Cybersecurity Act · s 16

Suggest a correction

Tell us what is wrong in this text. We check every suggestion against the official version before we change anything.

What is wrong?Wrong or mistyped wordsWrong structure or numberingWrong title or detailsText that appears twice

What should change, and whyUp to 2,000 characters.The text as it should read (optional)

16.
Duty to report cybersecurity incident in respect of critical information infrastructure etc.
(1) The owner of a critical information infrastructure shall notify the
Commissioner of the occurrence of any of the following in such form and manner as the Commissioner may determine, within the prescribed period after becoming aware of such occurrence —
(a) a prescribed cybersecurity incident in respect of the critical information infrastructure;
(b) a prescribed cybersecurity incident in respect of any computer or computer system under the control of the owner that is interconnected with or that communicates with the critical information infrastructure;
(c) any other type of cybersecurity incident in respect of the critical information infrastructure that the Commissioner has specified by written direction to the owner.
(2) The owner of a critical information infrastructure shall establish such mechanisms and processes for the purposes of detecting cybersecurity threats and incidents in respect of the critical information infrastructure as set out in any applicable code of practice.
(3) Any owner of a critical information infrastructure who, without reasonable excuse, fails to comply with subsection (1) is guilty of an offence and liable on conviction to a fine not exceeding $100,000, imprisonment for a term not exceeding 2 years or both.

Edit the text above. Up to 20,000 characters.Where you checked it (optional)A link to the official version, if you have one.

The text as we hold it

Open the official text

s 16Duty to report cybersecurity incident in respect of critical information infrastructure etc.

(1)

The owner of a critical information infrastructure shall notify the

Commissioner of the occurrence of any of the following in such form and manner as the Commissioner may determine, within the prescribed period after becoming aware of such occurrence —

(a)

a prescribed cybersecurity incident in respect of the critical information infrastructure;

(b)

a prescribed cybersecurity incident in respect of any computer or computer system under the control of the owner that is interconnected with or that communicates with the critical information infrastructure;

(c)

any other type of cybersecurity incident in respect of the critical information infrastructure that the Commissioner has specified by written direction to the owner.

(2)

The owner of a critical information infrastructure shall establish such mechanisms and processes for the purposes of detecting cybersecurity threats and incidents in respect of the critical information infrastructure as set out in any applicable code of practice.

(3)

Any owner of a critical information infrastructure who, without reasonable excuse, fails to comply with subsection (1) is guilty of an offence and liable on conviction to a fine not exceeding $100,000, imprisonment for a term not exceeding 2 years or both.