Cyber Security (Cyber Incident Review Board) Rules 2025

The Rules revolve around a small set of recurring concepts: referrals and reviews under the Act, composition and eligibility of the Cyber Incident Review Board and its Expert Panel, security clearances and classification, conflict-of-interest management and restrictions on paid work, and procedural mechanics for conducting reviews and Board business.

Referrals and reviews

• The Board acts on written referrals under subsection 46(1) of the Act and must consider and decide whether to conduct reviews (s 7). Reviews are limited by the Act’s conditions in subsection 46(2) (referred to in Notes at ss 9 and 10).
• Terms of reference govern each review and set the operational parameters, including number of standing members, number of Expert Panel members, minimum security clearance for participating standing members, and any additional eligibility requirements for Expert Panel appointment (s 9).

Composition and appointment

• A review panel comprises the Chair, specified standing members of the Board, and Expert Panel members appointed to assist the Board (s 5). Standing members are appointed by the Minister under the Act; the Minister may also make acting appointments to cover vacancies or absences (s 14).
• Expert Panel appointments are part‑time (s 22(1)) and limited to no more than four years per instrument of appointment (s 22(2)). Expert Panel members are only remunerated when appointed to a review (s 22 notes; s 24).

Eligibility and security clearance

• Eligibility for Board or Expert Panel membership includes a requirement that the person holds, or is eligible to hold, an Australian Government security clearance that permits access to information classified at least secret, or an equivalent Commonwealth‑recognised clearance (ss 13(1)(a), 22(3)(a)).
• Both Board and Expert Panel eligibility lists include alternative pathways to qualification: law degrees and legal experience, cyber security or information technology qualifications or experience, senior government positions, significant experience in audit/assurance/public administration/financial or prudential regulation, incident management or crisis response, critical infrastructure sector experience, or significant academic qualifications in a relevant field (ss 13(1)(b)(i)-(viii); 22(3)(b)(i)-(viii)).

Conflict management and paid work restrictions

• Board members must disclose all relevant interests to the Minister before appointment (s 15(1)), and disclosures under the PGPA Act s 29 must be made to the Minister (s 15(2)-(4)). Board members must also disclose interests to the Board if they arise (s 16). The Board may exclude a member from deliberations and decisions where a relevant interest exists (s 16(4)-(6)).
• Board members must not engage in paid work that, in the Minister’s opinion, conflicts or could conflict with their duties (s 17). Expert Panel members must satisfy the Chair that they will not be engaged in paid work that conflicts, or could conflict, with their duties for a particular review (s 23(c)).
• Expert Panel members must similarly disclose interests before and during appointment and may be excluded from deliberations by the Board (s 25).

Operational rules

• The Chair controls much operational decision-making: convening meetings, granting leave to Board members (s 29), appointing Expert Panel members to review panels (s 23), revoking Expert Panel appointments for cause (s 24(7)), and determining remuneration and allowances for Expert Panel members by legislative instrument (s 24(2)-(4)).
• The Board is required to publish notification of a review as soon as practicable after deciding to conduct it, and that notification must contain specified content (s 11).
• The Board must not conduct a review where the Chair considers it would interfere with ongoing investigations or proceedings (s 10). The Rules reference the Act’s requirement that reviews occur only after the incident and immediate response have ended (s 10 note).

Records, meetings and decision-making

• The Board must keep minutes (s 33), may make decisions without a meeting provided certain procedural safeguards are met (s 34), and determines its own procedures subject to the instrument and the Act (s 32). Voting rules provide for majority decision-making and a casting vote for the presiding officer (s 31).

Interplay with other statutory frameworks

• The Rules explicitly reference other laws for defined terms and obligations, including the Act, the Criminal Code (for Australian Government security clearance and security classification), the Public Governance, Performance and Accountability Act 2013 (PGPA Act) for disclosure duties, the Security of Critical Infrastructure Act 2018 (as a source for critical infrastructure experience), the Remuneration Tribunal Act 1973 (to note that an Expert Panel appointment is not a public office), and the Acts Interpretation Act 1901 (s 33 note). Those references anchor the Rules to broader statutory obligations and definitions.

Together, these concepts structure who may participate in reviews, how reviews are selected and timed, how conflicts and potential conflicts are identified and managed, how Expert Panel members are remunerated, and the administrative process for the Board’s business.

