{"id":"F2026L00384","name":"Maritime Transport and Offshore Facilities Security (Incident Reporting) Instrument 2026","slug":"maritime-transport-and-offshore-facilities-security-incident-reporting-instrument-2026","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":443230,"registerId":"F2026L00384-fast-fetch-1775958120195","compilationNumber":null,"startDate":"2026-04-12","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Maritime Transport and Offshore Facilities Security (Incident Reporting) Instrument 2026","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\n---\n\n![Commonwealth Coat of Arms of Australia](image.001.jpeg)\n\n \n\nLIN 26/032\n\n \n\nMaritime Transport and Offshore Facilities Security (Incident Reporting) Instrument 2026\n\nI, Matthew Pedler, Delegate of Secretary of the Department of Home Affairs, make the following instrument.\n\nDated 26 March 2026\n\nMatthew Pedler\n\nActing First Assistant Secretary  Critical Infrastructure Partnerships and Policy Division  Critical Infrastructure and Protective Security Group  National Security Group\n\nDepartment of Home Affairs\n\n \n\n \n\n \n\nContents\n\nPart 1—Preliminary\n\n1  Name\n\n2  Commencement\n\n3  Authority\n\n4  Definitions\n\n5  Schedules\n\nPart 2—Reporting requirements\n\n6  Information that must be included in a security incident report\n\n7  Way in which a security incident report is to be made\n\n8  Information that must be included in a cyber security incident report\n\n9  Way in which a cyber security incident report is made\n\nPart 3—Transitional and application provisions\n\n10  Reporting requirements—application\n\nSchedule 1—Repeals\n\nMaritime Transport and Offshore Facilities Security (Incident Reporting) Instrument 2018\n\n \n\nPart 1—Preliminary\n\n1  Name\n\n  This instrument is the Maritime Transport and Offshore Facilities Security (Incident Reporting) Instrument 2026.\n\n2  Commencement\n\n  This instrument commences on the later of:\n\n (a) the day after the instrument is registered; and\n\n (b) immediately after the commencement of Part 1 of Schedule 1 to the Transport Security Amendment (Security of Australia’s Transport Sector) Act 2025.\n\n3  Authority\n\n  This instrument is made under subsection 182(1) of the Maritime Transport and Offshore Facilities Security Act 2003.\n\n4  Definitions\n\nNote: A number of expressions used in this instrument are defined in the Act, including the following:\n\n(a) cyber security incident;\n\n(b) ISSC;\n\n(c) maritime industry participant;\n\n(d) maritime transport or offshore facility incident;\n\n(e) offshore facility;\n\n(f) relevant impact;\n\n(g) significant impact;\n\n(h) ship;\n\n(i) unlawful interference with maritime transport or offshore facilities.\n\n  In this instrument:\n\nAct means the Maritime Transport and Offshore Facilities Security Act 2003.\n\ncyber security incident report means a report required to be made to the Secretary under Part 9 of the Act for a cyber security incident.\n\nDepartment means the Department of Home Affairs.\n\nindustry participant means a maritime industry participant.\n\nrelevant cyber security incident means a cyber security incident that has a relevant impact.\n\nsecurity incident means a maritime transport or offshore facility security incident.\n\nsecurity incident report means a report required to be made to the Secretary under Part 9 of the Act in relation to a security incident.\n\nsignificant cyber security incident means a cyber security incident that has a significant impact.\n\nunlawful interference means unlawful interference with maritime transport or offshore facilities.\n\n5  Schedules\n\n  Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.\n\nPart 2—Reporting requirements\n\n6  Information that must be included in a security incident report\n\n (1) For the purposes of paragraph 182(1)(a) of the Act, this section specifies information that a security incident report must include.\n\nGeneral reporting requirements\n\n (2) The following information must be included in a security incident report:\n\n (a) the name, contact number and email address of the person making the report;\n\n (b) the title or position held by the person making the report;\n\n (c) the name of the employer of the person making the report (where applicable);\n\n (d) the date of the report;\n\n (e) the date and time the security incident commenced;\n\n (f) the date and time the security incident ceased;\n\n (g) the location of the security incident (including, where applicable, the name and address of the port or offshore facility the security incident occurred in);\n\n (h) the industry participant or participants to whom the security incident relates;\n\n (i) the industry participant or participants who are affected as a result of the security incident;\n\n (j) whether the report is a result of a routine security inspection;\n\n (k) a detailed description of the security incident, including an indication as to whether the incident was or is:\n\n (i) a threat of unlawful interference; or\n\n (ii) an unlawful interference;\n\n (l) the steps the industry participant has taken, or is in the process of taking, to ensure the security incident does not occur again; and\n\n (m) where subsection (3), (4), (5), (6), (7) or (8) applies—information that is specified in that subsection.\n\nNote: If, at the time of reporting, any of the required information under subsection 6(2) is not able to be provided, subsection 7(2) sets out requirements in relation to providing further information.\n\nIncident involving a threat of unlawful interference\n\n (3) If the security incident was or is a threat of unlawful interference, the following information must also be included in the report:\n\n (a) the name and contact details of the person who received the threat;\n\n (b) the details of the threat;\n\n (c) whether the threat is assessed as genuine or as a hoax and how that assessment has been made; and\n\n (d) whether the person who made the threat attempted, is in the process of committing, or completed the act of unlawful interference.