{"id":"F2022L00562","name":"Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022","slug":"security-of-critical-infrastructure-application-rules-lin-22-026-2022","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":102392,"registerId":"commonwealth-F2022L00562-current","compilationNumber":null,"startDate":"2026-04-03","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Name","content":"#### 1 Name\n\n  This instrument is the Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022.","sortOrder":0},{"sectionNumber":"3","sectionType":"section","heading":"Definitions","content":"#### 3 Definitions\n\n  In this instrument:\n\n> Act means the Security of Critical Infrastructure Act 2018.\n\n> Aviation Transport Security Act means the Aviation Transport Security Act 2004.\n\n> Aviation Transport Security Regulations means the Aviation Transport Security Regulations 2005.\n\n> cargo terminal and cargo terminal operator have the meaning given by section 102B of the Customs Act 1901.\n\n> designated airport has the same meaning as in regulation 3.01B of the Aviation Transport Security Regulations.\n\n> prescribed air service has the meaning given by section 9 of the Aviation Transport Security Act.\n\n> regulated air cargo agent has the meaning given by regulation 4.42 of the Aviation Transport Security Regulations.\n\n> relevant carriage service provider asset is a critical infrastructure asset owned or operated by a carriage service provider where:\n\n    (a) the asset is used in connection with the supply of at least 20,000 active total carriage services including any of the following:\n    (i) broadband services;\n    (ii) fixed telephone services;\n    (iii) public mobile telecommunications services;\n    (iv) voice only services; or\n    (b) the responsible entity for the asset is aware that the asset is used in connection with carriage services supplied to a Commonwealth entity (other than a body corporate established by a law of the Commonwealth).\n\n> screened air service has the meaning given by regulation 4.02 of the Aviation Transport Security Regulations.\n\n> Note Expressions used in this instrument have the same meaning as in the Act from time to time—Legislation Act 2003, paragraph 13(1)(b).","sortOrder":1},{"sectionNumber":"4","sectionType":"section","heading":"Application of Part 2 of the Act","content":"#### 4 Application of Part 2 of the Act\n\n  (1) For paragraph 18A(1)(a) of the Act, each of the following assets, other than an asset mentioned in subsection (2), is specified:\n    (a) a critical broadcasting asset;\n    (b) a critical domain name system;\n    (c) a critical data storage or processing asset;\n    (d) a critical financial market infrastructure asset that is a payment system;\n    (e) a critical food and grocery asset;\n    (f) a critical hospital;\n    (g) a critical freight infrastructure asset;\n    (h) a critical freight services asset;\n    (i) a critical public transport asset;\n    (j) a critical liquid fuel asset;\n    (k) a critical energy market operator asset;\n    (l) a critical electricity asset that was not a critical infrastructure asset immediately before the commencement of section 18A of the Act;\n    (m) a critical gas asset that was not a critical infrastructure asset immediately before the commencement of section 18A of the Act;\n    (n) a critical telecommunications asset that is:\n    (i) owned or operated by a carrier; or\n    (ii) relevant carriage service provider asset.\n\n> Note 1 Under section 18A(1)(c) of the Act, Part 2 of the Act continues to apply to critical infrastructure assets that were critical infrastructure assets immediately before the commencement of section 18A.\n\n> Note 2 A data storage system that meets all of the requirements under subsection 9(7) of the Act in respect of a critical infrastructure asset specified in subsection (1) is taken to be part of the critical infrastructure asset.\n\n  (2) An asset mentioned in an item the following table that is owned or operated by the entity mentioned in the item.\n\n| Item | Asset                                                   | Entity                                                   |\n| ---- | ------------------------------------------------------- | -------------------------------------------------------- |\n| 1    | Invicta Sugar Mill, Giru, Queensland                    | The Haughton Sugar Company Pty Ltd (ABN: 65 009 656 062) |\n| 2    | Pioneer Sugar Mill, Brandon, Queensland                 | Pioneer Sugar Mills Pty Ltd (ABN: 63009889856)           |\n| 3    | Racecourse Sugar Mill, Racecourse, Mackay, Queensland   | Mackay Sugar Ltd (ABN: 12 057 463 671)                   |\n| 4    | South Johnstone Sugar Mill, South Johnstone, Queensland | MSF Sugar Pty Ltd (ABN: 11 009 658 708)                  |\n\n  Grace period\n  (3) For subsection 18A(3) of the Act, Part 2 of the Act does not apply to an asset mentioned in subsection (1) during the period beginning when the asset became a critical infrastructure asset and ending at the later of:\n    (a) 6 months after the commencement of this instrument; and\n    (b) 6 months after the asset became a critical infrastructure asset mentioned in subsection (1).","sortOrder":2},{"sectionNumber":"5","sectionType":"section","heading":"Application of Part 2B of the Act","content":"#### 5 Application of Part 2B of the Act\n\n  (1) For paragraph 30BB(1)(a) of the Act, each of the following assets, other than an asset mentioned in subsection (3) and (4), is specified:\n    (a) a critical broadcasting asset;\n    (b) a critical domain name system;\n    (c) a critical data storage or processing asset;\n    (d) a critical banking asset;\n    (e) a critical superannuation asset;\n    (f) a critical insurance asset;\n    (g) a critical financial market infrastructure asset;\n    (h) a critical food and grocery asset;\n    (i) a critical hospital;\n    (j) a critical education asset;\n    (k) a critical freight infrastructure asset;\n    (l) a critical freight services asset;\n    (m) a critical public transport asset;\n    (n) a critical liquid fuel asset;\n    (o) a critical energy market operator asset;\n    (p) a critical aviation asset mentioned in subsection (2);\n    (q) a critical port;\n    (r) a critical electricity asset;\n    (s) a critical gas asset;\n    (t) a critical water asset.\n    (u) a critical telecommunications asset that is:\n    (i) owned or operated by a carrier; or\n    (ii) a relevant carriage service provider asset.\n\n> Note A data storage system that meets all of the requirements under subsection 9(7) of the Act in respect of a critical infrastructure asset specified in subsection (1) is taken to be part of the critical infrastructure asset.\n\n  (2) A critical aviation asset that is any of the following:\n    (a) a designated airport;\n    (b) an asset used to perform an Australian prescribed air service operating screened air services that depart from a designated airport;\n    (c) a cargo terminal that:\n    (i) is owned or operated by a regulated air cargo agent that is also a cargo terminal operator; and\n    (ii) is located at a designated airport.\n  (3) An asset mentioned in an item the following table that is owned or operated by the entity mentioned in the item.\n\n| Item | Asset                                                   | Entity                                                   |\n| ---- | ------------------------------------------------------- | -------------------------------------------------------- |\n| 1    | Invicta Sugar Mill, Giru, Queensland                    | The Haughton Sugar Company Pty Ltd (ABN: 65 009 656 062) |\n| 2    | Pioneer Sugar Mill, Brandon, Queensland                 | Pioneer Sugar Mills Pty Ltd (ABN: 63009889856)           |\n| 3    | Racecourse Sugar Mill, Racecourse, Mackay, Queensland   | Mackay Sugar Ltd (ABN: 12 057 463 671)                   |\n| 4    | South Johnstone Sugar Mill, South Johnstone, Queensland | MSF Sugar Pty Ltd (ABN: 11 009 658 708)                  |\n\n  (4) An asset that:\n    (a) on or after the commencement of Part 1 of Schedule 3 to the Transport Security Amendment (Critical Infrastructure) Act 2022—is a critical aviation asset; or\n    (b) on or after the commencement of Part 2 of Schedule 3 to the Transport Security Amendment (Critical Infrastructure) Act 2022—is a critical maritime asset.\n  Grace period\n  (5) For subsection 30BB(3) of the Act, Part 2B of the Act does not apply to an asset mentioned in subsection (1) during the period beginning when the asset became a critical infrastructure asset and ending at the later of:\n    (a) 3 months after the commencement of this instrument; and\n    (b) 3 months after the asset became a critical infrastructure asset mentioned in subsection (1).","sortOrder":3}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"This instrument appears to be operating within its original intended scope as an application/specification instrument under the Security of Critical Infrastructure Act 2018. It performs the standard function of designating which assets fall under Parts 2 and 2B, including standard exemptions and grace periods. There is no evidence of scope creep beyond the original purpose of operationalising the parent Act's framework."