Cybersecurity Act · 2024 Revised Edition · Part · Critical Information Infrastructure
14. Power of Commissioner to issue written directions
Official textFrom Attorney General's Chambers, unchanged
The Commissioner may, if the Commissioner thinks —
Commissioner
“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
it is necessary or expedient for ensuring the cybersecurity of a critical information infrastructure or a class of critical information infrastructure; or
it is necessary or expedient for the effective administration of this Act, issue a written direction, either of a general or specific nature, to the owner of a critical information infrastructure or a class of such owners.
Without affecting the generality of subsection (1), a direction under that subsection may relate to —
the action to be taken by the owner or owners in relation to a cybersecurity threat;
compliance with any code of practice or standard of performance applicable to the owner;
the appointment of an auditor approved by the Commissioner to audit the owner or owners on their compliance with this Act or any code of practice or standard of performance applicable to the owner or owners; or
such other matters as the Commissioner may think fit or expedient to ensure the cybersecurity of the critical information infrastructure.
Cybersecurity 22
The Commissioner may at any time vary or revoke any direction issued under subsection (1).
Before giving a direction under subsection (1), the Commissioner shall, unless the Commissioner thinks it is not practicable or desirable to do so, give notice to the person or persons whom the Commissioner proposes to issue the direction —
stating that the Commissioner proposes to issue the direction and setting out its effect; and
specifying the time within which representations or objections to the proposed direction may be made.
The Commissioner shall consider any representation or objection which is duly made before giving any direction.
Any person who, without reasonable excuse, fails to comply with a direction under subsection (1) is guilty of an offence and liable on conviction to a fine not exceeding $100,000, imprisonment for a term not exceeding 2 years or both and, in the case of a continuing offence, to a further fine not exceeding $5,000 for every day or part thereof during which the offence continues after conviction.
Terms defined in s 2
code of practice
Defined · s 2“code of practice” means any code of practice issued or approved under section 13(1);
Commissioner
Defined · s 2“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
critical information infrastructure
Defined · s 2“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
cybersecurity
Defined · s 2“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
cybersecurity threat
Defined · s 2“cybersecurity threat” means an act or activity (whether known or suspected) carried out on or through a computer or computer system that may imminently jeopardise or affect adversely, without lawful authority, the cybersecurity of that or another computer or computer system;
owner
Defined · s 2“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
standard of performance
Defined · s 2“standard of performance” means any standard of performance issued or approved under section 13(1).
Part
Responses to Cybersecurity Threats and Incidents
Part