{"id":"F2023L00113","name":"Security of Critical Infrastructure (Naval shipbuilding precinct) Rules (LIN 23/007) 2023","slug":"security-of-critical-infrastructure-naval-shipbuilding-precinct-rules-lin-23-007-2023","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":103765,"registerId":"commonwealth-F2023L00113-current","compilationNumber":null,"startDate":"2026-04-03","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Preliminary","content":"## Part 1 Preliminary\n\n1 Name\n\nThis instrument is the Security of Critical Infrastructure (Naval shipbuilding precinct) Rules (LIN 23/007) 2023.\n\n3 Definitions\n\n> Note Some terms used in this instrument are defined in the Act, including:\n\n> Note: (a) asset;\n\n> Note: (b) AusCheck scheme;\n\n> Note: (c) critical infrastructure asset;\n\n> Note: (d) entity;\n\n> Note: (e) relevant impact;\n\n> Note: (f) responsible entity;\n\n> Note: (g) security.\n\nIn this instrument:\n\n> AusCheck Act means the AusCheck Act 2007.\n\n> AusCheck Regulations means the AusCheck Regulations 2017.\n\n> background check means a background check under the AusCheck scheme.\n\n> CIRMP is short for critical infrastructure risk management program.\n\n> CIRMP criminal record has the same meaning as defined in the AusCheck Regulations.\n\ncriminal history criteria means the assessment of:\n\n(a) whether the person has a CIRMP criminal record; and\n\n(b) the nature of the offence.\n\n> Department of Defence means the Department administered by the Minister administering the Defence Act 1903.\n\n> personnel hazard includes where a person acts, through malice or negligence:\n\n(a) to compromise the proper function of the asset; or\n\n(b) to cause significant damage to the asset.\n\n4 Critical infrastructure asset\n\n  (1) For paragraph 9(1)(f) of the Act, an asset is a critical infrastructure asset if it is:\n    (a) within an area identified for the purposes of this section on the map in Schedule 1; and\n    (b) used for the primary purposes of naval shipbuilding or sustainment.\n\n    Note The map in Schedule 1 depicts the Osborne Naval Shipyard precinct on Lefevre Peninsula, South Australia.\n  (2) For subsection 12L(23) of the Act, the responsible entity for a critical infrastructure asset mentioned in subsection (1) is:\n    (a) the entity that has been granted exclusive control and use of the asset or the area where the asset is located, under a licence or other contractual arrangement, for such time as the licence or other contractual arrangement remains in force; or\n    (b) in all other circumstances, Australian Naval Infrastructure Pty Ltd (ABN 45 051 762 639).\n\n5 Application of Part 2A of the Act\n\n(1) For paragraph 30AB(1)(a) of the Act, Part 2A of the Act applies to a critical infrastructure asset mentioned in subsection 4(1).\n\n(2) For subsection 30AB(3) of the Act, Part 2A of the Act applies to a critical infrastructure asset mentioned in subsection 4(1), 12 months after the asset becomes a critical infrastructure asset.\n\n(3) The requirements specified in this instrument for paragraph 30AH(1)(c) of the Act apply to a critical infrastructure asset that:\n\n(a) is mentioned in subsection 4(1); and\n\n(b) is not specified in another instrument for paragraph 30AB(1)(a) of the Act.\n\n6 Relevant Commonwealth Regulator\n\nFor paragraph (a) of the definition of relevant Commonwealth regulator in section 5 of the Act, the Department of Defence is specified for a critical infrastructure asset mentioned in subsection 4(1).","sortOrder":0},{"sectionNumber":"Part 2","sectionType":"part","heading":"Requirements for a critical infrastructure risk management program","content":"## Part 2 Requirements for a critical infrastructure risk management program\n\n7 Material risks\n\nFor subsection 30AH(8) of the Act, the material risks include the following:\n\n(a) a stoppage or major slowdown of the critical infrastructure asset’s function for an unmanageable period;\n\n(b) a substantive loss of access to, or deliberate or accidental manipulation of, a critical component of the critical infrastructure asset;\n\n> Note: Example The position, navigation and timing systems affecting provision of service or functioning of the asset.\n\n(c) an interference with the critical infrastructure asset’s operation technology or information communication technology essential to the functioning of the asset;\n\n> Note: Example A Supervisory Control and Data Acquisition (SCADA) system.\n\n(d) the storage, transmission or processing of sensitive operational information outside Australia, which includes:\n\n(i) layout diagrams;\n\n(ii) schematics;\n\n(iii) geospatial information;\n\n(iv) configuration information;\n\n(v) operational constraints or tolerances information;\n\n(vi) data that a reasonable person would consider to be confidential or sensitive about the asset;\n\n(e) remote access to operational control or operational monitoring systems of the critical infrastructure asset.