\n\nIncident involving a ship\n\n (4) If the security incident involved or involves a ship, the following information must also be included in the report:\n\n (a) the name of the ship and its flag;\n\n (b) the size and type of ship;\n\n (c) the IMO and ISSC numbers; and\n\n (d) the type of cargo on board (if applicable).\n\nIncident involving an offshore facility, building or other infrastructure\n\n (5) If the security incident involved, or involves, an offshore facility or building or other infrastructure, information that is sufficient to identify the building or offshore facility or other infrastructure must also be included in the report.\n\nIncident previously reported to the Secretary\n\n (6) If the person making the report is aware that the security incident has previously been reported to the Secretary, the following information must also be included in the report:\n\n (a) the approximate time and date on which the security incident was reported; and\n\n (b) the name or position of the person to whom, or the name of the area in the Department to which, the incident was reported.\n\nIncident previously reported to the police, an industry participant or any other body\n\n (7) If the security incident has been reported to the police, an industry participant or any other body, the following information must also be included in the report:\n\n (a) the approximate time and date on which the security incident was reported; and\n\n (b) the name and contact information of the person to whom the incident was reported, or a relevant engagement identifier such as a case number, incident report number or other relevant identifier.\n\nIncident brought to the attention of an industry participant by a third party\n\n (8) If the report is a result of a security incident that has been brought to the attention of the person making the report by a third party, the following information must also be included in the report:\n\n (a) that the report is a result of notification from a third party; and\n\n (b) the name, and where applicable, name of employer, of the third party.\n\n7  Way in which a security incident report is to be made\n\n (1) Once an industry participant becomes aware that a security incident has occurred, or is occurring, the industry participant must make the security incident report as soon as possible, but no later than 24 hours after they first become aware of the incident.\n\n (2) If at the time of making the security incident report, the industry participant does not have any, or part, of the information that is required under section 6, but subsequently obtains that information, the industry participant must provide that information to the Secretary in a report by one of the ways specified in subsection (3) as soon as possible, but not later than 24 hours after obtaining the information.\n\n (3) A security incident report must be made in one of the following ways:\n\n (a) orally via phone on 1300 791 581;\n\n (b) online via the Department’s website using the form: https://www.homeaffairs.gov.au/help-and-support/departmental-forms/online-forms/maritime-security-incident-report-form;  or\n\n (c) by email to transport.security@homeaffairs.gov.au.\n\n (4) If a security incident report is first made in the way specified in paragraph (3)(a), the industry participant must, within 24 hours of making that report, also provide the information required under section 6 in a way specified in either paragraph (3)(b) or (c).\n\n8  Information that must be included in a cyber security incident report\n\n (1) For the purposes of paragraph 182(1)(a) of the Act, this section specifies information that a cyber security incident report must include.\n\n (2) The following information must be included in a cyber security incident report:\n\n (a) the name, contact number and email address of the person making the report;\n\n (b) the name of the employer of the person making the report (if applicable);\n\n (c) the state or territory and postcode of the employer of the person making the report;\n\n (d) the date and time the incident was identified;\n\n (e) whether the incident is ongoing at the time the report is made;\n\n (f) the nature or type of cyber security incident that is occurring or has occurred; and\n\n (g) a detailed description of the cyber security incident that is occurring or has occurred.\n\nNote:  If, at the time of reporting, any of the required information specified in subsection 8(2) is not able to be provided, subsection 9(4) sets out requirements in relation to providing further information in the specified way.\n\n9  Way in which a cyber security incident report is made\n\n (1) A cyber security incident report must be made online via the Australian Cyber Security Centre’s reporting portal.\n\nNote: The Australian Cyber Security Centre’s reporting portal can be accessed via Report | Cyber.gov.au as on the commencement day of this instrument.\n\n (2) If a cyber security incident report is made in accordance with subsection (1), and the industry participant has not given consent to share the cyber security incident report with the Secretary, the information specified in section 8 must be submitted to the Secretary online via the Department’s form:\n\n  https://www.homeaffairs.gov.au/help-and-support/ departmental-forms/online-forms/maritime-security-incident-report-form.\n\n (3) If a report is made to the Secretary in the way specified in subsection (2), this is to be done as soon as possible after the incident is identified, and in any event within:\n\n (a) 12 hours of the industry participant becoming aware of the incident, if it is a significant cyber security incident; or\n\n (b) 72 hours of an industry participant becoming aware of the incident, if it is a relevant cyber security incident.