While it sounds like these powers only impact the 11 critical infrastructure sectors (and you aren’t in any of them), don’t relax yet. Why not? Because these obligations also extend to those in their supply chains who are designated as responsible entities, reporting entities, direct interest holders, managed service providers and operators.
What are these ‘other’ positive security obligations?
The ‘other’ positive security obligations listed in the SOCI Act (and carried over to the SLACIP Act) are as follows:
- (Confidential) Register of Critical Infrastructure Assets – maintained by the Cyber Infrastructure Security Centre (CISC). Assets must provide the CISC with specific operational and interest and control information about the entity and asset, as well as contractual arrangements for operating core functionalities or maintaining business-critical data.
- Mandatory Cyber Security Incident Reporting/Notification of Cyber Security Events – here, assets must report actual or imminent cyber security incidents to the ASD. If the incident directly or indirectly impacts the asset’s availability, integrity or reliability, or the confidentiality of information about or stored on the asset, it must be reported within 72 hours. If it resulted in a significant impact – 12 hours.
- Risk Management Program – The Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023 (CIRMP Rules) rolled out 17 February 2023. More about this below.
Reporting requirements
If you’ve been designated a responsible entity, you’ll be subject to annual reporting obligations under the SOCI Act. This means that within 90 days after the end of the financial year, your annual report (as approved by your board, council, or other governing body) must be submitted to the Secretary for Home Affairs or a specified regulator.
The requirements of your report will vary depending on whether you’ve been required to produce a critical infrastructure risk management program or not. Either way, failing to comply with the risk management program or your annual reporting obligations under the SOCI Act may attract civil penalties.
A new (more holistic) approach to risk management
As well as providing Ministerial power to privately declare an asset as a critical infrastructure asset or a system of national significance, the SLACIP Act can require compliance with its new risk management program, including delivering additional reporting. (To note: If an asset is called out as a system of national significance, it’s done so in privacy to avoid signalling its importance to bad actors.)
So, if you are designated a responsible entity of one or more critical infrastructure assets, you can be required to ‘adopt, comply with, and maintain a critical infrastructure risk management program.’
Which is a good idea. This amendment drives a holistic ‘all-hazards’ approach to improving core security practices by requiring responsible entities of specified critical infrastructure assets to (in the words of the Government):
- Identify each hazard where there is a material risk that the occurrence of the hazard could have a relevant impact on the asset
- Minimise or eliminate any material risk of such a hazard occurring (so far as it is reasonably practicable to do so) and
- Mitigate the relevant impact of such a hazard on the asset (so far as it is reasonably practicable to do so).
If you have been deemed to be in a critical infrastructure sector or have been categorised as a critical infrastructure asset, you must document, regularly review and update your risk management program. As part of this, your program must also establish and maintain a process/system for complying with ISO/IEC 27001:2015, the Essential Eight Maturity Model (or an equivalent framework).
Is this you?
Before you start to worry, remember that the new risk management program only applies if the Minister decides to empower it. And if that happens, then the program will initially apply to these critical infrastructure sectors and assets:
- Communications: Broadcasting, Domain name systems
- Data storage and processing
- Health and medical: Hospitals
- Energy: Market operators, gas, electricity, and liquid fuel
- Financial services: Specified payment systems operator asset
- Food and grocery
- Transport: Freight infrastructure, freight services
- Water and sewerage
It’s worth noting that there would probably be a case-by-case assessment rather than a blanket application of this requirement.
So, what next?
While we’ve discussed all the potential impacts of the SLACIP Act, we have yet to discuss why it was introduced. Is the Australian Government being over-vigilant? (Short answer: no).
In part two of our critical infrastructure series, we’ll explain what has prompted the SLACIP Act and why the measures it introduces are so important to us all.
