{"id":"F2021L01769","name":"Security of Critical Infrastructure (Definitions) Rules (LIN 21/039) 2021","slug":"security-of-critical-infrastructure-definitions-rules-lin-21-039-2021","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":102213,"registerId":"commonwealth-F2021L01769-current","compilationNumber":null,"startDate":"2026-04-03","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Preliminary","content":"## Part 1 Preliminary\n\n1 Name\n\nThis instrument is the Security of Critical Infrastructure (Definitions) Rules (LIN 21/039) 2021.\n\n3 Definitions\n\n(1) In this instrument:\n\n> .au ccTLD system means the system used in providing the ‘.au’ country code Top Level Domain (ccTLD) internet service.\n\n> Act means the Security of Critical Infrastructure Act 2018.\n\n> Australian Register of Therapeutic Goods means the Australian Register of Therapeutic Goods maintained under section 9A of the Therapeutic Goods Act.\n\n> authoritative DNS name server means a computer server that provides authoritative DNS information about a domain name, which may include the Internet Protocol address of a website server or an email server.\n\n> Cash Market Product has the meaning given by section 1.4.3 of the ASIC Market Integrity Rules (Securities Markets) 2017.\n\n> Corporations Act means the Corporations Act 2001.\n\n> DNS means a domain name system, which is a component of the Internet that enables users to find and connect to local websites, email addresses and other Internet connected resources by mapping domain names to their corresponding Internet Protocol numeric addresses.\n\n> DNSSEC means DNS Security Extensions that facilitate the digital signing of DNS records, to assist in ensuring the integrity and authenticity of DNS information.\n\n> Futures Market Contract has meaning given by section 1.4.3 of the ASIC Market Integrity Rules (Futures Markets) 2017.\n\n> nameplate rating for a gas transmission pipeline, means the maximum quantity of natural gas that can be transported through the pipeline on a day under normal operating conditions.\n\n> quarter means any of the following periods of a year:\n\n(a) between 1 January and 31 March;\n\n(b) between 1 April and 30 June;\n\n(c) between 1 July and 30 September;\n\n(d) between 1 October and 31 December.\n\n> registrant information includes:\n\n(a) registrant legal entity name;\n\n(b) registrant identification number;\n\n(c) eligibility type;\n\n(d) eligibility name;\n\n(e) eligibility identification.\n\n> registrable superannuation entity has the same meaning as in the Superannuation Industry (Supervision) Act 1993.\n\n> smart meter means a meter that measures, and remotely communicates information relating to, the usage of any product that is produced or supplied by a critical infrastructure asset.\n\n> system restart ancillary service has the meaning given by subsection 5(2).\n\n> Therapeutic Goods Act means the Therapeutic Goods Act 1989.\n\n> WHOIS service means a service or tool that provides domain information, including (any of) the following:\n\n(a) domain registrar;\n\n(b) registrar contact information;\n\n(c) domain name status;\n\n(d) DNS name servers;\n\n(e) IP addresses of DNS name servers;\n\n(f) DNSSEC information;\n\n(g) registrant information;\n\n(h) registrant contact information;\n\n(i) technical contact information.\n\n> Note A number of expressions used in this instrument are defined in the Act, and those expressions have the same meaning in this instrument—see Legislation Act 2003, s. 13.\n\n(2) The following terms have the meaning given in section 3 of Therapeutic Goods Act:\n\n(a) current Poisons Standard;\n\n(b) medical device.","sortOrder":0},{"sectionNumber":"Part 2","sectionType":"part","heading":"Matters relating to definitions in the Act","content":"## Part 2 Matters relating to definitions in the Act\n\nDivision 2.1 Classes of critical infrastructure asset\n\n5 Critical electricity asset\n\n(1) For subsection 10(2) of the Act, an electricity generation station is critical to ensuring the security and reliability of electricity networks or electricity systems in a State or Territory if:\n\n(a) either:\n\n(i) the entity that owns or operates it is contracted to provide a system restart ancillary service in the State or Territory; or\n\n(ii) it is an electricity generator, in the State or Territory, that has an installed capacity of at least 30 megawatts; and\n\n(b) it is connected to a wholesale electricity market.\n\n(2) An electricity generation station provides a system restart ancillary service if it can:\n\n(a) start without an external power supply; and\n\n(b) connect, and provide energy, to an electricity network or an electricity system for the transmission or distribution of electricity.\n\n6 Critical gas asset\n\n(1) For paragraph 12(2)(a) of the Act, the following gas transmission pipelines are critical to ensuring the security and reliability of a gas market:\n\n(a) the Tasmanian Gas Pipeline;\n\n(b) the Carpentaria Gas Pipeline.