Industry Research and Development (Growing Australia’s Cyber Skills Program) Instrument 2021

The instrument centrally operates as a prescription and specification instrument under s 33 of the Industry Research and Development Act 1986 (the Act). Its key statutory concepts, expressed in its text, are the following.

Program (defined by s 5(1) and described in s 5(2)-(3))

• The instrument defines the program by reference to the activities it will fund and its stated purpose. The program is not defined by reference to budget lines, grant criteria, or governance documents within this instrument. Instead s 5(2) identifies two funding channels: the Cyber Security Skills Partnership Innovation Fund, and programmes run by Questacon directed at primary, secondary and tertiary students.

Funding as the operative mechanism

• The program is described as providing funding for the development of cyber security skills (s 5(2)). The only concrete mechanism named in the text by which the program is delivered is funding (s 5(2)(a)-(b)). The instrument does not itself create contracts, grants, or statutory entitlements; it prescribes that the program will provide funding and identifies the objects of that funding.

Purpose statement

• Section 5(3) expressly states the program’s purpose: "to contribute to the development of a skilled cyber security workforce, in order to increase the quantity and quality of cyber security professionals for Australian government and industry." That is the sole policy aim recorded in the instrument.

Specified legislative power (s 6)

• The instrument lists specific constitutional heads of power that the Parliament may rely on in relation to measures associated with the program, including a narrow external affairs linkage to certain international instruments and particular articles. The external affairs link is not general; it is explicitly “as it relates to measures to give effect to Australia’s obligations” under listed conventions and particular articles within them (s 6(c)). The instrument also invokes heads that relate to postal and other services, benefits to students, enterprises peculiarly adapted to government, and territory government.

Definitions and references

• The instrument contains a small definitions section that identifies the Act and five international instruments by name. The definitions adopt the phrase "as in force for Australia from time to time" for the treaties listed, attaching the temporal effect of those treaties to the instrument (s 4).

Statutory economy

• The instrument is limited in scope and textual reach. It is a prescription instrument that ties a programme name and purpose to the statutory power in s 33 of the Act, and sets out constitutional bases for Parliament to make laws related to the programme (s 3, s 5, s 6). It does not contain implementing rules, eligibility criteria, financial delegation, or supervisory mechanisms.

Implication of omissions

• Because the instrument does not address governance, application, selection, reporting or review, those aspects will be determined, if at all, by other Commonwealth instruments, departmental policies, funding agreements or administrative instruments administered under the Act or relevant financial management statutes. The instrument itself only authorises the programme to exist within the framework of s 33 of the Act.

The instrument’s text identifies three classes of affected actors directly, and implies others indirectly through omission and structure.

Directly affected entities

• Prospective recipients of programme funding. The instrument expressly provides funding for two named categories of activity (s 5(2)): (a) the Cyber Security Skills Partnership Innovation Fund (establishment and operation), and (b) programmes run by Questacon for primary, secondary and tertiary students. Entities or individuals who are potential beneficiaries of the Fund or of Questacon programmes are the primary intended recipients. The instrument does not, however, specify eligibility rules or application processes for those recipients; such rules must be located in implementing materials not in this instrument.
• Questacon,The National Science and Technology Centre. Questacon is identified as a vehicle for part of the programme (s 5(2)(b)). That places Questacon in the delivery chain for at least a portion of the funding and activities that fall under the programme’s scope, although the instrument does not set out the terms under which Questacon will receive funding or be accountable.
• Operators and trustees of the Cyber Security Skills Partnership Innovation Fund. The instrument directs funding toward establishment and operation of that named Fund (s 5(2)(a)). The body or bodies that will administer or govern the Fund are not specified in this instrument; whoever is appointed to set up and operate the Fund will be immediately affected because the instrument creates the statutory groundwork for that Fund’s funding.

Indirectly affected actors

• Students at primary, secondary and tertiary levels. The instrument’s stated purpose and the Questacon funding strand target students as a cohort to be prepared for cyber security careers (s 5(2)(b)-(3)).
• Employers in government and industry seeking cyber security professionals. The stated program purpose is to increase the quantity and quality of cyber security professionals for Australian government and industry (s 5(3)). That implies downstream effects for government hiring units and private employers who may recruit programme graduates, though the instrument does not impose obligations on those employers.
• Parliamentary and constitutional actors. By specifying certain constitutional powers in s 6, the instrument affects the legal basis on which Parliament may legislate around the programme and related measures. The specified heads of power include external affairs linked to particular international instruments and articles, and other heads enumerated in s 6(a)-(e).