Primary institutional actors

• The Cyber Incident Review Board and its Chair: the Rules prescribe how the Board functions operationally and how its Chair exercises significant operational control (ss 5, 9, 23, 24, 29-31). The Chair decides on Expert Panel appointments to particular review panels (s 23), determines remuneration and allowances for Expert Panel members by legislative instrument (s 24), and has duties in convening and presiding over meetings (s 29-30).
• The Minister for Home Affairs: the Minister appoints standing members of the Board and may terminate appointments (ss 13(2), 14, 20). The Minister also receives pre‑appointment disclosures from Board candidates (s 15) and is the addressee for resignations and terminations procedures which the Rules anchor to ministerial oversight (ss 18-20).

Experts and appointees

• Standing Board members: persons appointed under ss 64 or 66 of the Act must meet eligibility requirements in s 13, including a minimum security clearance and one or more specified qualifications or experience pathways (s 13(1)). Standing members must make pre‑appointment disclosures to the Minister (s 15(1)), disclose interests to the Board (s 16), and refrain from paid work that the Minister considers conflicts with Board duties (s 17).
• Expert Panel members: appointed on a part‑time basis to an Expert Panel (s 22(1)), eligible only if they meet security clearance requirements and one of the listed qualifications or experience pathways (s 22(3)). Expert Panel members are appointed to specific review panels by the Chair (s 23) and are remunerated only when appointed to a review panel (s 24).

Government agencies and investigatory bodies

• The Department hosting the Board: required to publish notifications of reviews on its website or otherwise as appropriate (s 11(1)), and to support Board administrative functions, minutes (s 33) and record‑keeping (s 34(4)).
• Investigative and prosecutorial authorities: the Rules expressly prevent reviews from being conducted where the Chair considers doing so would interfere with investigations or proceedings under Commonwealth, State or Territory law (s 10). That creates a direct operational interaction between the Board and existing criminal and civil enforcement processes.

Private sector entities and industry

• Entities that are the subject of referrals or that report cyber security incidents face the prospect of being the subject of a Board review. The Board’s stated purpose is to make recommendations to government and industry (s 5). The Rules require publication of notification that a review will be conducted, including details of the incident and proposed timeframes (s 11(2)(c)-(e)), which can affect industry reputational and disclosure plans.
• Potential Expert Panel members from industry: those with relevant expertise must be willing to obtain or already hold requisite security clearances (ss 22(3)(a), 23) and accept potential restrictions on concurrent paid work while assisting a review (s 23(c)). That can affect availability and opportunity costs for senior private practitioners.

Other statutory regimes and regulators

• Agencies and persons regulated under the PGPA Act must note that PGPA s 29 disclosures by Board members must be made to the Minister as required by the Rules (s 15(2)-(4)). The Rules also reference the Security of Critical Infrastructure Act 2018 as a source for “critical infrastructure sector” experience (ss 13(1)(b)(vii), 22(3)(b)(vii)).

Who decides and who pays

• Decision-makers are the Minister and the Chair for appointments, terminations, convening meetings, and Expert Panel composition and remuneration (ss 13(2), 14, 20, 23-24, 29-30).
• Who pays Expert Panel members once appointed is provided for: the Chair determines remuneration and allowances by legislative instrument (s 24). The Rules do not specify remuneration arrangements for standing Board members in this instrument; they note that Expert Panel appointments and assisting in a review are not public offices under the Remuneration Tribunal Act 1973 (s 22 note; s 24(1) note).

Consequentially, affected parties include: current and prospective Board and Expert Panel appointees (with attendant security clearance and disclosure obligations), the Minister and the Chair (with appointment and operational powers), departments supporting the Board’s administrative functions, agencies conducting investigations and prosecutions where timing conflicts may occur, and private entities that may be the subject of future reviews and who must engage with the Board’s notification and review processes.

This instrument sets duties for Board members, Expert Panel members, the Chair, the Minister and the Board as an institution, and confers certain operational rights. The duties are administrative, disclosure and procedural rather than imposing new criminal liabilities.

Duties to consider referrals and set terms of reference

• The Board must consider any written referral made under subsection 46(1) of the Act and decide whether a review should be conducted (s 7). This is a mandatory consideration duty; the Board must perform the assessment step before deciding to proceed.
• For each review the Board must establish terms of reference that specify the number of standing Board members and Expert Panel members to participate, the minimum security clearance required for standing members for that review, and any additional eligibility requirements for Expert Panel appointment (s 9(1)(a)-(d)). The Board may vary terms of reference with Ministerial approval (s 9(2)).

Notification duty

• The Board must publish notification that a review will be conducted as soon as practicable after deciding to conduct it, on the Department’s website or otherwise as appropriate (s 11(1)). The notification must include composition numbers, incident details, a brief description of how the incident meets subsection 46(2) of the Act, proposed timeframes, and any other information the Board considers appropriate (s 11(2)(a)-(f)). This creates a public-facing duty to disclose specific procedural and incident information.

