Cybersecurity Act · 2024 Revised Edition · Part · Critical Information Infrastructure
13. Codes of practice and standards of performance
Official textFrom Attorney General's Chambers, unchanged
The Commissioner may —
Commissioner
“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
issue or approve one or more codes of practice or standards of performance for the regulation of the owners of critical information infrastructure with respect to measures to be taken by them to ensure the cybersecurity of the critical information infrastructure; or
amend or revoke any code of practice or standard of performance issued or approved under paragraph (a).
If any provision in any code of practice or standard of performance is inconsistent with this Act, such provision, to the extent of the inconsistency, does not have effect.
code of practice
“code of practice” means any code of practice issued or approved under section 13(1);
Where a code of practice or standard of performance is issued, approved, amended or revoked by the Commissioner under subsection (1), the Commissioner shall —
standard of performance
“standard of performance” means any standard of performance issued or approved under section 13(1).
publish a notice of the issue, approval, amendment or revocation (as the case may be) in such manner as will secure adequate publicity for such issue, approval, amendment or revocation;
specify in the notice the date of the issue, approval, amendment or revocation (as the case may be); and
ensure that, so long as the code of practice or standard of performance remains in force, copies of that code or standard, and of all amendments to that code or standard, are available free of charge to the owner of a critical information infrastructure to which that code or standard applies.
None of the following has any effect until the notice relating to it is published in accordance with subsection (3) —
a code of practice or standard of performance;
an amendment to a code of practice or standard of performance;
a revocation of a code of practice or standard of performance.
Cybersecurity 21
Any code of practice or standard of performance has no legislative effect.
Subject to subsections (4) and (7), every owner of a critical information infrastructure shall comply with the codes of practice and standards of performance that apply to the critical information infrastructure.
owner
“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
The Commissioner may, either generally or for such time as the
Commissioner may specify, waive the application to the owner of a critical information infrastructure of any code of practice or standard of performance, or any part of it.
critical information infrastructure
“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
Terms defined in s 2
code of practice
Defined · s 2“code of practice” means any code of practice issued or approved under section 13(1);
Commissioner
Defined · s 2“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
critical information infrastructure
Defined · s 2“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
cybersecurity
Defined · s 2“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
owner
Defined · s 2“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
standard of performance
Defined · s 2“standard of performance” means any standard of performance issued or approved under section 13(1).
Part
Responses to Cybersecurity Threats and Incidents
Part