Administrative actors

• The Minister for Industry, Science and Technology. The Minister made the instrument (ministerial signature and s 3). Administrative responsibility for implementation will fall to the relevant department or agencies, though the instrument does not identify the departmental instruments or delegations that will operationalise funding and administration.
• Commonwealth departments and agencies that will administer grants, funds or contracts connected with the programme. The instrument prescribes funding as the operative mechanism but leaves implementation detail to agencies.

Who is not directly affected in the text

• The instrument does not make changes to tax law, credentialing, immigration policy, or education accreditation standards. It does not alter statutory obligations on employers or create direct entitlements for employers to hire programme graduates. It does not itself impose compliance obligations on private firms beyond any funding agreements they may enter with programme administrators.

Practical effect on affected parties

• Entities intending to apply for Fund support or to participate in Questacon programmes will need to seek out implementing rules and application documents outside this instrument to understand eligibility, compliance requirements, reporting obligations and timing. The instrument creates legal authority for funding streams but does not itself supply the operational detail those actors will need.

The instrument is brief and does not create a regime of duties, rights, offences or detailed obligations. From its text, the following duties and rights can be drawn, together with notable absences.

Rights established by the instrument

• Right to have the programme prescribed under s 33 of the Act. The instrument formally prescribes the Growing Australia’s Cyber Skills Program for the purposes of subsection 33(1) of the Act (s 5(1)). That is a legal act by the Minister creating the programme in statutory terms.
• Right to funding as a described object. The instrument states, in general terms, that the programme provides funding for development of cyber security skills and identifies two activities that funding will support (s 5(2)). This establishes the programme’s funding purpose as a legal object. The instrument does not, however, create enforceable individual entitlements to funding. It does not set minimum funding levels, applicant entitlements, or mandatory allocation formulas.

Duties or obligations created by the instrument

• The instrument itself does not impose specific duties on recipients, administrators, or third parties. It does not create statutory duties such as reporting obligations, compliance requirements, or performance benchmarks within its text.
• The Ministerial and departmental duties implicit in making the instrument. The instrument was made by the Minister under s 33 of the Act (s 3). The text does not detail how the Minister or department must operate the programme, only that the instrument is made under the Act. Any specific administrative duties will arise under other instruments, funding agreements or statutory frameworks not contained within this instrument.

Notable omissions that shape duties and rights in practice

• No eligibility criteria for applicants. The instrument names funding channels but does not specify who may apply or on what grounds. That omission means duties and rights as between applicants and the Commonwealth are deferred to subsequent instruments or documents.
• No governance rules for the named Innovation Fund. Although the instrument prescribes establishment and operation of the Cyber Security Skills Partnership Innovation Fund (s 5(2)(a)), it provides no charter, board composition, conflicts rules, procurement rules, or fiduciary duties in relation to the Fund. Governance duties will be specified elsewhere, if at all.
• No enforcement or penalty clauses. The instrument contains no penalty provisions or administrative sanctions. It does not create offences, civil liability rules, or compliance penalties on its face.

Interpretative anchors

• Purpose clause as interpretive guide. Section 5(3) sets out the programme’s purpose and can function as an interpretative anchor for implementing authorities and for courts or review bodies asked to construe the scope of subsequent instruments or agreements that rely on this instrument. The purpose is to contribute to development of a skilled cyber security workforce to increase the quantity and quality of professionals for government and industry.

Operational consequence

• Because duties and rights are not granularly specified in this instrument, the practical duties of applicants, Fund operators, Questacon, departmental officers and administrators will depend on non-statutory or separately made statutory materials. Practitioners should look to grant guidelines, funding deeds, departmental determinations and, if applicable, the Industry Research and Development Act 1986 for the details that will frame rights and duties in practice.

The instrument contains no express penalty provisions, sanction mechanisms, or enforcement clauses. It is a prescription instrument that identifies a programme and constitutional bases; it does not itself establish offences, fines, or administrative sanctions.