\n\n8 Personnel hazards\n\n(1) For paragraph 30AH(1)(c) of the Act, for personnel hazards, a responsible entity must establish and maintain a process or system in a CIRMP:\n\n(a) to permit a person unescorted access to a critical infrastructure asset mentioned in subsection 4(1) only where:\n\n(i) a background check of the person has been conducted in accordance with section 9; and\n\n(ii) a person has been found suitable to have unescorted access to the critical infrastructure asset in accordance with section 10; and\n\n(iii) an identity card has been issued to a person who meets the requirements in subparagraphs (i) and (ii); and\n\n(b) to collect the identity and contact information for each person who has access to the critical infrastructure asset; and\n\n(c) to record the date, time and duration of access to the critical infrastructure asset by each person; and\n\n(d) as far as it is reasonably practicable to do so—to minimise or eliminate material risks:\n\n(i) arising from a malicious or negligent person; and\n\n(ii) arising from the off-boarding process for outgoing employees and contractors.\n\n(2) For subsection 30AH(12) of the Act, the establishment and maintenance of processes or systems mentioned in subsection (1) is taken to be action that mitigates the relevant impact of personnel hazards on the critical infrastructure asset.\n\n9 Background checks\n\n(1) A background check is required:\n\n(a) before a person is granted unescorted access to the critical infrastructure asset; and\n\n(b) if the person requires ongoing access to the critical infrastructure asset—every 2 years.\n\n(2) For paragraph 30AH(4)(a) of the Act, a background check of a person must be conducted under the AusCheck scheme.\n\n(3) A background check must include an assessment of information relating to the matters mentioned in paragraphs 5(a), (b), (c) and (d) of the AusCheck Act; and\n\n(a) for paragraph 30H(4)(c) of the Act—the criteria against which the information must be assessed are the criminal history criteria; and\n\n(b) for paragraph 30AH(4)(d) of the Act—the assessment must consist of both an electronic identity verification check and an in person identity verification check.\n\n(4) A responsible entity must notify the Secretary if a background check is no longer required for a person.\n\n10 Suitability assessment\n\n(1) Following a background check under section 9, a responsible entity must assess the suitability of a person to have unescorted access to the critical infrastructure asset.\n\n(2) In making a suitability assessment for subsection (1), a responsible entity must consider:\n\n(a) any advice from the Secretary under the following provisions of the AusCheck Regulations:\n\n(i) paragraph 21DA(2)(a);\n\n(ii) paragraph 21DA(2)(b);\n\n(iii) subsection 21DA(4);\n\n(iv) subsection 21DA(5); and\n\n(b) whether permitting the person unescorted access to a critical infrastructure asset mentioned in subsection 4(1) would be prejudicial to security; and\n\n(c) any other information that may affect the person’s suitability to have unescorted access to the asset.\n\n> Note A responsible entity may be required to inform the Secretary of a decision to grant or revoke access to a critical infrastructure asset, in certain circumstances—see AusCheck Regulations, section 21ZA.\n\nSchedule 1 Naval shipbuilding precinct\n\n1 Osborne Naval Shipyard\n\n![A map of the Osborne Naval Shipyard precinct on Lefevre Peninsula, South Australia. A boundary line has been included on the map to outline the areas within the shipyard where critical infrastructure assets are located, for the purposes of section 4 of the Rules.](image.002.png)An area within the Osborne Naval Shipyard boundary lines on the following map constitutes an area identified for the purposes of section 4.","sortOrder":1}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":4,"scope_assessment":{"changed":false,"description":"The legislation remains tightly focused on its original purpose: applying the Security of Critical Infrastructure Act framework specifically to the Osborne Naval Shipyard. It does not expand beyond naval shipbuilding and sustainment activities at this specific geographic location. The scope is actually narrower than the enabling Act, which covers multiple sectors (energy, telecommunications, transport, etc.), and represents a targeted sectoral application rather than scope creep."