\n\n(2) For paragraph 12(2)(b) of the Act, a gas transmission pipeline in a gas market mentioned in an item in the following table is critical to ensuring the security and reliability of a gas market if it has at least the nameplate rating mentioned in the item for the gas market:\n\n| Item | Gas market | Nameplate rating       |\n| ---- | ---------- | ---------------------- |\n| 1    | Eastern    | 200 terajoules per day |\n| 2    | Northern   | 80 terajoules per day  |\n| 3    | Western    | 150 terajoules per day |\n\n7 Critical liquid fuel asset\n\n(1) For paragraph 12A(2)(a) of the Act, the liquid fuel refineries at the following locations are critical to ensuring the security and reliability of a liquid fuel market:\n\n(a) Corio, Victoria;\n\n(b) Lytton, Queensland.\n\n(2) For paragraph 12A(3)(a) of the Act, the following liquid fuel pipelines are critical to ensuring the security and reliability of a liquid fuel market:\n\n(a) Sydney Metropolitan Pipeline;\n\n(b) Gore Bay Pipeline;\n\n(c) Westernport Altona Geelong Pipeline;\n\n(d) Longford (Dutson) to Hastings Pipeline;\n\n(e) Melbourne Airport Jet Fuel Pipelines;\n\n(f) Jet Fuel Pipeline (Kurnell to Sydney Airport);\n\n(g) Brisbane Airport Jet Fuel Pipeline;\n\n(h) Perth Airport Jet Fuel Pipeline.\n\n(3) For paragraph 12A(4)(b) of the Act, a liquid fuel storage facility is critical to ensuring the security and reliability of a liquid fuel market if it has a storage capacity of more than 50 megalitres of liquid fuel.\n\n8 Critical freight infrastructure asset\n\n(1) For paragraph 12B(4)(a) of the Act, an intermodal transfer facility at a location mentioned in an item of Schedule 1 that is owned or operated by the entity mentioned in the item is critical to the transportation of goods between:\n\n(a) 2 States;\n\n(b) a State and a Territory; or\n\n(c) 2 Territories; or\n\n(d) 2 regional centres.\n\n(2) For paragraph 12L(18)(e) of the Act, the entity mentioned in an item of the table in Schedule 1 is the responsible entity for the asset mentioned in the item.\n\n9 Critical freight services asset\n\nFor paragraph 12C(2)(b) of the Act, a business is critical to the transportation of goods by road, rail, inland waters or sea if:\n\n(a) the business has an annual revenue of at least $150 million; and\n\n(b) the business provides a service (a freight service) that is:\n\n(i) a road freight transport service; or\n\n(ii) a freight forwarding service; or\n\n(iii) a rail freight transport service; or\n\n(iv) a water freight service; and\n\n(c) the freight service provided by the business involves the transport or storage of any of the following:\n\n(i) food and groceries, where transported to or from a critical supermarket retailer or a critical grocery wholesaler;\n\n(ii) therapeutic goods registered on the Australian Register of Therapeutic Goods moved to or from premises storing such goods;\n\n(iii) the supply of medicines listed under Schedules 2, 3, 4 or 8 of Part 4 of the current Poisons Standard, where transported to or from a premises at which the manufacture of the medicine is permitted under a law of a State or Territory;\n\n(iv) liquid fuel, where transported to or from a critical liquid fuel asset;\n\n(v) essential goods and supplies required for water treatment facilities;\n\n(vi) any other good that is critical for the operation, maintenance or management of a critical infrastructure asset.\n\n10 Critical financial market infrastructure asset\n\nFinancial market\n\n(1) For paragraph 12D(2)(b) of the Act, a financial market is critical to the security and reliability of the financial services and markets sector if it:\n\n(a) is operated by an entity that holds a Tier 1 market licence under subsection 795B(1) of the Corporations Act; and\n\n(b) has, for at least 2 consecutive quarters, a turnover that meets any of the following:\n\n(i) 35% market share of traded Cash Market Products;\n\n(ii) $4 billion average daily value of traded Cash Market Products;\n\n(iii) $15 billion average daily notional value of Futures Market Contract transactions;\n\n(iv) $30 billion average daily notional value of transactions that are not Cash Market Products or Futures Market Contracts.\n\n> Note 1 Cash Market Product has the meaning given by the ASIC Market Integrity Rules (Securities Markets) 2017—see section 3.\n\n> Note 2 Futures Market Contract has the meaning given by the ASIC Market Integrity Rules (Futures Markets) 2017—see section 3.\n\nClearing and settlement facility\n\n(2) For paragraph 12D(3)(b) of the Act, a clearing and settlement facility is critical to the security and reliability of the financial services and markets sector if it is owned or operated by an Australian body corporate or an associated entity of an Australian body corporate that is required to comply with the financial stability standards determined by the Reserve Bank of Australia under section 827D of the Corporations Act:\n\nSignificant financial benchmark\n\n(3) For paragraph 12D(4)(b) of the Act, a significant financial benchmark is critical to the security and reliability of the financial services and markets sector if it is declared under section 908AC(2) of the Corporations Act.