Cybersecurity Act · 2024 Revised Edition · Part · Critical Information Infrastructure
10. Power to obtain information to ascertain if computer etc. fulfils criteria of critical information infrastructure
Official textFrom Attorney General's Chambers, unchanged
This section applies where the Commissioner has reason to believe that a computer or computer system may fulfil the criteria of a critical information infrastructure.
Commissioner
“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
The Commissioner may, by notice issued in such form and manner as the Commissioner may determine, require any person who appears to be exercising control over the computer or computer system, to provide to the Commissioner, within a reasonable period specified in the notice, such relevant information relating to that computer or computer system as may be required by the Commissioner for the purpose of ascertaining whether the computer or computer system fulfils the criteria of a critical information infrastructure.
computer
“computer” means an electronic, magnetic, optical, electrochemical or other data processing device performing logical, arithmetic or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification published in the Gazette, prescribe;
Without affecting the generality of subsection (2), the
Commissioner may in the notice require the person who appears to be exercising control over the computer or computer system to provide —
computer system
“computer system” means an arrangement of interconnected computers that is designed to perform one or more specific functions, and includes — (a) an information technology system; and (b) an operational technology system such as an industrial control system, a programmable logic controller, a supervisory control and data acquisition system or a distributed control system;
information relating to —
the function that the computer or computer system is employed to serve; and
the person or persons who is or are, or other computer or computer systems that is or are, served by that computer or computer system;
information relating to the design of the computer or computer system; and
such other information as the Commissioner may require in order to ascertain whether the computer or computer system fulfils the criteria of a critical information infrastructure.
Cybersecurity 18
Any person who, without reasonable excuse, fails to comply with a notice issued under subsection (2) is guilty of an offence and liable on conviction to a fine not exceeding $100,000, imprisonment for a term not exceeding 2 years or both and, in the case of a continuing offence, to a further fine not exceeding $5,000 for every day or part thereof during which the offence continues after conviction.
Any person to whom a notice is issued under subsection (2) is not obliged to disclose any information that is subject to any right, privilege or immunity conferred, or obligation or limitation imposed, by or under any law, contract or rules of professional conduct in relation to the disclosure of such information.
Terms defined in s 2
Commissioner
Defined · s 2“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
computer
Defined · s 2“computer” means an electronic, magnetic, optical, electrochemical or other data processing device performing logical, arithmetic or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification published in the Gazette, prescribe;
computer system
Defined · s 2“computer system” means an arrangement of interconnected computers that is designed to perform one or more specific functions, and includes — (a) an information technology system; and (b) an operational technology system such as an industrial control system, a programmable logic controller, a supervisory control and data acquisition system or a distributed control system;
critical information infrastructure
Defined · s 2“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
cybersecurity
Defined · s 2“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
Part
Responses to Cybersecurity Threats and Incidents
Part