Security of Critical Infrastructure (Application) Rules ...

1 EXPOSURE DRAFT EXPOSURE DRAFT EXPLANATORY STATEMENT Issued by authority of the Minister for Home Affairs Security of Critical Infrastructure Act 2018 Security of Critical Infrastructure (Application) Rules 2021 1 The instrument is made under section 61 of the Security of Critical Infrastructure Act 2018 (the Act). The instrument commences on the day after registration on the Federal Register of Legislation, and is a legislative instrument for the Legislation Act 2003 (the Legislation Act). Purpose 2 Part 2 of the Act provides that the Secretary of the Department must keep a non-public Register of Critical Infrastructure Assets containing information in relation to those assets.

2 Under Part 2, the responsible entity for a Critical Infrastructure asset to which that Part applies must give the Secretary operational information in relation to the asset to be included in the Register. 3 Section 18A of the Act provides that Part 2 of the Act applies to: an asset specified in the Rules (paragraph (1)(a)); and an asset that has been privately declared to be a Critical Infrastructure asset under section 51 of the Act, where the declaration determines that Part 2 applies to the asset (paragraph (1)(b)).

3 And an asset that was a Critical Infrastructure asset immediately before the commencement of section 18A of the Security Legislation Amendment ( Critical Infrastructure ) Act 2021 (the Amendment Act), (paragraph (1)(c)). 4 Part 2B of the Act provides that if a cyber Security incident has a relevant impact on a Critical Infrastructure asset, a responsible entity for the asset to which that Part applies is required to give a relevant Commonwealth body a report about the incident. 5 Section 30BB of the Act provides that Part 2B of the Act applies to: an asset specified in the Rules (paragraph (1)(a)); and an asset that has been privately declared to be a Critical Infrastructure asset under section 51 of the Act, where the declaration determines that Part 2B applies to the asset (paragraph (1)(b)).

4 6 Part 2 and Part 2B of the Act constitute positive Security obligations for responsible entities for Critical Infrastructure assets. The purpose of these Rules is to specify that the obligations in Part 2 and Part 2B of the Act are switched on for a Critical Infrastructure asset or class of Critical Infrastructure assets. 7 The Rules also provide a grace period of 6 months for the commencement of obligations under Part 2 and 3 months for the commencement of obligations under Part 2B. EXPOSURE DRAFT EXPOSURE DRAFT Details of the instrument 8 Details of the instrument are included at Attachment A.

5 Parliamentary scrutiny etc. 9 The instrument is subject to disallowance under section 42 of the Legislation Act. A Statement of Compatibility with Human Rights has been prepared in relation to the instrument, and provides that to the extent that the instrument impacts human rights, the impact is reasonable and proportional. The Statement is included at Attachment B to this explanatory statement. 10 The instrument was made by Karen Andrews, Minister for Home Affairs, in accordance with sections 18AA, 30 BBA and 61 of the Act.

6 EXPOSURE DRAFT EXPOSURE DRAFT Attachment A Details of the Security of Critical Infrastructure (Application) Rules 2021 Section 1 Name This section provides that the name of the instrument is the Security of Critical Infrastructure (Application) Rules 2021 (the instrument). Section 2 Commencement This section provides that the instrument commences on the day after the instrument is registered on the Federal Register of Legislation. Section 3 Definitions Section 3 sets out definitions of terms used in this instrument.

7 Section 4 Application of Part 2 of the Act Subsection (1) provides for the application of Part 2 of the Act to the Critical Infrastructure assets specified in paragraphs (a) to (n) for paragraph 18A(1)(a) of the Act. Paragraphs 4(1)(m) and (n) of the instrument specify Part 2 as applying to Critical electricity assets and Critical gas assets that were not Critical Infrastructure assets prior to the commencement of section 18A of the Act. This is to ensure that Part 2 of the Act applies to assets that newly become a Critical electricity asset or a Critical gas asset as a result of the implementation of the Security of Critical Infrastructure (Definitions) Rules 2021 (the Definitions Rules ).

8 It should be noted that paragraph 18A(1)(c) of the Act provides that Part 2 of the Act continues to apply to Critical Infrastructure assets that were Critical Infrastructure assets immediately before the commencement of section 18A. For this reason, Part 2 of the Act continues to apply Critical electricity assets and Critical gas assets that were already Critical Infrastructure assets immediately prior to the commencement of section 18A. Part 2 of the Act also continues to apply to a Critical port, a Critical water asset and an asset privately declared under section 51 before the commencement of section 18A of the Amendment Act.

9 As a result of being listed in subsection 4(1), the responsible entities for these assets have an ongoing obligation to give the Secretary operational information and to notify the Secretary of notifiable events (see sections 23 and 24 of the Act in particular). The opening words of subsection 4(1) of the instrument exclude the assets mentioned in subsection 4(2) from being specified. This means that Part 2 of the Act does not apply to assets owned or owned by the entities mentioned in subsection 4(2). The purpose of this provision is that sugar mills owned or operated by these entities may fall within the definition of Critical electricity asset under the Definitions Rules .

10 The exclusion will ensure that these entities do not have obligations under Part 2 of the Act. The Department recognises that generators run by Mackay Sugar Australia, MSF Sugar Pty Ltd and Wilmar Sugar Pty Ltd are non-scheduled, seasonal generators, and would unlikely impact the electricity network in EXPOSURE DRAFT EXPOSURE DRAFT any significant way if they were unavailable. For this reason, the generators run at the following sugar mills will not be subject to the positive Security obligations: Invicta Sugar Mill, Giru, Queensland Pioneer Sugar Mill, Brandon, Queensland Racecourse Sugar Mill, Racecourse, Mackay, Queensland, and South Johnstone Sugar Mill, South Johnstone, Queensland.