Cybersecurity Act · 2024 Revised Edition · Part · Critical Information Infrastructure
12. Furnishing of information relating to critical information infrastructure
Official textFrom Attorney General's Chambers, unchanged
The Commissioner may, by notice issued in such form and manner as the Commissioner may determine, require the owner of a critical information infrastructure to furnish, within a reasonable period specified in the notice, the following —
Commissioner
“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
information on the design, configuration and security of the critical information infrastructure;
information on the design, configuration and security of any other computer or computer system under the control of the owner that is interconnected with or that communicates with the critical information infrastructure;
information relating to the operation of the critical information infrastructure and of any other computer or computer system under the control of the owner that is interconnected with or that communicates with the critical information infrastructure;
such other information as the Commissioner may require in order to ascertain the level of cybersecurity of the critical information infrastructure.
Cybersecurity 19
Any owner of a critical information infrastructure who fails, without reasonable excuse, to comply with a notice issued under subsection (1) is guilty of an offence and liable on conviction to a fine not exceeding $100,000, imprisonment for a term not exceeding 2 years or both and, in the case of a continuing offence, to a further fine not exceeding
owner
“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
$5,000 for every day or part thereof during which the offence continues after conviction.
The owner of a critical information infrastructure to whom a notice is issued under subsection (1) is not obliged to disclose any information that is subject to any right, privilege or immunity conferred, or obligation or limitation imposed, by or under any law or rules of professional conduct in relation to the disclosure of such information, except that the performance of a contractual obligation is not an excuse for not disclosing the information.
critical information infrastructure
“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
The owner of a critical information infrastructure is not treated as being in breach of any contractual obligation mentioned in subsection (3) for doing or omitting to do any act, if the act is done or omitted to be done with reasonable care and in good faith and for the purpose of complying with a notice issued under subsection (1).
If a material change is made by or on behalf of the owner of a critical information infrastructure to the design, configuration, security or operation of the critical information infrastructure after any information has been furnished to the Commissioner pursuant to a notice issued under subsection (1), the owner of the critical information infrastructure shall notify the Commissioner of the change not later than 30 days after the change is made.
For the purposes of subsection (5), a change is a material change if the change affects or may affect the cybersecurity of the critical information infrastructure or the ability of the owner of the critical information infrastructure to respond to a cybersecurity threat or incident affecting the critical information infrastructure.
cybersecurity
“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
Any owner of a critical information infrastructure who fails, without reasonable excuse, to comply with subsection (5) is guilty of an offence and liable on conviction to a fine not exceeding $25,000, imprisonment for a term not exceeding 12 months or both.
Cybersecurity 20
Terms defined in s 2
Commissioner
Defined · s 2“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
computer
Defined · s 2“computer” means an electronic, magnetic, optical, electrochemical or other data processing device performing logical, arithmetic or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification published in the Gazette, prescribe;
computer system
Defined · s 2“computer system” means an arrangement of interconnected computers that is designed to perform one or more specific functions, and includes — (a) an information technology system; and (b) an operational technology system such as an industrial control system, a programmable logic controller, a supervisory control and data acquisition system or a distributed control system;
critical information infrastructure
Defined · s 2“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
cybersecurity
Defined · s 2“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
cybersecurity threat
Defined · s 2“cybersecurity threat” means an act or activity (whether known or suspected) carried out on or through a computer or computer system that may imminently jeopardise or affect adversely, without lawful authority, the cybersecurity of that or another computer or computer system;
owner
Defined · s 2“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
Part
Responses to Cybersecurity Threats and Incidents
Part