{"id":"F2017L00685","name":"Industry Research and Development (Cyber Security Small Business Program) Instrument 2017","slug":"industry-research-and-development-cyber-security-small-business-program-instrument-2017","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":439208,"registerId":"F2017L00685-fast-fetch-1775955317160","compilationNumber":null,"startDate":"2026-04-12","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Industry Research and Development (Cyber Security Small Business Program) Instrument 2017","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\n---\n\n?xml version=\"1.0\" encoding=\"utf-8\" standalone=\"no\"?>\n\n![](image.001.jpeg)\n\n \n\nIndustry Research and Development (Cyber Security Small Business Program) Instrument 2017\n\nI, Arthur Sinodinos AO, Minister for Industry, Innovation and Science, make the following instrument.\n\nDated 14 June 2017\n\nArthur Sinodinos AO\n\nMinister for Industry, Innovation and Science\n\n \n\n \n\n \n\n \n\nContents\n\n1 Name\n\n2 Commencement\n\n3 Authority\n\n4 Definitions\n\n5 Prescribed program\n\n6 Specified legislative power\n\n \n\n1  Name\n\n  This instrument is the Industry Research and Development (Cyber Security Small Business Program) Instrument 2017.\n\n2  Commencement\n\n (1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n \n\n- Commencement information\n- Column 1 Column 2 Column 3\n- Provisions Commencement Date/Details\n- 1. The whole of this instrument The day after this instrument is registered. 17 June 2017\n\n\nNote: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.\n\n (2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.\n\n3  Authority\n\n  This instrument is made under section 33 of the Industry Research and Development Act 1986.\n\n4  Definitions\n\nNote: Entity is defined in the Act.\n\n  In this instrument:\n\nAct means the Industry Research and Development Act 1986.\n\nCREST ANZ means CREST Australia New Zealand Ltd.\n\nNote: CREST is short for the Council of Registered Ethical Security Testers.\n\nsmall business means an entity that:\n\n (a) has an ABN, and is registered, within the meaning given by section 195‑1 of the A New Tax System (Goods and Services Tax) Act 1999; and\n\n (b) employs less than 20 people.\n\n5  Prescribed program\n\n  For the purposes of subsection 33(1) of the Act, the program specified in item 1 of the following table is prescribed to the extent that it is with respect to the legislative power of the Parliament specified in section 6.\n\n \n\n- Prescribed program\n- Item Column 1Program Column 2Description and purpose of the program\n- 1 Cyber Security Small Business Program Financial assistance to:(a) assist CREST ANZ to grow the pool of CREST ANZ approved members and to expand its range of cyber security services; and(b) co‑fund small businesses to have their cyber security tested by CREST ANZ approved service providers.\n\n\n6  Specified legislative power\n\n  For the purposes of subsection 33(3) of the Act, the legislative power of the Parliament to make laws with respect to postal, telegraphic, telephonic, and other like services, is specified.\n","sortOrder":0}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":2,"scope_assessment":{"changed":false,"description":"This instrument remains tightly focused on its original purpose of establishing a specific cyber security assistance program for small businesses. There is no evidence of scope creep; it does exactly what its title suggests and contains no extraneous provisions."},"complexity_factors":["Very short instrument — only 6 sections spanning approximately 2 pages","Minimal defined terms — only 3 definitions ('Act', 'CREST ANZ', 'small business')","No cross-references to other legislation beyond the enabling Act and GST Act for the ABN definition","Simple structure — linear progression from name/authority through to program description","No conditional logic, exceptions, or nested provisions","Single purpose instrument with straightforward operative provisions in sections 5 and 6"],"plain_english_summary":"This instrument establishes the Cyber Security Small Business Program to help Australian small businesses afford professional cyber security testing by funding CREST ANZ to expand its services and co‑funding tests with CREST‑approved providers. \n\nIt affects small businesses (ABN, <20 employees), CREST ANZ, and prospective CREST‑approved testers, improving access to assessments and growing the pool of qualified cyber security professionals; it is prescribed under the Industry Research and Development Act 1986."},"flash_summary":{"complexity_score":2,"scope_assessment":{"changed":false,"description":"The instrument prescribes a specific program and its beneficiaries (CREST ANZ and small businesses) under the existing Act (ss.3,5–6) rather than amending or expanding the Act's objects or definitions. It sets eligibility for small businesses (s.4) and the program purpose (s.5) but leaves implementation, funding decisions and operational criteria to the administering authority under the Act."},"complexity_factors":["Very short instrument (6 sections) with focused purpose — reduces structural complexity.","Relies on cross‑references to the Industry Research and Development Act 1986 for legal effect (s.3) and for administrative detail.","Narrow eligibility definition for small business (ABN and <20 employees) keeps operational criteria simple (s.4).","Program mechanics and funding administration are left to the Act and implementing agency rather than detailed here (s.5), creating delegated discretion.","Specifies parliamentary power basis narrowly (postal/telecommunications‑style services) but does not elaborate limits or procedures (s.6)."],"plain_english_summary":"This instrument prescribes the Cyber Security Small Business Program under the Industry Research and Development Act 1986, authorising government financial assistance to CREST ANZ and co‑funding for eligible small businesses to obtain cyber‑security testing by CREST‑approved providers. It applies to entities with an ABN that employ fewer than 20 people; section 5 sets the assistance and who benefits, and section 6 identifies the legislative power. Payers are program funds and decisions sit with the administering authority under the Act (ss.5–6)."}},"importantCases":[],"_links":{"self":"/api/acts/industry-research-and-development-cyber-security-small-business-program-instrument-2017","history":"/api/acts/industry-research-and-development-cyber-security-small-business-program-instrument-2017/history","analysis":"/api/acts/industry-research-and-development-cyber-security-small-business-program-instrument-2017/analysis","conflicts":"/api/acts/industry-research-and-development-cyber-security-small-business-program-instrument-2017/conflicts","importantCases":"/api/acts/industry-research-and-development-cyber-security-small-business-program-instrument-2017/important-cases","documents":"/api/acts/industry-research-and-development-cyber-security-small-business-program-instrument-2017/documents"}}