In force2024 Revised Edition

Contents

Cybersecurity Act · 2024 Revised Edition · Part · Critical Information Infrastructure

16. Duty to report cybersecurity incident in respect of critical information infrastructure etc.

(1)

The owner of a critical information infrastructure shall notify the

Commissioner of the occurrence of any of the following in such form and manner as the Commissioner may determine, within the prescribed period after becoming aware of such occurrence —

(a)

a prescribed cybersecurity incident in respect of the critical information infrastructure;

(b)

a prescribed cybersecurity incident in respect of any computer or computer system under the control of the owner that is interconnected with or that communicates with the critical information infrastructure;

(c)

any other type of cybersecurity incident in respect of the critical information infrastructure that the Commissioner has specified by written direction to the owner.

(2)

The owner of a critical information infrastructure shall establish such mechanisms and processes for the purposes of detecting cybersecurity threats and incidents in respect of the critical information infrastructure as set out in any applicable code of practice.

(3)

Any owner of a critical information infrastructure who, without reasonable excuse, fails to comply with subsection (1) is guilty of an offence and liable on conviction to a fine not exceeding $100,000, imprisonment for a term not exceeding 2 years or both.

Terms defined in s 2

code of practice
Defined · s 2
“code of practice” means any code of practice issued or approved under section 13(1);
Open s 2
Commissioner
Defined · s 2
“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
Open s 2
computer
Defined · s 2
“computer” means an electronic, magnetic, optical, electrochemical or other data processing device performing logical, arithmetic or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification published in the Gazette, prescribe;
Open s 2
computer system
Defined · s 2
“computer system” means an arrangement of interconnected computers that is designed to perform one or more specific functions, and includes — (a) an information technology system; and (b) an operational technology system such as an industrial control system, a programmable logic controller, a supervisory control and data acquisition system or a distributed control system;
Open s 2
critical information infrastructure
Defined · s 2
“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
Open s 2
cybersecurity
Defined · s 2
“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
Open s 2
cybersecurity incident
Defined · s 2
“cybersecurity incident” means an act or activity carried out without lawful authority on or through a computer or computer system that jeopardises or adversely affects its cybersecurity or the cybersecurity of another computer or computer system;
Open s 2
owner
Defined · s 2
“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
Open s 2

Report

Read on from s 17

Part

Responses to Cybersecurity Threats and Incidents

Read on from Part