Timing duty and non-interference

• A review must not be conducted at a time when the Chair considers it would interfere with or prejudice investigations or legal proceedings under Commonwealth, State or Territory law (s 10). The instrument cross-references the Act’s requirement that reviews only occur after the incident and immediate response has ended (s 10 note; paragraph 46(2)(b) of the Act).

Eligibility and vetting

• The Minister must be satisfied that prospective Board appointees meet the eligibility criteria in s 13 and that they have appropriate qualifications, knowledge, skills or experience before appointment (s 13(2)). The Chair must satisfy analogous requirements for Expert Panel appointments (s 22(4)).

Disclosure duties

• Board member candidates must disclose to the Minister all pecuniary and other interests they are aware of that are likely to be considered by the Board prior to appointment (s 15(1)). After appointment, Board members must file disclosures under PGPA s 29 to the Minister (s 15(2)-(4)).
• During reviews, a Board member or Expert Panel member who has an interest in a matter being considered must disclose the nature of that interest to the Board or Chair as soon as practicable (ss 16(1)-(3); 25(2)-(3)). Disclosures must be recorded in minutes (ss 16(3); 25(7)) and may lead the Board to exclude the member from deliberations and decisions unless the Board otherwise determines (ss 16(4); 25(4)-(6)).

Restrictions on paid work

• Board members must not engage in paid work that, in the Minister’s opinion, conflicts or could conflict with their duties (s 17). Expert Panel members must satisfy the Chair that they will not be engaged in paid work that conflicts, or could conflict, with their duties assisting the Board in a particular review (s 23(c)). These provisions allocate to the Minister and Chair the evaluative judgment about conflict.

Operational duties and rights

• The Chair may convene meetings at any time, must convene a meeting within 30 days of a written request from another member (s 29(2)(a)-(b)), presides at meetings when present (s 30(1)), and appoints presiding officers when absent (s 30(2)).
• The Board must hold necessary meetings for efficient performance and keep minutes (ss 29(1); 33). Voting is by majority with the presiding officer having a deliberative and casting vote (s 31). The Board may make decisions without meetings if it has pre-established a method and a majority indicates agreement (s 34).

Termination and removal rights

• The Minister may terminate a Board member for misbehaviour or incapacity and for other listed causes such as bankruptcy, absence from meetings, engagement in conflicting paid work, and failure to comply with PGPA s 29 or eligibility ceasing to be satisfied (s 20(1)-(2)). The Chair may revoke an Expert Panel appointment to a review panel for similar causes (s 24(7)) and may terminate an Expert Panel appointment to the Expert Panel for similar reasons (s 27).

Remuneration rights

• Expert Panel members appointed to a review panel are to be paid remuneration and allowances as determined by the Chair by legislative instrument (s 24(2)-(4)). The instrument explicitly notes that these appointments are not public offices within the meaning of the Remuneration Tribunal Act 1973 (s 22 note; s 24(1) note).

Rights to act and substitute

• The Minister may make acting appointments to standing member offices during vacancies or absences (s 14). The Chair may grant leave to Board members (s 18(2)) and the Minister may grant leave to the Chair (s 18(1)).

Rights and duties are largely administrative and internal: they shape who sits on review panels, when reviews occur, how conflicts are handled, and how meetings and records are governed. The instrument does not create direct investigatory powers, criminal offences or civil penalties; enforcement is exercised through appointment, termination and exclusion powers allocated to the Minister, Chair and the Board, as set out above (ss 15-20, 23-27, 29-34).

The Rules themselves do not create new criminal offences or civil penalty provisions. Enforcement within the Rules takes the form of appointment, exclusion and termination powers, procedural consequences for non‑compliance with disclosure duties, and exclusion from deliberations. The instrument relies on administrative sanctions and ministerial or chair discretion rather than new statutory penalties.

Termination and revocation powers

• The Minister may terminate the appointment of a Board member for misbehaviour or incapacity (s 20(1)(a)-(b)). The Minister also has specified grounds for termination, including bankruptcy or insolvency, unapproved absence from three consecutive meetings, engagement in paid work that conflicts in the Minister’s opinion with Board duties, failure to comply with PGPA s 29 or rules made for that section, and ceasing to satisfy eligibility requirements (s 20(2)(a)-(e)). These grounds provide the instrument’s primary enforcement tools against Board members.
• The Chair may revoke the appointment of an Expert Panel member to a review panel for misbehaviour, incapacity, bankruptcy/insolvency events, failure to comply with s 25 disclosure obligations, or ceasing to meet eligibility requirements for the Expert Panel in relation to the appointment (s 24(7)(a)-(e)). The Chair also may terminate a member’s appointment to the Expert Panel for similar causes (s 27(a)-(e)).

