Cybersecurity Act · 2024 Revised Edition · Part · Responses to Cybersecurity Threats and Incidents
21. Powers to investigate and prevent cybersecurity incidents etc.
Official textFrom Attorney General's Chambers, unchanged
Where information regarding a cybersecurity threat or incident has been received by the Commissioner, the Commissioner may exercise, or may authorise the Deputy Commissioner, an Assistant Commissioner, a cybersecurity officer or an authorised officer to exercise such of the powers mentioned in subsection (2) as are necessary to investigate the cybersecurity threat or incident for the purpose of —
cybersecurity threat
“cybersecurity threat” means an act or activity (whether known or suspected) carried out on or through a computer or computer system that may imminently jeopardise or affect adversely, without lawful authority, the cybersecurity of that or another computer or computer system;
assessing the impact or potential impact of the cybersecurity threat or incident;
preventing any or further harm arising from the cybersecurity incident; or
preventing a further cybersecurity incident from arising from that cybersecurity threat or incident.
The powers mentioned in subsection (1) are the following —
require, by written notice, any person to attend at such reasonable time and at such place as may be specified by the incident response officer to answer any question or to provide a signed statement in writing concerning the cybersecurity threat or incident;
require, by written notice, any person to produce to the incident response officer any physical or electronic record, or document, or a copy of the record or document, that is in the possession of that person, or to provide the incident response officer with any information, which the incident response officer considers to be related to any matter relevant to the investigation;
without giving any fee or reward, inspect, copy or take extracts from such record or document or copy of the record or document mentioned in paragraph (b);
examine orally any person who appears to be acquainted with the facts and circumstances relating to the cybersecurity threat or
Cybersecurity 30
incident and reduce to writing any statement made by the person so examined.
The incident response officer shall specify in the notice mentioned in subsection (2)(b) —
the time and place at which any record, document or copy is to be produced or any information is to be provided; and
the manner and form in which it is to be produced or provided.
A statement made by a person examined under this section shall —
be reduced to writing;
be read over to the person;
if the person does not understand English, be interpreted for the person in a language that he or she understands; and
after correction (if necessary), be signed by that person.
If any person fails to comply with a written notice under subsection (2)(a), the incident response officer may report such failure to a
Magistrate who may then issue an order for the person to attend before the
Commissioner, at a time and place specified in the order, to answer any question or provide a signed statement in writing concerning the cybersecurity threat or incident.
Commissioner
“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
Any person examined under this section or to whom a notice under subsection (2) or an order under subsection (5) is issued is not obliged to disclose any information that is subject to any right, privilege or immunity conferred, or obligation or limitation imposed, by or under any law or rules of professional conduct in relation to the disclosure of such information, except that the performance of a contractual obligation is not an excuse for not disclosing the information.
The person examined under this section or to whom a notice under subsection (2) or an order under subsection (5) is issued is not treated as being in breach of any contractual obligation mentioned in subsection (6) for doing or omitting to do any act if the act is done or omitted to be done with
Cybersecurity 31
cybersecurity
“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
reasonable care and in good faith and for the purpose of answering any question asked during the examination or complying with the notice or order.
Any person who —
wilfully misstates or without reasonable excuse refuses to give any information, provide any statement or produce any record, document or copy required of the person by an incident response officer under subsection (2); or
fails, without reasonable excuse, to comply with an order issued by a Magistrate under subsection (5), is guilty of an offence and liable on conviction to a fine not exceeding
$5,000, imprisonment for a term not exceeding 6 months or both.
In this section and sections 22, 23 and 24, “incident response officer” means the Commissioner, the Deputy Commissioner or any
Deputy Commissioner
“Deputy Commissioner” means the Deputy Commissioner of Cybersecurity appointed under section 5(3);
Assistant Commissioner, cybersecurity officer or authorised officer exercising the powers under this section or section 22, as the case may be.
Assistant Commissioner
“Assistant Commissioner” means any Assistant Commissioner of Cybersecurity appointed under section 5(3);
Terms defined in s 2
Assistant Commissioner
Defined · s 2“Assistant Commissioner” means any Assistant Commissioner of Cybersecurity appointed under section 5(3);
Commissioner
Defined · s 2“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
cybersecurity
Defined · s 2“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
cybersecurity incident
Defined · s 2“cybersecurity incident” means an act or activity carried out without lawful authority on or through a computer or computer system that jeopardises or adversely affects its cybersecurity or the cybersecurity of another computer or computer system;
cybersecurity officer
Defined · s 2“cybersecurity officer” means any cybersecurity officer appointed under section 5(5);
cybersecurity threat
Defined · s 2“cybersecurity threat” means an act or activity (whether known or suspected) carried out on or through a computer or computer system that may imminently jeopardise or affect adversely, without lawful authority, the cybersecurity of that or another computer or computer system;
Deputy Commissioner
Defined · s 2“Deputy Commissioner” means the Deputy Commissioner of Cybersecurity appointed under section 5(3);
Part