevant Commonwealth body (see section 30BF) may, by writing, delegate any or all of the head’s powers under subsection (5) to a person who:

  • (a)

    is an SES employee, or acting SES employee, in the relevant Commonwealth body; or

  • (b)

    holds, or is acting in, a position in the relevant Commonwealth body that is equivalent to, or higher than, a position occupied by an SES employee.

  Note: The expressions SES employee and acting SES employee are defined in section 2B of the Acts Interpretation Act 1901.

• (8)

  In exercising powers under a delegation, the delegate must comply with any directions of the head (however described) of the relevant Commonwealth body.