Exclusion and incapacity consequences

• Where a Board member or Expert Panel member has a conflict or interest in a matter under consideration, the Board may determine that the member must not be present during deliberations or participate in decisions regarding that matter (ss 16(4)-(6); 25(4)-(5)). That exclusion is recorded in minutes (ss 16(3), 16(6); 25(6)-(7)). This process operates as a procedural enforcement mechanism to preserve impartiality.

Disclosure compliance and PGPA obligations

• The Rules require Board members to make disclosures under PGPA s 29 to the Minister (s 15(2)-(4)) and state that a Board member is taken not to have complied with PGPA s 29 if they do not comply with s 15(2) (s 15(4)). That creates an internal rule tying PGPA disclosure obligations to ministerial notification and allows termination grounds (s 20(2)(d)) where a Board member fails, without reasonable excuse, to comply with PGPA s 29 or associated rules. The PGPA Act itself contains administrative frameworks for compliance, and the instrument connects those frameworks into Board governance.

Remuneration and legislative instruments

• The Chair determines Expert Panel remuneration and allowances by legislative instrument (s 24(2)-(4)). The Rules do not specify penalties for non‑payment; enforcement of remuneration obligations would depend on the accuracy and operation of the Chair’s legislative instrument and any administrative remedies available through the Department or applicable employment or contract law provisions.

Limitations and lack of coercive enforcement

• The Rules do not, in themselves, provide coercive investigatory powers: they do not authorise warrants, compel third‑party disclosure, or create offences for obstructing a review. For timing, the Chair must avoid conducting reviews that interfere with ongoing investigations or legal proceedings (s 10). This constrains the Board’s operational scope and avoids direct interference with law enforcement and prosecutorial processes.

Practical enforcement channels

• Enforcement is primarily administrative: appointment, suspension, exclusion from deliberations, revocation of Expert Panel membership, and termination. Non‑compliance with required disclosures can trigger termination (s 20(2)(d); s 24(7)(d); s 27(d)). The instrument also uses record‑keeping (minutes s 33; decisions without meetings s 34) to maintain evidentiary bases for enforcement actions.

In sum, the Rules enforce compliance through internal governance mechanisms and ministerial/chair discretionary powers. They do not create new criminal or civil liability within the instrument itself; enforcement is effected by administrative measures outlined at ss 15-20, 23-27 and the meeting and record‑keeping provisions at ss 29-34.

The Rules are explicitly designed to operate in tandem with the Cyber Security Act 2024 and to reference existing Commonwealth statutory frameworks. They do not operate in isolation and rely on definitions, obligations and constraints embedded in other statutes. The instrument itself cites several Acts; these citations establish definitional incorporation, procedural cross‑references and normative constraints.

Cyber Security Act 2024

• Authority: The Rules are made under the Cyber Security Act 2024 (s 3). The Rules implement and give effect to the Act’s provisions about the Cyber Incident Review Board, including the Board’s review powers under s 46 of the Act (see s 6 note and s 7).
• Operational constraints: The Rules reference subsection 46(2) of the Act several times (s 9 note; s 10 note; s 11(2)(d)). That subsection limits when a review may be conducted, and the Rules embed those Act limits in the timing and terms of reference for reviews (s 9(1)(c)-(d); s 10).

Criminal Code (for security clearance and classification)

• Definitions: The Rules adopt the Criminal Code’s meanings for “Australian Government security clearance” and “security classification” (s 4 definitions). Eligibility for both Board and Expert Panel membership requires either holding or being eligible to hold a security clearance that permits access to at least secret classified information, or an equivalent Commonwealth-recognised clearance (ss 13(1)(a), 22(3)(a)). Thus, the Criminal Code’s security classification and clearance frameworks materially affect who can serve.

Public Governance, Performance and Accountability Act 2013 (PGPA Act)

• Disclosure duties: The Rules require Board members to make disclosures under PGPA s 29 to the Minister (s 15(2)-(4)). The instrument states that a Board member is taken not to have complied with PGPA s 29 if they do not comply with s 15(2) (s 15(4)). The instrument therefore incorporates PGPA s 29 compliance into Board appointment and termination considerations (s 20(2)(d)).
• Administrative cross‑reporting: By requiring PGPA s 29 disclosures to be submitted to the Minister, the Rules create an obligation on Board members to align their conflict disclosures with broader Commonwealth financial governance regimes.

Security of Critical Infrastructure Act 2018

• Experience weighting: The Rules list “significant experience in a critical infrastructure sector (within the meaning of the Security of Critical Infrastructure Act 2018)” as an eligible qualification pathway for both Board and Expert Panel members (ss 13(1)(b)(vii), 22(3)(b)(vii)). This cross-reference situates the Board’s expertise expectations within the scope of critical infrastructure regulation.

