1. Does your business fall within one of the following 11 essential sectors regulated by Australia’s Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act)?

• Communications
• Data storage or processing
• Defence
• Energy
• Financial services and markets
• Food and grocery
• Healthcare and medical
• Higher education and research
• Space Technology
• Transport
• Water and sewerage

If yes, your business falls within a critical infrastructure sector and the assets that your business owns, operates, controls, or manages may be subject to laws regulating the security of those assets in Australia.

2. Does your business own, operate, control, or manage one of the following 22 critical infrastructure assets (CIA)?

• Critical telecommunications asset
• Critical broadcasting asset
• Critical domain name system
• Critical data storage or processing asset
• Critical banking asset
• Critical superannuation asset
• Critical insurance asset
• Critical financial market infrastructure asset
• Critical water asset
• Critical electricity asset
• Critical gas asset
• Critical energy market operator asset
• Critical liquid fuel asset
• Critical hospital
• Critical education asset
• Critical food and grocery asset
• Critical port
• Critical freight infrastructure asset
• Critical freight services asset
• Critical public transport asset
• Critical aviation asset
• Critical defence industry asset

If yes, your business may be subject to requirements to report operational and ownership interest information, notify actual or imminent cyber incidents, develop risk management plans or to respond to Australian Government information gathering, directions or interventions.

3. Does your business have assets which may be critical infrastructure assets (CIAs) in or outside of Australia?

The SOCI Act expressly states that it applies to any “responsible entity”, “reporting entity” or “operator” of a critical infrastructure asset located in Australia or assets “used in the course of, or in relation to” trade or commerce with countries outside of Australia, or among the Australian States, or between the Australian Territories or between an Australian Territory and an Australian State. Assets may be categorised as critical infrastructure sector assets (CISA), or critical infrastructure assets (CIA), or “Systems of National Significance” (SONS) – and the classification triggers different obligations under SOCI. In short:

• CISA (assets that related to a critical infrastructure sector) are subject to action and information gathering directions for cyber security incidents.
• CIA are subject to positive security obligations (if “switched on” – that is, further legislated to apply), requests for information and government assistance and directions obligations.
• SONS (which will be specifically declared by an Australian federal government Minister if to apply) will have the obligations that apply to CIAs as well as enhanced cyber security obligations.

4. Are you regulated as an owner or operator of, or an interest holder in, a critical infrastructure asset?

If yes, you may have obligations to comply with under the SOCI Act. Do you know which obligations your business must comply with? The SOCI Act expressly states that it applies both within and outside Australia. It specifically applies to foreign corporations or other Australian trading or financial corporations and any entities that fall within the categories of being a “responsible entity” or “reporting entity” or “operator” of a CIA. Responsible entities are those who own or operate a CIA. Reporting entities are responsible entities and “direct interest holders”. Direct interest holder is anyone who (together with their associates) holds an interest of at least 10% in a CIA or holds an interest in an asset which results in the entity being in a position to directly or indirectly influence or control the CIA. If you have an interest in a CIA only because of a moneylending arrangement, then you are deemed not to be direct interest holder.

New investors into Australia should be aware that Australia’s foreign investor laws (the Foreign Acquisitions and Takeovers Act 1975 (Cth) (FATA)) also have mandatory pre-approval requirements for any foreign person starting a “national security business” or acquiring a direct interest of 10% or greater in a “national security business”, regardless of the value of the investment. A “national security business”, as defined, includes a business which is involved in or connected with a “critical infrastructure asset”.

Also to note is that, on 1 July 2023, a new Register of Foreign Ownership of Australian Assets is expected to come into effect under the FATA and there will be obligations on foreign persons to report ownership of Australian assets.

5. Is your business obliged to provide information to be included on the Register of Critical Infrastructure Assets?

The obligations under the SOCI Act are numerous and include in certain cases registering with the Australian Cyber Infrastructure Security Centre who maintains a confidential Register of Critical Infrastructure Assets. Responsible entities and direct interest holders of CIAs must provide certain “operational” or “interest and control” information to the Register of Critical Infrastructure Assets, which is not accessible to the public.