},"complexity_factors":["11 defined terms in section 3, many referencing external legislation (Aviation Transport Security Act, Customs Act, etc.)","Nested conditional logic: exemptions apply 'other than an asset mentioned in subsection (2)' with cross-references to tables","Temporal conditions: grace periods depend on 'the later of' two dates involving commencement times and asset classification times","External legislative dependencies: definitions rely on 4+ other Acts/Regulations including Aviation Transport Security Regulations and Transport Security Amendment (Critical Infrastructure) Act 2022","Dual regime application: distinguishes between Part 2 and Part 2B with different asset lists and grace periods","Specific entity carve-outs: table-based exemptions for 4 named sugar mills with specific ABNs"],"plain_english_summary":"This instrument specifies which critical infrastructure assets fall under the Security of Critical Infrastructure Act 2018, deciding who must register, report incidents, and meet enhanced cyber-security rules. It brings major providers across energy, health, finance, telecoms, transport and supply chains within scope, sets carve-outs (notably four Queensland sugar mills), and imposes short compliance grace periods. Thresholds limit coverage of small telecoms and some aviation/maritime assets already covered by other transport laws."},"flash_summary":{"complexity_score":7,"scope_assessment":{"changed":true,"description":"This instrument expands and clarifies which assets Part 2 and Part 2B of the Act apply to by listing many categories (see subsection 4(1) and 5(1)) and by expressly including certain aviation-related assets (subsection 5(2)) and carriage-service provider assets meeting a 20,000-service threshold or used for Commonwealth supply (definition of 'relevant carriage service provider asset'). It also creates targeted exceptions for four named sugar mills (subsections 4(2) and 5(3)) and delays application for identified assets via grace periods (6 months for Part 2 in subsection 4(3); 3 months for Part 2B in subsection 5(5)). These changes shift the universe of entities that will face notification and risk-management obligations under the Act and introduce transitional timing rules."},"complexity_factors":["Extensive cross-references to the principal Act and multiple transport security instruments (Act; Aviation Transport Security Act and Regulations), increasing interpretive dependencies.","Broad lists of asset categories with overlapping sectors (telecoms, energy, transport, financial, data, food, health), raising boundary questions about which installations qualify.","Specific quantitative threshold for 'relevant carriage service provider asset' (used in connection with supply of at least 20,000 active total carriage services) plus a subjective trigger (responsible entity’s awareness of supply to a Commonwealth entity).","Different treatment between Part 2 and Part 2B (different asset lists and aviation-specific inclusions), requiring separate compliance mapping.","Explicit carve-outs listing four named sugar mills (subsections 4(2) and 5(3)), creating narrow exceptions that must be checked against ownership/operator details.","Staggered grace periods: 6 months for Part 2 specified assets (subsection 4(3)) and 3 months for Part 2B specified assets (subsection 5(5)), adding transitional compliance timing.","Inclusion of data storage systems as part of an asset if they meet subsection 9(7) of the Act, tying application to technical criteria elsewhere in the Act.","Specific aviation-related inclusions (designated airports, screened air services, regulated air cargo operator cargo terminals) that import definitions from aviation regulations (subsection 5(2)).","Clauses that extend coverage to assets that were not previously designated immediately before the commencement of particular sections (subsections 4(1)(l),(m) and 5(4)), requiring historic status checks."],"plain_english_summary":"This instrument says which kinds of infrastructure are covered by Parts 2 and 2B of the Security of Critical Infrastructure Act — for example broadcasting, data storage/processing, certain telecoms and transport assets, energy, water and financial market infrastructure — and which specific aviation and carriage-provider assets are included. It also creates short grace periods before obligations begin and carves out four named sugar mills. Owners and operators of specified assets will therefore become subject to the Act’s notification and risk-management rules."}},"importantCases":[],"_links":{"self":"/api/acts/security-of-critical-infrastructure-application-rules-lin-22-026-2022","history":"/api/acts/security-of-critical-infrastructure-application-rules-lin-22-026-2022/history","analysis":"/api/acts/security-of-critical-infrastructure-application-rules-lin-22-026-2022/analysis","conflicts":"/api/acts/security-of-critical-infrastructure-application-rules-lin-22-026-2022/conflicts","importantCases":"/api/acts/security-of-critical-infrastructure-application-rules-lin-22-026-2022/important-cases","documents":"/api/acts/security-of-critical-infrastructure-application-rules-lin-22-026-2022/documents"}}