Remuneration Tribunal Act 1973

• Status of appointment: The Rules include notes stating that appointments to the Expert Panel and to assist in reviews are not public offices within the meaning of the Remuneration Tribunal Act 1973 (s 22 note; s 24(1) note). That affects the mechanism for determining pay and allowances, with the Chair instead empowered to set remuneration by legislative instrument (s 24(2)-(4)).

Acts Interpretation Act 1901

• Meeting participation: The Rules reference s 33B of the Acts Interpretation Act 1901 for further information about ways Board members may participate in meetings (s 32 note). That background provision may allow for electronic participation and other procedural flexibilities in meetings.

Interaction with investigative and prosecutorial regimes

• Non‑interference: The Chair must not allow a review to proceed at a time when it would interfere with or prejudice investigations or proceedings under Commonwealth, State or Territory law (s 10). This embeds a cross‑regime constraint ensuring the Review Board does not obstruct criminal or civil enforcement activities, integrating the Board’s timing and scope with law enforcement processes.

Remuneration and legislative instruments

• The Chair is empowered to determine remuneration and allowances for Expert Panel members by legislative instrument (s 24(2)-(4)). That use of a legislative instrument operates within the legislative instrument framework and any applicable disallowance, tabling and publication requirements prescribed by the Legislative Instruments Act. The Rules themselves do not set rates.

Record-keeping and PGPA interface

• The Board’s requirements for minutes and record-keeping (ss 33-34) interact with PGPA obligations for governance and accountability. The requirement that PGPA s 29 disclosures be provided to the Minister (s 15(2)) reinforces this link.

Limits and gaps

• The Rules do not create new statutory powers to compel documents or testimony from third parties; if such powers exist elsewhere in the Act, they are not restated here. The instrument therefore relies on institutional cooperation and existing statutory compulsion powers elsewhere in Commonwealth law, if any are present.

In short, the Rules integrate the Board’s governance and operational detail with substantive constraints and definitional frameworks in the Cyber Security Act 2024, the Criminal Code, PGPA Act, Security of Critical Infrastructure Act 2018, the Remuneration Tribunal Act 1973 and the Acts Interpretation Act 1901. Practical compliance and operationalisation of the Rules therefore requires actors to align with classification, clearance processes, PGPA disclosure obligations, disclosure and record‑keeping expectations, and the legislative instrument mechanisms for remuneration determined by the Chair.

The instrument as presented contains a commencement table and a note stating that the table relates only to the provisions of the instrument as originally made and will not be amended to deal with later amendments (s 2(1) table and note). The provided text contains no subsequent amendment provisions, schedules or history entries recording later variations, repeals or consolidations. Therefore, based solely on the text supplied, the amendment history is as follows.

• Original making and date: The instrument is made by the Minister for Home Affairs and dated 27 February 2025 (front matter). The commencement provision provides that the whole of the instrument commences on the later of the start of the day after registration and the commencement of Part 5 of the Cyber Security Act 2024 (s 2).
• No recorded amendments in the instrument: The instrument contains no Part or section marked as amended, no insertions, no repeal clauses, and no historic notes that would indicate subsequent changes. The instrument explicitly warns that the commencement table will not be updated to reflect later amendments (s 2 note).

Practical implications of the instrument’s amendment status

• Monitor for later instruments: As the instrument does not itself record subsequent amendments, those wishing to keep a current understanding must monitor the Federal Register of Legislation and the Department’s publications for any legislative instruments that repeal or vary these Rules or for any legislative changes to the Cyber Security Act 2024 that may change the Board’s remit or the Rules’ effect.
• Legislative instrument authority and variation: Several provisions require the Chair to make legislative instruments (notably remuneration and allowances for Expert Panel members, s 24(2)-(4)). Those legislative instruments, once made, would themselves have commencement and potential amendment histories which are not contained in the present text and should be tracked separately.
• Ministerial and Chair discretion: Given the instrument entrusts operational discretion to the Minister and the Chair (appointments, terminations, remuneration determinations), substantial practical change over time may occur through personnel decisions and legislative instruments rather than through amendments to the instrument itself. That discretion can produce de facto changes in how the Rules operate without formal amendment.

Absent additional documents, there is no recorded litigation history, no recorded amendments, no saved transitional arrangements beyond the commencement table, and no multiplicity of versions recorded within the text supplied. Any practitioner relying on this instrument should therefore check the Federal Register of Legislation and the Department of Home Affairs for:

• subsequent legislative instruments made by the Chair under s 24;
• any amendments to the Rules registered after 27 February 2025;
• any consequential amendments to the Cyber Security Act 2024 (including Part 5) that alter the Board’s scope, membership or powers.