\n\nDerivative trade repository\n\n(4) For paragraph 12D(5)(b) of the Act, a derivative trade repository is critical to the security and reliability of the financial services and markets sector if it has at least $20 trillion average daily notional value of outstanding transactions for all asset classes for at least 2 consecutive quarters.\n\nPayment system\n\n(5) For paragraphs 12D(6)(a) and 12L(8)(i) of the Act:\n\n(a) a payment system mentioned in an item of the following table is critical to the security and reliability of the financial services and markets sector; and\n\n(b) the entity mentioned in the item is the responsible entity for the payment system.\n\n| Item | Payment system                          | Responsible entity                                             |\n| ---- | --------------------------------------- | -------------------------------------------------------------- |\n| 1    | Mastercard debit and credit card system | Mastercard Asia/Pacific Australia Pty Ltd (ABN 95 108 603 345) |\n| 2    | Visa debit and credit card system       | Visa AP (Australia) Pty Ltd (ABN: 20 134 885 564)              |\n| 3    | EFTPOS card system                      | eftpos Payments Australia Limited (ABN: 37 136 180 366)        |\n| 4    | New Payments Platform                   | NPP Australia Limited (ABN: 68 601 428 737)                    |\n\n11 Critical broadcasting asset\n\nFor paragraph 12E(3)(a) of the Act, TX Australia Pty Ltd (ABN 98 086 979 339) is critical to the transmission of a broadcasting service.\n\n12 Critical banking asset\n\n(1) For paragraph 12G(2)(b) of the Act, an authorised deposit-taking institution is critical to the security and reliability of the financial services and markets sector if it has assets over $50 billion.\n\n(2) For paragraph 12G(3)(b) of the Act, a body corporate is critical to the security and reliability of the financial services and markets sector if it has assets over $50 billion.\n\n13 Critical insurance asset\n\n(1) For paragraph 12H(2)(b) of the Act, an entity is critical to the security and reliability of the financial services and markets sector if it has assets over $2 billion.\n\n(2) For paragraph 12H(3)(b) of the Act, a body corporate is critical to the security and reliability of the financial services and markets sector if it has assets over $2 billion.\n\nLife insurance\n\n(3) For paragraph 12H(4)(b) of the Act, an entity is critical to the security and reliability of the financial services and markets sector if it has assets over $5 billion.\n\n(4) For paragraph 12H(5)(b) of the Act, a body corporate is critical to the security and reliability of the financial services and markets sector if it has assets over $5 billion.\n\nHealth insurance\n\n(5) For paragraph 12H(6)(b) of the Act, an entity is critical to the security and reliability of the financial services and markets sector if it has assets over $500 million.\n\n(6) For paragraph 12H(7)(b) of the Act, a body corporate is critical to the security and reliability of the financial services and markets sector if it has assets over $500 million.\n\n14 Critical superannuation asset\n\nFor paragraph 12J(2)(b) of the Act, an RSE licensee is critical to the security and reliability of the financial services and markets sector if it is a trustee of a registrable superannuation entity that has assets over $20 billion.\n\n15 Critical food and grocery asset\n\n(1) For paragraph 12K(2)(a) of the Act, each of the following entities is a critical supermarket retailer:\n\n(a) Aldi Pty Limited (ABN 68 086 493 950);\n\n(b) Coles Group Limited (ABN 11 004 089 936);\n\n(c) Woolworths Group Limited (ABN 88 000 014 675).\n\n(2) For paragraph 12K(4)(a) of the Act, MetCash Trading Limited (ABN 61 000 031 569) is a critical grocery wholesaler.\n\n16 Critical domain name system\n\n(1) For paragraph 12KA(2)(a) of the Act, .au Domain Administration Ltd (ABN 38 079 009 340) is critical to the administration of an Australian domain name system.\n\n(2) For paragraph 12KA(2)(b) of the Act, an entity that administers the .au ccTLD system is critical to the administration of an Australian domain name system.\n\n(3) For paragraph 12KA(3)(a) of the Act, the following assets within the .au ccTLD system are critical to the administration of an Australian domain name system:\n\n(a) registry database;\n\n(b) public WHOIS service ([https://whois.auda.org.au/](https://whois.auda.org.au/));\n\n(c) .au top level authoritative DNS name servers;\n\n(d) the following second level authoritative DNS name servers:\n\n(i) .com.au;\n\n(ii) .net.au;\n\n(iii) .org.au;\n\n(iv) .asn.au;\n\n(v) .id.au;\n\n(vi) .edu.au;\n\n(vii) .gov.au.