30AG  Responsible entity must submit annual report

Scope

• (1)

  This section applies if, during a period (the relevant period) that consists of the whole or a part of a financial year:

  • (a)

    an entity was the responsible entity for one or more critical infrastructure assets; and

  • (b)

    the entity had a critical infrastructure risk management program that applied to the entity.

Annual report

• (2)

  The entity must, within 90 days after the end of the financial year, give:

  • (a)

    if there is a relevant Commonwealth regulator that has functions relating to the security of those assets—the relevant Commonwealth regulator; or

  • (b)

    in any other case—the Secretary;

  a report that:

  • (c)

    if the entity had the program at the end of the financial year—includes whichever of the following statements is applicable:

    • (i)

      if the program was up to date at the end of the financial year—a statement to that effect;

    • (ii)

      if the program was not up to date at the end of the financial year—a statement to that effect; and

  • (d)

    if a hazard had a significant relevant impact on one or more of those assets during the relevant period—includes a statement that:

    • (i)

      identifies the hazard; and

    • (ii)

      evaluates the effectiveness of the program in mitigating the significant relevant impact of the hazard on the assets concerned; and

    • (iii)

      if the program was varied during the financial year as a result of the occurrence of the hazard—outlines the variation; and

  • (da)

    if one or more of those assets are critical telecommunications assets:

    • (i)

      includes a summary of the changes (if any) the entity notified during the relevant period under subsection 30EC(2); and

    • (ii)

      describes the risks (if any) advised to the entity during the relevant period under paragraph 30ED(3)(c); and

    • (iii)

      describes the measures (if any) the entity adopted during the relevant period to eliminate or reduce risks advised to the entity during the relevant period or any previous period; and

    • (iv)

      includes a statement that evaluates the effectiveness of those measures to eliminate or reduce risks advised to the entity during the relevant period or any previous period; and

  • (db)

    if the entity was given a direction under section 30AI during the relevant period—includes a statement that:

    • (i)

      sets out the content of the direction; and

    • (ii)

      sets out how the program was varied in response to the direction; and

  • (e)

    is in the approved form; and

  • (f)

    if the entity has a board, council or other governing body—is approved by the board, council or other governing body, as the case requires.

  Civil penalty: 150 penalty units.

• (3)

  A report given by an entity under subsection (2) is not admissible in evidence against the entity in civil proceedings relating to a contravention of a civil penalty provision of this Act.