The instrument as provided contains no record of litigation, judicial review or administrative appeals concerning its provisions. There are no cases referenced in the text, no court decisions cited, and no indication of judicial interpretation or dispute about the Rules included in the instrument itself.

What the absence of litigation in the text means practically

• No precedential interpretation: Because there is no litigation history recorded in the instrument, there are no judicially developed interpretive rules specific to these provisions contained in the text. Practical questions about ambiguous terms (for example, what constitutes a conflict under ss 17 and 23, or how strictly the Chair should exercise the non‑interference rule in s 10) will therefore initially be resolved administratively by the Minister, Chair and Board rather than by courts, unless and until a matter reaches judicial review.
• Administrative discretion as a potential source of disputes: The Rules vest substantial discretion in the Minister and Chair on questions such as eligibility satisfaction (ss 13(2), 22(4)), conflict of interest judgments (ss 17, 23(c)), termination for misbehaviour (ss 20(1), 24(7), 27) and remuneration determinations (s 24). Where administrative decisions adversely affect persons with standing, disputes could arise (judicial review of appointment or termination decisions, for instance), but none are recorded in the instrument.
• Future litigation signals to watch for: Potential areas that could give rise to litigation or judicial review applications include termination for misbehaviour or for failure to disclose (ss 20(1)-(2); 24(7); 27), disputes over whether a review would interfere with ongoing investigations (s 10), and challenges to the Chair’s legislative instrument setting remuneration (s 24(2)-(4)). None of these are presently in the instrument text as decided or litigated matters.

Practical next steps for practitioners

• Monitor public records: To determine whether any litigation has arisen since the instrument’s making, practitioners should monitor court databases, administrative law reports and government press releases.
• Document administrative decisions: Given the likely administrative resolution of many operational questions, persons affected by appointment, exclusion or termination decisions should ensure accurate minutes and records (ss 33-34) to create an evidentiary trail suitable for review should a dispute later proceed to litigation.

In the absence of litigation recorded in the Rules themselves, any legal interpretation or challenge will initially depend on administrative processes and existing general principles of public law, but those are not invoked or described in the instrument provided.

This section distils traps and operational surprises in the Rules that are grounded in the instrument’s text. Each item cites the relevant provision and explains the concrete mechanism that creates the risk.

Pre-appointment disclosure to the Minister, and PGPA link (s 15)

• Gotcha: Candidates for standing Board membership must disclose all interests to the Minister before appointment (s 15(1)). After appointment, the PGPA s 29 disclosure must be made to the Minister (s 15(2)-(4)). A Board member is taken not to have complied with PGPA s 29 if they fail to make that disclosure to the Minister under s 15(2) (s 15(4)).
• Practical effect: Failure to disclose can be both a ground for termination (s 20(2)(d)) and a basis for administrative sanctions. Prospective appointees must conduct broad conflict checks pre-appointment.

Subjective tests for conflicts and paid work (ss 17, 23(c))

• Gotcha: The instrument bars Board members from engaging in paid work that the Minister considers conflicts or could conflict with their duties (s 17). For Expert Panel members appointed to a review, the Chair must be satisfied the member will not be engaged in paid work that conflicts or could conflict (s 23(c)).
• Practical effect: The standard is subjective and vested in officials. Experts with ongoing consultancy or private practice may find their ability to participate judged against a broad discretionary test, producing opportunity costs or last‑minute exclusions.

Security clearance bottleneck (ss 13(1)(a), 22(3)(a))

• Gotcha: Eligibility requires an Australian Government security clearance permitting access to information classified at least secret, or an equivalent Commonwealth-recognised clearance (ss 13(1)(a), 22(3)(a)). Obtaining clearance can be time-consuming and may exclude otherwise qualified experts.
• Practical effect: Operational capacity to assemble review panels quickly relies on available cleared experts; s 8 lists capacity as a prioritisation factor. Agencies must plan for clearance lead times.

Chair-controlled remuneration by legislative instrument (s 24)

• Gotcha: Expert Panel members appointed to a review are remunerated and given allowances as determined by the Chair by legislative instrument (s 24(2)-(4)). The instrument also notes that these appointments are not public offices under the Remuneration Tribunal Act 1973 (s 24(1) note).
• Practical effect: Rates and terms of payment will be subject to a separate legislative instrument. Potential appointees will be unable to assume remuneration regimes common to public offices and may face uncertainty until the Chair’s instrument is issued.