\n\nDivision 2.2 Other definitions\n\n17 Operational information\n\n(1) For paragraph 7(1)(f) of the Act, the data for which a description of the arrangements under which it is maintained is data that:\n\n(a) relates to a critical infrastructure asset; and\n\n(b) is maintained by an entity that is not the responsible entity for the asset; and\n\n(c) is any of the following kinds:\n\n(i) personal information, within the meaning of the Privacy Act 1988, of at least 20,000 persons;\n\n(ii) sensitive information, within the meaning of that Act;\n\n(iii) information about any research and development related to the asset;\n\n(iv) information about any systems needed to operate the asset;\n\n(v) information about risk management and business continuity (however described) for the asset;\n\n(vi) for a critical infrastructure asset mentioned in an item of the following table—information about the matter mentioned in the item for the asset.\n\n| Item | Critical infrastructure asset                  | Information                                                                                                                                                                                                                                              |\n| ---- | ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| 1    | critical electricity asset                     | consumers’ consumption of electricity or any other product that is produced or supplied by the asset, including data communicated by a smart meter                                                                                                       |\n| 2    | critical water asset                           | consumers’ consumption of water or any other product that is produced or supplied by the asset, including data communicated by a smart meter                                                                                                             |\n| 3    | critical gas asset                             | consumers’ consumption of gas or any other product that is produced or supplied by the asset, including data communicated by a smart meter                                                                                                               |\n| 4    | critical telecommunications asset              | consumers’ consumption of telecommunication carriage services or any other product that is produced or supplied by the asset, including capturing telecommunications networks and facilities owned or operated by carriers or carriage service providers |\n| 5    | critical broadcasting asset                    | consumers’ consumption of television and radio services that is produced or supplied by the asset                                                                                                                                                        |\n| 6    | critical data storage or processing asset      | consumers’ consumption of data storage or processing services that is produced or supplied by the asset                                                                                                                                                  |\n| 7    | critical domain name system                    | consumers’ queries of domain names or Internet protocol addresses                                                                                                                                                                                        |\n| 8    | critical financial market infrastructure asset | consumers; consumption of payment system services produced or supplied by the asset                                                                                                                                                                      |\n| 9    | critical food and grocery asset                | consumers’ consumption of food and groceries that is produced or supplied by the asset                                                                                                                                                                   |\n| 10   | critical hospital                              | patients’ use of intensive care units that is produced or supplied by the asset                                                                                                                                                                          |\n| 11   | critical port                                  | traffic and cargo received by the asset                                                                                                                                                                                                                  |\n| 12   | critical freight services asset                | consumers’ consumption of freight services produced or supplied by the asset                                                                                                                                                                             |\n| 13   | critical freight infrastructure asset          | traffic and cargo that is produced or supplied by the asset                                                                                                                                                                                              |\n| 14   | critical liquid fuel asset                     | consumers’ consumption of liquid fuel that is produced or supplied by the asset                                                                                                                                                                          |\n| 15   | critical energy market operator asset          | consumers’ consumption of energy across the market                                                                                                                                                                                                       |\n| 16   | critical public transport asset                | passenger trips made in relation to the services produced or supplied by the asset                                                                                                                                                                       |\n\n(2) The description of the arrangements must include:\n\n(a) the name of the entity that maintains the data; and\n\n(b) if that entity is not the responsible entity for the asset:\n\n(i) any ABN, or other similar business number (however described), of the entity if the entity was incorporated, formed or created (however described) outside Australia; and\n\n(ii) the address of the entity’s head office or principal place of business; and\n\n(iii) the country in which the entity was incorporated, formed or created (however described); and\n\n(c) the address where the data is held, including, to the extent practicable, the address where computers or servers holding the data are located, whether or not the computers or servers are part of a cloud service; and\n\n(d) for data held using a cloud service—the name of the cloud service; and\n\n(e) the kind of data mentioned in paragraph (2)(c) that the entity maintains.\n\n18 Relevant Commonwealth body\n\n(1) For paragraph 30BF(a) of the Act, the Department is specified as a relevant Commonwealth body.\n\n(2) Subsection (1) only applies for subsections 30BC(5) and 30BD(5) of the Act.\n\n> Note For other provisions in Part 2B of the Act, the relevant Commonwealth body is ASD.\n\nDivision 2.3 Assets that are not critical infrastructure assets\n\n19 Sugar mills\n\n(1) For paragraph 9(2)(j) of the Act, a critical electricity asset mentioned in subsection (2) is not a critical infrastructure asset.\n\n(2) An asset mentioned in an item in the following table that is owned or operated by the entity mentioned in the item.\n\n| Item | Asset                                                   | Entity                                                   |\n| ---- | ------------------------------------------------------- | -------------------------------------------------------- |\n| 1    | Invicta Sugar Mill, Giru, Queensland                    | The Haughton Sugar Company Pty Ltd (ABN: 65 009 656 062) |\n| 2    | Pioneer Sugar Mill, Brandon, Queensland                 | Pioneer Sugar Mills Pty Ltd (ABN: 63009889856)           |\n| 3    | Racecourse Sugar Mill, Racecourse, Mackay, Queensland   | Mackay Sugar Ltd (ABN: 12 057 463 671)                   |\n| 4    | South Johnstone Sugar Mill, South Johnstone, Queensland | MSF Sugar Pty Ltd (ABN: 11 009 658 708)                  |\n\n  \n\nSchedule 1 Intermodal transfer facilities\n\n(section 8)\n\n| Item | Location of intermodal transfer facility | Entity                                                                                                                  |\n| ---- | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |\n| 1    | Chullora, New South Wales                | Pacific National (ABN 48 052 134 362)                                                                                   |\n| 2    | Parkes, New South Wales                  | (a) Pacific National (ABN 50 105 300 767);(b) SCT Logistics (ABN 37 757 194 158); and(c) Linfox (ABN 24 121 216 724)    |\n| 3    | Altona, Victoria                         | SCT Logistics (ABN 37 757 194 158)                                                                                      |\n| 4    | Barnawartha, Victoria                    | SCT Logistics (ABN 37 757 194 158)                                                                                      |\n| 5    | Dynon—North, Victoria                    | (a) QUBE Logistics (Victoria) Pty Ltd (ABN 72 092 352 228); and(b) Victorian Rail Track (VicTrack) (ABN 55 047 316 805) |\n| 6    | Dynon—South, Victoria                    | Pacific National (ABN 48 052 134 362)                                                                                   |\n| 7    | Acacia Ridge, Queensland                 | Pacific National (ABN 26 615 302 111)                                                                                   |\n| 8    | Bromelton, Queensland                    | SCT Logistics (ABN 37 757 194 158)                                                                                      |\n| 9    | Townsville, Queensland                   | Linfox (ABN 87 648 327 413)                                                                                             |\n| 10   | Islington, South Australia               | Pacific National (ABN 48 052 134 362)                                                                                   |\n| 11   | Penfield, South Australia                | SCT Logistics (ABN 37 757 194 158)                                                                                      |\n| 12   | Forrestfield, Western Australia          | SCT Logistics (ABN 37 757 194 158)                                                                                      |\n| 12A  | Kewdale-Welshpool, Western Australia     | Pacific National (ABN 48 052 134 362)                                                                                   |\n| 13   | Brighton Transport Hub, Tasmania         | (a) Tasmanian Railway Pty Ltd (ABN 83 139 383 761); and(b) IPEC Pty Limited (ABN 15 084 157 666)                        |","sortOrder":1}],"analysis":{"kimi_summary":{"content_quality":"ok","complexity_score":6,"scope_assessment":{"changed":false,"description":"This instrument appears to be operating within its original intended scope as a definitional and specification instrument under the Security of Critical Infrastructure Act 2018. It does not appear to have expanded beyond the original purpose of detailing which assets fall under the Act's coverage. The inclusion of specific named entities (sugar mills, specific freight facilities) and detailed technical thresholds is consistent with the legislative intent to provide certainty through delegated legislation rather than primary legislation amendments."},"complexity_factors":["Extensive cross-referencing to primary legislation (Security of Critical Infrastructure Act 2018) and other statutes (Corporations Act, Therapeutic Goods Act, Superannuation Industry Act, etc.)","Multiple conditional thresholds combining quantitative metrics (megawatts, terajoules, billions of dollars, megalitres) with qualitative requirements (contractual obligations, market connections)","Nested definitions requiring external knowledge (e.g., 'Cash Market Product' defined by reference to ASIC Market Integrity Rules 2017)","Hybrid structure mixing general rules with specific named entities (ABNs explicitly listed for sugar mills, freight facilities, payment systems, supermarkets)","Temporal conditions ('at least 2 consecutive quarters') and geographic specificity (named pipelines, named locations)","18 defined terms in section 3 plus incorporation by reference of Act definitions via Legislation Act 2003","Tabular presentation of data creating fragmented reading experience across multiple schedules and sections"],"plain_english_summary":"This legislation is a set of rules that defines what counts as 'critical infrastructure' under Australia's main security law (the Security of Critical Infrastructure Act 2018). Think of it as the detailed checklist that tells the government exactly which power stations, gas pipelines, banks, supermarkets, ports, and internet systems are so important to national security that they need special protection rules.\n\n**What it does:**\n- **Sets specific thresholds** for when something becomes 'critical' — for example, a power station is critical if it can generate at least 30 megawatts and is connected to the wholesale market, or if it can restart the grid after a blackout.\n- **Names specific companies and locations** — it literally lists which sugar mills are *excluded*, which specific intermodal freight facilities are included (like Chullora in NSW or Parkes), and which payment systems (Visa, Mastercard, EFTPOS, New Payments Platform) are deemed critical.\n- **Sets financial thresholds** for banks ($50 billion in assets), insurers ($2 billion or $5 billion depending on type), and superannuation funds ($20 billion).\n- **Defines technical terms** like what counts as a 'smart meter' or 'DNS' (the system that translates website names into computer addresses).\n- **Specifies what 'operational information'** these companies must report about — including customer data, cloud storage locations, and research details.\n\n**Who it affects:**\n- **Large infrastructure operators** — power companies, gas pipeline operators, major banks, big insurers, large super funds, major supermarkets (Woolworths, Coles, Aldi), freight companies with $150m+ revenue, and specific internet domain administrators.\n- **Government agencies** — it designates which Commonwealth bodies oversee different parts of the regime.\n\n**Why it matters:**\nThis is the practical machinery that makes the broader Security of Critical Infrastructure Act work. Without these definitions, the Act would be too vague to enforce. These rules determine which companies must register with the government, report cyber incidents, and allow government assistance during cyber attacks. It essentially draws the line between 'regular business' and 'national security priority'."