41BACyber security information for which communication and use is limited by this Division

#### 41BA Cyber security information for which communication and use is limited by this Division (1) This Division applies to information (limited cyber security information) if: (a) the information relates to: (i) a cyber security incident that has occurred or is occurring; or (ii) a cyber security incident that may potentially occur; and (b) the information has been acquired or prepared by ASD in a circumstance mentioned in subsection (2); and (c) the information is not excepted under subsection (3). (2) This Division only applies to information that ASD has acquired or prepared in one of the following circumstances: (a) the information has been voluntarily provided to ASD, in the performance of its functions, by, or on behalf of, an entity (the impacted entity) that: (i) is, was or could reasonably be expected to be directly or indirectly impacted by the cyber security incident; or (ii) would be or would reasonably be expected to be impacted by the cyber security incident that may potentially occur; (b) the information has been acquired or prepared by ASD, in the performance of its functions, with the consent of the impacted entity; (c) the information has been: (i) acquired by the National Cyber Security Coordinator under subsection 35(2) of the Cyber Security Act 2024 in relation to the cyber security incident; and (ii) disclosed to ASD under subsection 38(1), 39(2) or 40(2) of that Act. (3) This Division does not apply to information if: (a) the information has been provided to the Commonwealth about the cyber security incident to comply with: (i) a requirement in Part 3 of the Cyber Security Act 2024; or (ii) a requirement in Part 2B of the Security of Critical Infrastructure Act 2018; or (iii) a requirement under the Telecommunications Act 1997; or (iv) a requirement under a prescribed law; or (b) the information has already been lawfully made available to the public; or (c) the information is about an entity and has been de‑identified so that it is no longer about an identifiable entity or an entity that is reasonably identifiable. (4) A cyber security incident is: (a) one or more acts, events or circumstances: (i) of a kind covered by the meaning of cyber security incident in the Security of Critical Infrastructure Act 2018; or (ii) involving unauthorised impairment of electronic communication to or from a computer, within the meaning of that phrase in that Act, but as if that phrase did not exclude the mere interception of any such communication; or (b) the discovery of unintended or unexpected vulnerabilities in a computer, computer data or a computer program that, if exploited, would result in a cyber security incident within the meaning of paragraph (a). (5) For the purposes of this Division: (a) Commonwealth body has the same meaning as in the Cyber Security Act 2024; and (b) Commonwealth enforcement body has the same meaning as in the Cyber Security Act 2024; and (c) entity has the same meaning as in the Cyber Security Act 2024; and (d) State body has the same meaning as in the Cyber Security Act 2024.