Textual basis for that observation

• The operative sections (s 5 and s 6) set out the programme and specified legislative powers; neither section nor any other provision of the instrument establishes penalties, enforcement procedures, audit rights, or administrative review processes. The instrument’s definitions, commencement provision and authority clause similarly contain no enforcement language (ss 1-4).

Consequences of the absence of penalties in the instrument

• Enforcement and sanction mechanisms, if required, will have to be created or applied by other legal instruments or administrative arrangements. For example, funding agreements, grant deeds, procurement contracts, public service financial management instruments, or the Act itself may contain applicable enforcement mechanisms. The instrument provides the statutory permission to fund the activities but leaves enforcement architecture to implementing measures outside the text.
• Administrative oversight and audit. There is no express requirement within the instrument for reporting, performance measurement or audit of Fund operation or Questacon programmes. Any audit or reporting requirements will depend on the terms of funding agreements and other legal instruments not contained in this document.

Likely enforcement settings that are not in this text

• The instrument does not specify whether recipients will be subject to standard Commonwealth grant terms, which commonly include repayment obligations for misuse, clawback provisions, or specific reporting obligations. Because the instrument does not include these terms, one cannot infer their existence from the text alone.

Practical implication for practitioners

• Lawyers, accountants and compliance officers advising potential applicants should not rely on the instrument for enforcement or penalty guidance. They should obtain the implementing grant guidelines, funding deeds, and departmental terms to identify compliance risks and enforcement exposures. The instrument supplies the legal basis for a programme but not the compliance architecture that will regulate recipient behaviour.

Constitutional and statutory enforcement

• While the instrument specifies constitutional powers that Parliament may rely on (s 6), it does not indicate how courts or administrative bodies will resolve disputes concerning implementation. Any legal challenges or enforcement actions would need to be grounded in applicable law outside this instrument, or in the terms of specific funding agreements or statutory provisions invoked in implementation.

The instrument interacts with other laws primarily by reference and by designating constitutional bases. The instrument is expressly made under s 33 of the Industry Research and Development Act 1986, and it invokes specific constitutional heads that indicate the legal foundations Parliament might use to authorise related measures.

Primary statutory interaction

• Industry Research and Development Act 1986. The instrument states it is made under section 33 of the Act (s 3) and that the program is prescribed for the purposes of subsection 33(1) (s 5(1)). The instrument therefore operates within the statutory framework created by the Act. The instrument’s legal effect is to prescribe a programme under the Act; it does not purport to amend the Act or to create exceptions to the Act’s substantive provisions.

Constitutional heads specified (s 6)

• The instrument lists specific heads of power from section 51 of the Constitution and other constitutional provisions, thereby signalling the constitutional bases Parliament may use when making laws in relation to the programme (s 6). Those heads include:
  • Postal, telegraphic, telephonic and other like services (par 51(v)) (s 6(a));
  • Provision of benefits to students (par 51(xxiiiA)) (s 6(b));
  • External affairs (par 51(xxix)), limited to giving effect to specified international obligations (s 6(c));
  • Enterprises and activities peculiarly adapted to the government of a nation (par 51(xxxix)) and section 61 of the Constitution (s 6(d));
  • Government of a Territory (s 122) (s 6(e)).

External affairs and international instruments (s 4 and s 6(c))

• The instrument explicitly links the external affairs power to a set of international instruments listed in the definitions in s 4 and referenced in s 6(c). The listed instruments are:
  • Convention on the Elimination of All Forms of Discrimination Against Women (as in force for Australia from time to time) (s 4);
  • Convention on the Rights of the Child (as in force for Australia from time to time) (s 4);
  • International Covenant on Economic, Social and Cultural Rights (as in force for Australia from time to time) (s 4); and
  • Two International Labour Organization Conventions (Employment Policy, and Vocational Guidance and Vocational Training in the Development of Human Resources) (s 4).
• Section 6(c) makes the external affairs linkage precise by stating that the Parliament’s external affairs power is specified "as it relates to measures to give effect to Australia’s obligations under one or more" of the listed instruments, and it identifies particular articles or provisions within those instruments that are relevant (s 6(c)(i)-(v)). The instrument therefore anchors the programme to international obligations as a potential legislative foundation.