},"summary":{"content_quality":"ok","complexity_score":3,"scope_assessment":{"changed":false,"description":"The instrument does not alter the legal scope of the Security of Critical Infrastructure Act 2018; it activates the Act’s definitions by specifying which assets and entities satisfy the statutory criteria for critical infrastructure."},"complexity_factors":["Numerous detailed quantitative thresholds across multiple sectors","Requires cross-referencing with the Act, Corporations Act, ASIC Market Integrity Rules, Therapeutic Goods Act and Superannuation Industry (Supervision) Act","Incorporates lists of specific named entities, locations and asset types","Defines technical terms such as DNS, DNSSEC, authoritative DNS name servers and system restart ancillary service","Specifies operational information categories and data types"],"plain_english_summary":"This instrument defines which assets count as “critical infrastructure” under the Security of Critical Infrastructure Act 2018, naming specific entities (major supermarkets, payment systems, .au domain administrator, etc.) and setting precise thresholds and lists across sectors like energy, gas, fuel, freight, financial services, water, broadcasting, and food and grocery. It also sets required operational‑information reporting rules and designates the Department for information sharing. If you own, operate or supply assets in these sectors, it tells you when the Act’s obligations apply."},"flash_summary":{"complexity_score":6,"scope_assessment":{"changed":true,"description":"This instrument narrows and specifies the Act’s scope by prescribing precise definitions, numeric thresholds and named entities, thereby determining which assets and businesses fall inside or outside the Act’s reach (examples: electricity generators ≥30 MW and wholesale‑market connection at s 5; named gas pipelines and regional nameplate thresholds at s 6; liquid fuel refineries/pipelines and >50 ML storage at s 7; freight businesses with ≥$150 million revenue and specified goods at s 9; DNS administration and .au components at s 16; sugar mill exclusions at s 19)."},"complexity_factors":["Extensive cross‑references to other statutes and instruments (Security of Critical Infrastructure Act, Corporations Act, Therapeutic Goods Act, Privacy Act, ASIC Market Integrity Rules) — see sections 3, 10 and 17.","Multiple sector‑specific numeric thresholds and two‑part tests (e.g. electricity: ≥30 MW and connection to a wholesale market; system restart capability) — see s 5.","Named asset lists and responsible entities (payment systems, supermarket retailers, intermodal facilities, specific pipelines and refineries) that require entity identification and mapping to ABNs — see ss 6–8, 15, 16 and Schedule 1.","Operational information definition requires detailed provenance and hosting details (ABN/address/head office/country/cloud provider and server locations) for third‑party held data — see s 17(2).","Sectoral specificity of data types tied to assets (smart‑meter consumption, WHOIS queries, ICU usage, cargo traffic) requiring different data collection and disclosure approaches — see s 17(1)(c) table.","Several different asset classes use distinct metrics (storage capacity in megalitres, pipeline nameplate terajoules/day, asset values in dollars) increasing compliance measurement complexity — see ss 6(2), 7(3), 12–14.","Explicit exclusions (certain sugar mills) that require matching ownership to the listed entities to determine non‑coverage — see s 19 and table.","Delegation/administration distinctions (Department specified as relevant Commonwealth body for certain provisions, ASD for others) affecting where approvals or interactions occur — see s 18."],"plain_english_summary":"This instrument sets out which assets, systems and businesses are treated as \"critical\" for the Security of Critical Infrastructure Act by listing named facilities, sector tests and numeric thresholds (for electricity, gas, liquid fuel, freight, finance, DNS, broadcasting, banking, insurance, superannuation, food/grocery and others). It also defines key terms (DNS, WHOIS, operational information) and who is the responsible Commonwealth body. That matters because these definitions determine which owners/operators must meet the Act’s obligations and what data or facilities must be reported or managed."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"}},"importantCases":[],"_links":{"self":"/api/acts/security-of-critical-infrastructure-definitions-rules-lin-21-039-2021","history":"/api/acts/security-of-critical-infrastructure-definitions-rules-lin-21-039-2021/history","analysis":"/api/acts/security-of-critical-infrastructure-definitions-rules-lin-21-039-2021/analysis","conflicts":"/api/acts/security-of-critical-infrastructure-definitions-rules-lin-21-039-2021/conflicts","importantCases":"/api/acts/security-of-critical-infrastructure-definitions-rules-lin-21-039-2021/important-cases","documents":"/api/acts/security-of-critical-infrastructure-definitions-rules-lin-21-039-2021/documents"}}