Cybersecurity Act · 2024 Revised Edition · Part · Critical Information Infrastructure
9. Designation of critical information infrastructure
Official textFrom Attorney General's Chambers, unchanged
The Commissioner may, by written notice to the owner of a computer or computer system, designate the computer or computer system as a critical information infrastructure for the purposes of this Act, if the
Commissioner
“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
Commissioner is satisfied that —
the computer or computer system is necessary for the continuous delivery of an essential service and the loss or compromise of the computer or computer system will have a debilitating effect on the availability of the essential service in Brunei Darussalam; and
the computer or computer system is located wholly or partly in Brunei Darussalam.
A notice issued under subsection (1) shall —
identify the computer or computer system that is being designated as a critical information infrastructure;
identify the owner of the computer or computer system so designated as a critical information infrastructure;
inform the owner of the computer or computer system, regarding the duties and responsibilities of the owner under this Act that arise from the designation;
provide the name and contact particulars of the officer assigned by the Commissioner to supervise the critical information infrastructure;
inform the owner of the computer or computer system that any representation against the designation is to be made to the
Commissioner by a specified date, being a date not earlier than 14 days after the date of the notice; and
inform the owner of the computer or computer system that the owner may appeal to the Minister against the designation and provide information on the applicable procedure.
Cybersecurity 16
Any designation under subsection (1) has effect for a period of 5 years, unless it is withdrawn by the Commissioner before the expiry of the period.
The person who receives a notice under subsection (1) may request the Commissioner to proceed under subsection (5) on showing proof that —
the person is not able to comply with the requirements in this
Part for the reason that the person has neither effective control over the operations of the computer or computer system, nor the ability or right to carry out changes to the computer or computer system; and
another person has effective control over the operations of the computer or computer system and the ability and right to carry out changes to the computer or computer system.
If the Commissioner is satisfied that the conditions mentioned in subsection (4)(a) and (b) are met, the Commissioner may amend the notice issued to the person under subsection (1) and address and send that amended notice to the person mentioned in subsection (4)(b).
During the period when a notice amended under subsection (5) is in effect, the provisions of this Part apply to the person mentioned in subsection (4)(b) as if every reference to the owner of a critical information infrastructure is a reference to the person mentioned in subsection (4)(b).
owner
“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
Where —
a notice issued under this section and amended under subsection (5) is addressed and sent to the person mentioned in subsection (4)(b); and
the person mentioned in subsection (4)(b) then ceases to have the control, ability and right mentioned in that provision, the owner of the critical information infrastructure shall notify the
Commissioner of this without delay.
Where a critical information infrastructure is owned by the
critical information infrastructure
“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
Government and operated by a Ministry, the Permanent Secretary allocated to the Ministry who has responsibility for the critical information
Cybersecurity 17
cybersecurity
“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
infrastructure is treated as the owner of the critical information infrastructure for the purposes of this Act.
A notice issued under this section need not be published in the
Gazette.
Terms defined in s 2
Commissioner
Defined · s 2“Commissioner” means the Commissioner of Cybersecurity appointed under section 5(1);
computer
Defined · s 2“computer” means an electronic, magnetic, optical, electrochemical or other data processing device performing logical, arithmetic or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but does not include such device as the Minister may, by notification published in the Gazette, prescribe;
computer system
Defined · s 2“computer system” means an arrangement of interconnected computers that is designed to perform one or more specific functions, and includes — (a) an information technology system; and (b) an operational technology system such as an industrial control system, a programmable logic controller, a supervisory control and data acquisition system or a distributed control system;
critical information infrastructure
Defined · s 2“critical information infrastructure” means a computer or a computer system in respect of which a designation under section 9(1) is in effect;
cybersecurity
Defined · s 2“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state — (a) the computer or computer system continues to be available and operational; (b) the integrity of the computer or computer system is maintained; and (c) the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
essential service
Defined · s 2“essential service” means any service essential to the national security, defence, foreign relations, economy, public health, public safety or public order of Brunei Darussalam and specified in the Schedule;
owner
Defined · s 2“owner”, in relation to a critical information infrastructure, means the legal owner of the critical information infrastructure and, where the critical information infrastructure is jointly owned by more than one person, includes every joint owner;
Spot a mistake in this text? Suggest a correction.
Part
Responses to Cybersecurity Threats and Incidents
Part