Some assets may be categorised as Critical Infrastructure Sector Assets, Critical Infrastructure Assets, or a Systems of National Significance (these terms are explained above) and the class that your asset falls into (e.g. whether it an critical public transport asset, critical freight asset, etc) and whether the regulations have ‘switched on’ particular responsibilities for that class of assets determine your obligations under the SOCI Act.

Below is an example of how the various obligations under the SOCI Act will apply to critical data storage and processing assets.

6. Is your board aware of the ongoing obligation to give information and notify of change events?

A reporting entity for a critical infrastructure asset has an ongoing obligation to give information in relation to the asset if the “operational” or “interest and control” information becomes incorrect or an entity becomes a reporting entity for the asset or a reporting entity becomes an entity to which the SOCI Act applies.

There are many deadlines to meet for complying with the SOCI Act - educating your board about them is a necessary part of good governance.

Also, they will need to be aware of the need to consider third party arrangements with suppliers or customers – who may want to impose contractual obligations or who may need to be part of the solutions and processes to enable your business to mitigate and manage material risks.

7. Does your business know about the notification obligations in respect of a cyber security incident?

If the reporting entity becomes aware that a cybersecurity incident has had, or is having, a significant or relevant impact on the availability of a critical infrastructure asset, it must report this event within 12 hours or 72 hours respectively to the Australian Signals Directorate.

8. Does your business need a critical infrastructure risk management program?

The federal Security Legislation Amendment (Critical Infrastructure Protection) Act 2022 (Cth) introduced a new obligation for certain entities to create, maintain, comply with, review regularly, and take all reasonable steps to keep up to date a critical infrastructure risk management program (CIRMP).

The new Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023 (Cth) specify the requirements of a CIRMP. Responsible entities in respect of a critical infrastructure asset have until 17 August 2023 to adopt a Critical infrastructure risk management program.

A CIRMP identifies each hazard where there is a material risk that the occurrence of the hazard could have a relevant impact on the asset, minimises or eliminates any material risk of such a hazard occurring, and mitigates the relevant impact.

9. What happens if your business does not comply with the obligations?

The provisions in the SOCI Act attract significant penalties for non-compliance. A business which contravenes a civil penalty provision of the SOCI Act commits a separate contravention of that provision each day during which the contravention occurs – and so penalties can quickly escalate.

By way of example, breaches of the risk management program obligations and enhanced cybersecurity obligations will be subject to civil penalties of up to 200 penalty units (each penalty unit is at today’s date AUD$275 – so 200 penalty units is AUD$55,000 or around USD$37,000). Fines will be significant given their daily accumulation.

10. Is your business complying with its obligations under the SOCI Act?

Dentons can assist you to comply with Australia’s security of critical infrastructure legislation, by:

• advising on which entities and assets of your company might be regulated by the SOCI Act and related legislation.
• advising on which assets might be regulated or out of scope.
• updating your company’s policies, including response plans, risk management plans, privacy policies to include processes for cyber incidents and their impact on critical infrastructure assets – whether as a service provider to a responsible entity or owner, operator or direct interest holder of a CIA.
• considering internal processes and procedures should you receive a request for information or direction from the Australian Government in response to a cyber security incident or any other matters.
• reviewing which supplier arrangements may be impacted and preparing a playbook of relevant contract positions to assist with your negotiations for compliance.

If you need further information, advice or assistance about the Australian laws regulating critical infrastructure please contact Robyn Chatwood, Partner, or Matthew Hennessy, Partner or a member of your usual cybersecurity team at Dentons.

If you need further information, advice or assistance about the Australian foreign investment laws please contact Kym Livesley, Partner, or Caroline Snow, Partner or a member of your usual corporate team at Dentons.