Ministerial termination powers and limited procedural checks (s 20)

• Gotcha: The Minister may terminate Board appointments for a broad set of reasons including misbehaviour and when “the Minister ceases to be satisfied” about eligibility matters (s 20(1), (2)(e)). The instrument provides no detailed procedural protections (such as notice or appeal mechanisms) within its text.
• Practical effect: Appointees face the risk of termination by executive decision, with procedural safeguards depending on general public law principles rather than the instrument’s specific provisions.

Non‑interference is judged by the Chair (s 10)

• Gotcha: The Chair determines that a review must not be conducted if, in the Chair’s opinion, it would interfere with or prejudice investigations or proceedings (s 10).
• Practical effect: This concentrates timing control in the Chair and may delay reviews while investigations proceed. Entities subject to a review must coordinate with investigators and may face indefinite delays depending on enforcement activity.

Publication requirements may have reputational effects (s 11)

• Gotcha: The Board must publish notification of a review, including incident details and a description of how it meets the Act’s thresholds (s 11(1)-(2)(c)-(d)).
• Practical effect: Public notification could have reputational, contractual and market consequences for entities subject to an upcoming review even before findings are made.

Absence rules and termination for missing meetings (s 20(2)(b))

• Gotcha: A Board member may be terminated if absent without leave from three consecutive meetings of the Board (s 20(2)(b)). Leave procedures require Chair or Minister involvement (s 18).
• Practical effect: Sitting members must monitor attendance and obtain formal leave to avoid termination for absences that may be due to other commitments.

Discretion over terms of reference (ss 9(1)(c)-(d), 9(2))

• Gotcha: Terms of reference specify clearance levels and additional eligibility requirements for Expert Panel members and may be varied with Ministerial approval (s 9(1), (2)).
• Practical effect: Applicants need to monitor terms of reference for each review; a person eligible for the Panel generally may be excluded from a particular review if they do not meet additional terms of reference criteria.

No explicit coercive powers in the Rules

• Gotcha: The Rules do not state any coercive powers to compel documents or testimony.
• Practical effect: If the Act does not contain such powers either, the Board's practical ability to secure evidence will rely on voluntary cooperation or other statutory authorities, and reviews may be constrained by access to material.

Record and minute obligations (ss 33-34)

• Gotcha: The Board must keep minutes and record decisions taken without meetings. Disclosures and determinations under ss 16 and 25 must be recorded (ss 16(3), 16(6), 25(6)-(7); ss 33-34).
• Practical effect: Robust administrative record-keeping is required and will form the evidentiary basis for any challenge. Poor records can undercut the Board’s decision-making defensibility.

Remuneration silence for standing members

• Gotcha: The instrument prescribes remuneration processes only for Expert Panel members appointed to reviews (s 24). It is silent about remuneration for standing Board members in this instrument.
• Practical effect: Remuneration arrangements for standing members may be set by the Act or other instruments. Prospective appointees should seek clarity on remuneration and conditions before accepting appointment.

These “gotchas” arise from the instrument’s specified allocation of discretion, security clearance prerequisites, disclosure obligations and administrative mechanisms. They illustrate points where participants and affected entities should take proactive steps to avoid adverse outcomes.

This section gives concrete steps, checklists and practical advice grounded in the instrument’s text to help persons and entities comply with the Rules’ requirements. Each item cites relevant provisions.

For prospective Board and Expert Panel appointees

• Confirm security clearance eligibility early (ss 13(1)(a), 22(3)(a)): Obtain or verify that you hold an Australian Government security clearance permitting access to at least secret classified information, or an equivalent Commonwealth‑recognised clearance. Start clearance processes early where required.
• Verify eligibility pathways (ss 13(1)(b); 22(3)(b)): Ensure that you meet at least one of the listed qualification or experience pathways (legal degree and significant legal experience; cyber security/information security qualifications or experience; senior government position; audit/assurance or regulatory experience; incident management/crisis response; critical infrastructure sector experience; academic qualifications).
• Make pre‑appointment disclosures to the Minister or Chair as required (s 15(1); s 25(1)): For Board candidates, disclose all pecuniary and other interests relevant to matters likely to be considered by the Board before appointment (s 15(1)). For Expert Panel candidates, give written notice to the Chair of all interests that conflict or could conflict with duties (s 25(1)).
• Prepare PGPA s 29 disclosures (s 15(2)-(4)): If you are a Board member, ensure PGPA s 29 disclosures are made to the Minister, as the Rules make compliance with PGPA s 29 contingent upon this provision (s 15(4)). Maintain up-to-date registers as required by PGPA rules.
• Avoid conflicting paid work (ss 17, 23(c)): Board members must not engage in paid work that the Minister considers conflicts or could conflict (s 17). Expert Panel members must satisfy the Chair they will not be engaged in conflicting paid work for the particular review (s 23(c)). If you have ongoing private work, discuss potential exclusions and manage conflicts pre-appointment.