},"complexity_factors":["Heavy reliance on external legislative references — the Rules repeatedly point to the Security of Critical Infrastructure Act 2018, AusCheck Act 2007, and AusCheck Regulations 2017 for definitions and procedural details, requiring readers to cross-reference three separate instruments to understand full obligations.","Nested conditional logic in access control — section 8(1)(a) requires three cumulative conditions (background check + suitability finding + ID card) plus a 'reasonably practicable' qualifier for off-boarding risks, creating layered compliance requirements.","Dual responsible entity structure — section 4(2) splits responsibility between leaseholders and Australian Naval Infrastructure Pty Ltd depending on contractual status, creating potential ambiguity about who bears legal obligations.","Incorporation by reference of criminal history criteria — the 'criminal history criteria' definition in section 3 delegates substantive content to the AusCheck Regulations, meaning the Rules themselves don't specify what criminal records disqualify access.","12-month delayed application trigger — section 5(2) creates a conditional commencement that depends on when an asset 'becomes' critical infrastructure, requiring tracking of individual asset status over time."],"plain_english_summary":"This law designates the Osborne Naval Shipyard as critical infrastructure and imposes strengthened security: regular federal background checks and ID for unescorted access, mandatory risk‑management planning for sabotage, cyber threats and insider risks, and Defence oversight of compliance. \n\nIt directly affects the site owner (Australian Naval Infrastructure Pty Ltd), private contractors and workers. The aim is to safeguard classified naval work and prevent espionage, sabotage or insider harm while operators transition to the new rules."},"flash_summary":{"complexity_score":6,"scope_assessment":{"changed":false,"description":"This instrument applies existing Part 2A obligations to a specified geographic precinct (Osborne Naval Shipyard) and sets procedural requirements for access and risk management (ss4–10). It does not amend the Act’s definitions or broaden the Act’s substantive subject-matter; it designates which assets are captured, identifies the responsible entity rules (s4(2)), and names the Department of Defence as the relevant Commonwealth regulator (s6)."},"complexity_factors":["Cross-references to the Security of Critical Infrastructure Act and AusCheck legislation, requiring coordination across statutory schemes (definitions in s3, application in s5 and s9).","Multiple compliance actions required of responsible entities: CIRMP creation/maintenance, background checks, suitability assessments, identity cards, access logs, off-boarding processes (operational obligations in ss7–10).","Detailed identity verification standard: both electronic and in-person identity checks mandated (s9(3)(b)).","Periodic renewal requirement: background checks before access and every two years for ongoing access (s9(1)).","Designation of responsible entity can depend on licence or default to a corporate body, creating variable compliance owner depending on contractual arrangements (s4(2)).","Regulatory specification: Department of Defence named as relevant Commonwealth regulator for these assets, concentrating oversight (s6).","Timing and phased application: Part 2A applies generally and may be subject to a 12-month delay after designation (s5(2)), creating transitional compliance planning needs.","Notification duties to the Secretary where background checks cease and possible reporting/consultation obligations under AusCheck Regulations referenced in suitability assessments (s9(4); s10(2)(a) note).","Asset definition tied to a mapped precinct (Schedule 1), which requires spatial interpretation and may raise boundary or scope questions in practice (s4(1); Schedule 1).","Operational-risk specifications (material risks and personnel hazards) combine technical (OT/ICT, remote access) and human factors, requiring multidisciplinary controls (s7; s8)."],"plain_english_summary":"This instrument designates the Osborne Naval Shipyard precinct as a critical infrastructure area for naval shipbuilding and brings those assets within Part 2A of the Security of Critical Infrastructure Act. It requires the responsible entity to run a critical infrastructure risk management program (CIRMP) with AusCheck background checks (electronic and in-person identity checks), suitability assessments, identity cards, access logging and two‑year rechecks before granting unescorted access. The Department of Defence is the relevant Commonwealth regulator; licence-holders or Australian Naval Infrastructure Pty Ltd carry the compliance obligations and costs."}},"importantCases":[],"_links":{"self":"/api/acts/security-of-critical-infrastructure-naval-shipbuilding-precinct-rules-lin-23-007-2023","history":"/api/acts/security-of-critical-infrastructure-naval-shipbuilding-precinct-rules-lin-23-007-2023/history","analysis":"/api/acts/security-of-critical-infrastructure-naval-shipbuilding-precinct-rules-lin-23-007-2023/analysis","conflicts":"/api/acts/security-of-critical-infrastructure-naval-shipbuilding-precinct-rules-lin-23-007-2023/conflicts","importantCases":"/api/acts/security-of-critical-infrastructure-naval-shipbuilding-precinct-rules-lin-23-007-2023/important-cases","documents":"/api/acts/security-of-critical-infrastructure-naval-shipbuilding-precinct-rules-lin-23-007-2023/documents"}}