If an entity is the responsible entity for one or more critical infrastructure assets, then, in deciding whether to adopt a critical infrastructure risk management program, the entity must have regard to such matters (if any) as are set out in the rules.
Civil penalty: 200 penalty units.
Subsection (1) does not limit the matters to which the responsible entity may have regard.
If:
an entity is the responsible entity for one or more critical infrastructure assets; and
the entity has adopted a critical infrastructure risk management program that applies to the entity;
then, in reviewing the program in accordance with section 30AE, the entity must have regard to such matters (if any) as are set out in the rules.
Civil penalty: 200 penalty units.
Subsection (3) does not limit the matters to which the responsible entity may have regard.
If:
an entity is the responsible entity for one or more critical infrastructure assets; and
the entity has adopted a critical infrastructure risk management program that applies to the entity;
then, in deciding whether to vary the program, the entity must have regard to such matters (if any) as are set out in the rules.
Civil penalty: 200 penalty units.
Subsection (5) does not limit the matters to which the responsible entity may have regard.
Rules made for the purposes of subsection (1), (3) or (5):
may be of general application; or
may relate to one or more specified critical infrastructure assets.
Note: For specification by class, see subsection 13(3) of the Legislation Act 2003.
Subsection (7) of this section does not, by implication, limit subsection 33(3A) of the Acts Interpretation Act 1901.