For Board and Chair operational compliance

• Establish clear terms of reference for each review (s 9): Specify number of standing members and Expert Panel members, minimum security clearance level for standing members, and any additional eligibility requirements for Expert Panel appointment. Obtain Ministerial approval for any variation to terms (s 9(2)).
• Publish notifications promptly (s 11): As soon as practicable after deciding to conduct a review, publish notification (on the Department’s website or otherwise) including the number of standing members and Expert Panel members, incident details, a brief description of how the incident meets subsection 46(2) of the Act, proposed timeframes, and any other relevant information (s 11(1)-(2)).
• Avoid interfering with investigations (s 10): Before commencing a review, the Chair must assess whether the review would interfere with or prejudice investigations or proceedings. If so, delay the review. Maintain liaison with prosecutorial and investigatory agencies.
• Keep accurate minutes and records (ss 33-34): Record minutes for all meetings and decisions. Where decisions are made without a meeting, follow the Board’s prescribed method and keep a record (s 34). Record disclosures and determinations regarding interests (ss 16(3), 16(6), 25(6)-(7)).
• Convene and attend meetings per rules (ss 29-31): The Chair may convene meetings at any time and must convene a meeting within 30 days of a written request by another member (s 29(2)(b)). Ensure quorate attendance and track absences to avoid termination for unexcused absence (s 20(2)(b)).

For Expert Panel members engaged to assist a review

• Confirm appointment prerequisites in the terms of reference (s 23(a)): Verify you meet any additional eligibility requirements in the review’s terms of reference before accepting appointment.
• Obtain written appointment instrument and understand remuneration instrument (s 24(2)-(4)): Accept that remuneration and allowances will be as determined by the Chair by legislative instrument. Seek a copy of that legislative instrument and the appointment instrument to understand payment timing, tax treatment and any contractual terms.
• Avoid conflicting paid work while assisting a review (s 23(c)): Seek written clarification from the Chair on permitted outside work during the period of the review.

For entities subject to a referral or likely to be reviewed

• Monitor Department website and notifications (s 11(1)): The Board must publish notifications of reviews and provide details and timeframes (s 11(2)). Maintain media and legal teams prepared to respond to public notification.
• Coordinate with investigators and the Chair regarding timing (s 10): If an incident is the subject of law enforcement or regulatory investigation, expect the Chair to defer a review if it would interfere with those processes. Coordinate with relevant authorities to understand staging.
• Prepare documentation and internal process reviews: The Board’s purpose is to make recommendations to government and industry about prevention, detection, response and minimisation (s 5). Prepare a factual chronology, incident response documentation, evidence preservation records, and internal post-incident analyses to facilitate timely review when it proceeds.
• Anticipate reputational and contractual implications of public notification (s 11): Notifications will include incident details and a summary of why the Board considers the matter falls within Act thresholds (s 11(2)(c)-(d)). Plan external communications and contractual notifications accordingly.

Record-keeping and governance checks for all participants

• Maintain conflict registers and minutes: Ensure disclosures of interests are made promptly and recorded in minutes (ss 16(2)-(3); 25(2)-(3), (6)-(7)). Keep auditable records of decisions taken without meetings (s 34).
• Plan for leave and acting arrangements: Obtain and record leave in accordance with the instrument (s 18). The Minister or Chair has defined leave‑granting powers depending on the office (s 18(1)-(2)); the Chair must notify the Minister for leave exceeding three months (s 18(3)).
• Manage potential termination exposures: Understand grounds for termination or revocation (ss 20(1)-(2); 24(7); 27). If subject to adverse action, rely on procedural safeguards available under general administrative law, bearing in mind the Rules themselves do not set out internal appeal processes.

Checklist summary

• For appointees: Verify security clearance, meet eligibility pathways, make pre‑appointment disclosures, ensure PGPA s 29 compliance to the Minister, obtain appointment instrument, review remuneration instrument (for Expert Panel appointees).
• For Chair/Board: Draft and publish terms of reference, publish review notifications swiftly, ensure non-interference with investigations, keep robust minutes, manage meetings and decisions without meetings consistent with s 34, and issue or obtain Chair legislative instruments for remuneration.
• For entities under review: Monitor notifications, prepare incident documentation, coordinate with investigators, plan communications and contractual responses.

These steps are grounded in the instrument’s text (notably ss 7-11, 13-16, 17-20, 22-25, 29-34) and are intended to reduce disclosure failures, avoid conflicts of interest, maintain record integrity, and ensure timely and procedurally compliant engagement with the Board’s review processes.