Interaction by omission

• The instrument does not purport to alter taxation law, education law, immigration law, procurement law, or financial management law. Where the programme will involve funding, standard Commonwealth financial management statutes and grant rules will likely apply, but the instrument itself is silent on those points. Practitioners should assume that the programme will be delivered subject to the usual Commonwealth frameworks unless and until implementing instruments state otherwise.

Use of the instrument as an interpretive or enabling device

• As an instrument made under s 33 of the Act, this instrument is an enabling device that prescribes the programme and signals constitutional bases. It does not itself bind other bodies such as Questacon beyond naming it as a delivery partner. The programme’s interactions with other laws , for example, whether a grant to Questacon is subject to particular procurement rules, whether the Fund must comply with Commonwealth financial accountability laws, or whether Fund recipients must meet privacy and workplace laws , will be governed by those separate legal frameworks and the terms of any funding agreements.

Practical advice for lawyers and compliance officers

• Because the instrument is high level, those advising clients should locate the Act’s relevant provisions (not included in this instrument) and identify implementing documents, such as grant guidelines, funding deeds and departmental determinations that operationalise the programme and which will set the binding legal obligations on recipients and administrators.

The instrument contains limited internal amendment-relevant material and provides only its original commencement details. The text itself supplies the following amendment-history facts.

Original making and commencement

• The instrument was made by the Minister for Industry, Science and Technology and dated 29 April 2021 (signature block and opening recital). The commencement table in s 2 records that "the whole of this instrument" commences "the day after this instrument is registered," which is recorded as 5 May 2021 in the commencement table (s 2 and the commencement table). The instrument carries a note that the commencement table relates only to the instrument "as originally made" and will not be amended in the instrument itself to reflect later amendments (s 2(2) note).

Notes about later amendments

• Section 2(2) contains a standard drafting note stating that any information appearing in column 3 of the commencement table is not part of the instrument and that such information may be edited in any published version. That note also signals that the commencement table will not be amended to deal with later amendments to the instrument. The instrument does not itself contain any subsequent amendment entries or historical notes of amendment.

Absence of subsequent amendment provisions in the instrument

• The instrument does not include any provisions that amend or repeal existing legislation, nor does it include a schedule recording subsequent amendments. It is a stand-alone prescription instrument made under s 33 of the Act.

Practical consequences for researchers

• The instrument’s own amendment history record is minimal. To determine whether the instrument has been subsequently amended or repealed, practitioners must check the legal instruments register, the Federal Register of Legislation, or other official repositories. The instrument’s note that the commencement table relates only to the instrument "as originally made" (s 2(2) note) indicates that the version supplied is the original text from 2021 and that later amendments, if any, would be recorded elsewhere.

No retroactive amendments recorded in text

• The instrument contains no clauses purporting to operate retrospectively, and the commencement clause indicates prospective commencement the day after registration. There is therefore no textual basis within the instrument for retroactive application.

Recordkeeping and citation

• For citation and version tracking, the instrument should be cited by its short name in s 1 and by its making date where relevant: The Industry Research and Development (Growing Australia’s Cyber Skills Program) Instrument 2021, made 29 April 2021, commenced 5 May 2021.

The instrument itself contains no litigation history or judicial citations. It names no cases and records no judicial determinations, and the text does not report any challenges or litigation relating to its provisions.

What the instrument discloses

• There are no references to judicial review, disputes, or litigation in the instrument’s text. The instrument is a statutory prescription without embedded dispute-resolution clauses or enforcement provisions which might have generated litigation referenced in the instrument.

What this means for practitioners

• The instrument’s silence on litigation history means practitioners must search external legal databases, court records and administrative tribunal files if they need to know whether the instrument, the programme, the Cyber Security Skills Partnership Innovation Fund, or related Questacon programmes have been the subject of challenges. The instrument itself provides no record of such activity.