\n\n (4) If at the time of making a cyber security incident report, the industry participant does not have any, or part, of the information required under section 8, but subsequently obtains that information, the industry participant must provide that information in a report by the way specified in subsection (1) as soon as possible, but not later than 24 hours after obtaining the information.\n\n (5) If information is provided in accordance with subsection (4), and consent is not given to share the information with the Secretary, the information must be provided to the Secretary in the way specified in subsection (2) as soon as possible, but no later than 24 hours after the industry participant obtains the information.\n\n \n\nPart 3—Transitional and application provisions\n\n10  Reporting requirements—application\n\n  This instrument applies in relation to:\n\n (a) a report made in accordance with Division 4 of Part 9 of the Act (a Division 4 report) on or after the day this instrument commences; and\n\n (b) if additional information is to be provided to the Secretary in connection with a Division 4 report made before this instrument commences—that additional information.\n\n\n\n\nSchedule 1—Repeals\n\nMaritime Transport and Offshore Facilities Security (Incident Reporting) Instrument 2018\n\n1  The whole of the instrument\n\nRepeal the instrument.\n","sortOrder":0}],"analysis":{"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"The instrument maintains its original scope of setting incident reporting requirements for maritime security. While it adds cyber security reporting (reflecting evolving threats), this is within the existing framework of the parent Act and represents a natural evolution rather than scope creep."},"complexity_factors":["Multiple reporting pathways with different timeframes (24 hours for physical security, 12/72 hours for cyber)","Conditional logic for cyber incidents based on consent to share information with Secretary","Nested requirements: general reporting requirements (subsection 6(2)) plus 6 conditional additional requirements (subsections 6(3)-(8))","Cross-referencing to parent Act (Maritime Transport and Offshore Facilities Security Act 2003) for defined terms","Dual reporting mechanism for cyber incidents requiring potential duplicate submission if consent not given","Transitional provision applying to both new reports and supplemental information for old reports"],"plain_english_summary":"This instrument requires maritime industry participants (ports, ships, offshore facilities) to report physical security incidents to Home Affairs and cyber incidents to the Australian Cyber Security Centre, so government can respond to threats to ports and offshore infrastructure. Physical incidents must be reported within 24 hours; cyber incidents within 12 hours for significant events and 72 hours for relevant ones, with procedures if ACSC sharing to Home Affairs is not consented. It updates and replaces the 2018 rules."},"flash_summary":{"complexity_score":4,"scope_assessment":{"changed":true,"description":"This instrument repeals the Maritime Transport and Offshore Facilities Security (Incident Reporting) Instrument 2018 (Schedule 1) and replaces it with a new, detailed reporting framework specifying required report content, channels and timelines for security and cyber incidents (ss6–9). The instrument therefore replaces the prior reporting instrument; any substantive differences from the 2018 instrument are not described within this text."},"complexity_factors":["Prescriptive content requirements for different incident types (security incidents: s6; cyber incidents: s8).","Multiple reporting channels and conditional follow-ups (phone, online form, email; ss7(3)–(4); s9(1)–(2)).","Different deadlines for cyber reports depending on severity (significant: 12 hours; relevant: 72 hours; s9(3)).","Obligation to supply missing or subsequent information within 24 hours after obtaining it (ss7(2), 9(4)–(5)).","Cross-agency interaction and consent rules when using the ACSC portal and sharing with the Secretary (s9(1)–(2)).","Complete repeal and replacement of the 2018 instrument (Schedule 1) — requires administrators and industry to adjust to the new form and timings."],"plain_english_summary":"This Instrument requires maritime industry participants to report security incidents and cyber security incidents to the Department of Home Affairs or the Australian Cyber Security Centre, specifying precise content, methods and deadlines for reports (ss6–9). \n\nIt applies to ships, offshore facilities and industry participants and creates a compliance task: provide detailed factual data and any follow-up information within set timeframes, with the Secretary receiving and managing reports (see ss6–9; reporting channels at ss7 and s9)."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"}},"importantCases":[],"_links":{"self":"/api/acts/maritime-transport-and-offshore-facilities-security-incident-reporting-instrument-2026","history":"/api/acts/maritime-transport-and-offshore-facilities-security-incident-reporting-instrument-2026/history","analysis":"/api/acts/maritime-transport-and-offshore-facilities-security-incident-reporting-instrument-2026/analysis","conflicts":"/api/acts/maritime-transport-and-offshore-facilities-security-incident-reporting-instrument-2026/conflicts","importantCases":"/api/acts/maritime-transport-and-offshore-facilities-security-incident-reporting-instrument-2026/important-cases","documents":"/api/acts/maritime-transport-and-offshore-facilities-security-incident-reporting-instrument-2026/documents"}}