Potential litigation vectors not addressed in the text

• Although the instrument contains no litigation history, areas that could, in principle, attract legal disputes in the course of implementation include:
  • Challenges to the validity of implementing measures or grant agreements entered pursuant to the programme, if a claimant alleges ultra vires action under the Act or the Constitution;
  • Disputes over procurement or selection processes for Fund recipients if contractual processes are contested;
  • Administrative law challenges to departmental decisions implementing the programme, where applicants or unsuccessful bidders seek merits review or judicial review; and
  • Contractual disputes arising under funding agreements or deeds, for example over payments, deliverables or reporting obligations.
• The instrument does not supply evidence that any of these litigations have occurred, and it does not authorise any specific procedural or dispute-resolution regime for such matters.

Advisory note for litigators

• To build a litigation record or to advise on prospective challenges, practitioners must examine the Act (beyond s 33), the text of any enabling or implementing documents, and the terms of individual funding agreements and grant guidelines. The instrument is a starting point for locating the programme’s legal architecture but not a record of dispute resolution.

This instrument is concise and creates legal authority for a programme, but its brevity creates a number of practical pitfalls and points of uncertainty. The following are concrete risks and structural features practitioners should note, grounded in the instrument’s text.

1. The instrument prescribes funding but provides no operational detail (s 5(2))

• Gotcha: The programme is said to "provide[] funding" and names two delivery strands (s 5(2)), but the instrument does not contain eligibility criteria, application procedures, grant terms, amounts, selection criteria, timelines, reporting obligations or clawback provisions. Practitioners seeking to advise applicants or administrators cannot rely on this instrument alone to understand what is required.

2. No governance framework for the Cyber Security Skills Partnership Innovation Fund (s 5(2)(a))

• Gotcha: While the instrument authorises establishment and operation of the named Fund, it does not specify who will govern the Fund, how decisions will be made, what conflicts of interest rules apply, or how contributions will be allocated. Interested parties must locate the Fund’s constituting documents to understand governance and fiduciary duties.

3. Questacon is named as a delivery partner, but the instrument does not set contractual or accountability terms (s 5(2)(b))

• Gotcha: Questacon is explicitly included, but no funding conditions, performance measures, or reporting regimes are in the instrument. This creates uncertainty about how Questacon’s programmes are to be funded and assessed.

4. External affairs linkage is limited and particularised (s 6(c))

• Gotcha: The instrument’s reliance on the external affairs power is not open-ended; it is limited to giving effect to Australia’s obligations under specified international instruments and specified articles within them (s 6(c)(i)-(v)). That limitation can affect the constitutional foundation of measures that are connected to the programme. Practitioners should note the particular articles referenced rather than assume a broad external affairs basis.

5. Definitions refer to treaties "as in force for Australia from time to time" (s 4)

• Gotcha: The operative reference to treaties is dynamic. If Australia’s treaty obligations change over time, the external affairs linkage and the interpretive context cited in s 6(c) may shift in step, because definitions adopt "as in force for Australia from time to time" language (s 4). This can affect interpretation of the specified legislative power over time.

6. Commencement and the "as originally made" note (s 2)

• Gotcha: The commencement table includes a note that it relates only to the provisions "as originally made" and will not be amended within the instrument to reflect later amendments (s 2(2) note). If amendments are later made, the instrument’s internal table will not necessarily show them; researchers must consult official registers for later versions.

7. No penalties or enforcement provisions (see Penalties and enforcement)

• Gotcha: The instrument creates no enforcement regime. Any penalties, sanctions, reporting obligations, audit access or compliance obligations will need to be found in implementing documents. Advisers should not assume standard Commonwealth grant conditions apply without checking the grant guidelines or funding deeds.

8. Narrow scope provides limited private-law rights

• Gotcha: The instrument does not create enforceable entitlements to funding for individuals or bodies. It establishes a programme and funding purpose but does not confer proprietary or contractual rights on potential applicants. Any enforceable rights will arise from subsequent funding instruments.

9. Reliance on other statutory and administrative instruments

• Gotcha: Since the instrument is an enabling prescription, practitioners must identify the full governance chain: departmental funding rules, grant guidelines, funding agreements and possible instruments made under the Act. Failing to locate those implementing instruments will leave advisers and clients exposed to misunderstanding obligations and deadlines.

10. The instrument’s named purposes may be used as interpretive guide in future disputes

• Gotcha: Section 5(3) sets the programme’s purpose and could be relied upon to interpret the scope of powers or to challenge implementing measures that depart from that declared purpose. Stakeholders should assess whether proposed activities align with the stated purpose to avoid potential legal challenge.

The instrument itself contains little in the way of prescriptive compliance steps. It establishes the programme and identifies funding channels and purpose, but it does not set out compliance obligations, eligibility criteria or reporting regimes. From the instrument’s content the compliance pathway is therefore procedural and investigative rather than directive.

Step 1 , Treat this instrument as authorising the programme, not as the operative grant instrument (ss 3, 5)

• The instrument prescribes the programme under s 33 of the Act (s 5(1)) and declares the programme will provide funding for specified activities (s 5(2)). However, compliance obligations are not set out here. Parties should regard this instrument as creating the legal basis for funding streams rather than as a source of compliance rules.

Step 2 , Obtain the implementing instruments and documentation

• Because the instrument does not contain eligibility or operational rules, potential applicants and delivery partners must locate the implementing grant guidelines, funding deeds, expressions of interest, procurement documents, and any departmental determinations that set out the terms and conditions of funding. The instrument alone does not contain these materials; they will be published and administered separately.

Step 3 , Analyse the purpose clause when designing proposals (s 5(3))

• Section 5(3) defines the programme’s purpose: to contribute to the development of a skilled cyber security workforce and to increase the quantity and quality of cyber security professionals for government and industry. Proposals and applications should be clearly tied to that purpose, because it is the statutory objective recorded in the prescribing instrument and may inform selection criteria and evaluation.

Step 4 , For Fund operators, request the Fund constitution and governance documents (s 5(2)(a))

• If advising an entity involved in establishing or operating the Cyber Security Skills Partnership Innovation Fund, obtain the Fund’s constituting documents, governance charter, conflict of interest policies and financial management arrangements. The instrument authorises establishment and operation, but it does not provide governance detail.

Step 5 , For Questacon-related work, secure the terms of the Questacon funding agreement (s 5(2)(b))

• Where services or programmes are to be delivered via Questacon, obtain and review the specific funding agreement or memorandum of understanding that sets out deliverables, performance measurement, intellectual property arrangements, reporting obligations and payment schedules.

Step 6 , Check for financial management, procurement and audit requirements

• Although not specified in the instrument, standard Commonwealth frameworks may apply to any funding. Practitioners should confirm whether the relevant Commonwealth Financial Management and Accountability instruments, Commonwealth grant rules, or procurement standards apply to the funding instrument in question. The instrument does not itself stipulate these frameworks.

Step 7 , Monitor the external affairs link if international obligations are invoked (s 6(c))

• Where a proposed measure or funding activity is justified by the external affairs power, the instrument specifies the particular international instruments and articles that are relevant (s 6(c)(i)-(v)). If compliance or reporting obligations are premised on giving effect to any of those international instruments, practitioners should review the relevant articles cited in the instrument and consider their application to proposed activities.

Step 8 , Confirm commencement and any amendment status (s 2)

• The instrument commenced on 5 May 2021 as recorded in the commencement table (s 2). Practitioners should verify whether later amendments have been made by consulting the Federal Register of Legislation or other official registers rather than relying on the instrument’s original table, which the instrument says will not be amended to show later changes (s 2(2) note).

Step 9 , Build compliance into contracts and funding deeds

• Once the implementing documents are obtained, advise clients to ensure that funding deeds and contracts contain explicit compliance obligations, reporting requirements, procedures for breach, and audit and remedy clauses. Because the instrument itself does not set these terms, they will need to be negotiated and documented.

Step 10 , Prepare for documentation and evidence retention

• Although the instrument does not specify reporting, likely implementing grant terms will require evidence of expenditure, deliverables and outputs linked to the programme’s purpose. Practitioners should advise clients to maintain contemporaneous records, deliverable reports and financial documentation to satisfy future audits or reviews.

Final practical note

• The instrument prescribes a programme and identifies delivery strands and a purpose, but it is not an operational manual. Compliance therefore requires obtaining and following the implementing instruments and contractual documents that will define rights, duties and sanctions. This instrument should be treated as the statutory authorisation that gives rise to those implementing documents, but not as the substitute for them.