Maritime Transport and Offshore Facilities Security (Incident Reporting) Instrument 2026

This instrument, the Maritime Transport and Offshore Facilities Security (Incident Reporting) Instrument 2026, is made under subsection 182(1) of the Maritime Transport and Offshore Facilities Security Act 2003 (the Act). It replaces the 2018 instrument of the same name, which is repealed in full by Schedule 1. Mechanically, the instrument prescribes the information that must be included in two categories of reports required under Part 9 of the Act: security incident reports (covering maritime transport or offshore facility security incidents) and cyber security incident reports. It also specifies the manner and timeframes for making those reports. For security incident reports, the instrument sets a 24‑hour deadline from when an industry participant first becomes aware of an incident, with a requirement to provide any missing information within 24 hours of obtaining it. For cyber security incident reports, the deadlines are tighter and differentiated by severity: 12 hours for a significant cyber security incident, and 72 hours for a relevant cyber security incident (s 9(3)). The instrument also provides a fallback mechanism for cyber security reports if the industry participant does not consent to share the report submitted via the Australian Cyber Security Centre’s portal with the Secretary. In that case, the information specified in section 8 must be submitted separately via the Department’s online form (s 9(2)). The instrument applies to reports made on or after its commencement date, and also governs additional information provided in connection with reports made before commencement (s 10). The practical effect is to impose a clearer, technology‑friendly reporting framework with tight statutory deadlines. The cost of compliance - in terms of personnel time, systems capability, and potential legal liability for late or incomplete reports - falls squarely on maritime industry participants. There is no exemption for small operators, no grace period for systemic failures, and no compensation for the burden. The instrument itself does not create new substantive obligations beyond what the Act already requires; it fills in the details the Act left to delegated legislation. The repeal of the 2018 instrument means that any reporting guidance or precedent built on the old form is superseded.

The instrument defines several key terms by reference to the Act, which in turn defines concepts such as “cyber security incident”, “maritime transport or offshore facility incident”, “relevant impact”, and “significant impact”. The critical distinction is between a standard “security incident” (a maritime transport or offshore facility security incident) and a “cyber security incident”. The instrument then creates two parallel reporting regimes with different triggers and deadlines. Within the cyber security incident category, the instrument further distinguishes between a “relevant cyber security incident” and a “significant cyber security incident”. The deadlines differ according to that classification: 12 hours for significant, 72 hours for relevant. The Act’s definitions of “relevant impact” and “significant impact” are not reproduced in the instrument, so an industry participant must consult the primary legislation to determine which threshold applies. That creates an interpretive burden: the operator must first ascertain whether the incident is a security incident or a cyber security incident under the Act, then within the cyber class determine the severity level. The instrument also defines “unlawful interference” by reference to the Act, and a threat of unlawful interference is treated as a security incident requiring specific additional information (s 6(3)). The concepts of “industry participant” (defined in the Act as “maritime industry participant”) and “ISSC” (International Ship Security Certificate) are also imported. The distinction between the two reporting channels for cyber incidents is a notable design feature: the primary channel is the Australian Cyber Security Centre’s reporting portal (s 9(1)), but if the participant does not consent to share that report with the Secretary, a separate submission must be made to the Department via its own online form. This bifurcation may create confusion and duplication. An industry participant who wishes to limit government data sharing may find itself submitting two reports - one to ACSC and one to Home Affairs - which is antithetical to streamlined compliance. The instrument does not define “consent” or how it is given or withheld. The term “relevant impact” and “significant impact” are central to the cyber reporting obligations, but the instrument provides no guidance on their meaning. That is a gap likely to generate uncertainty and, potentially, disputes with regulators about when the clock started.

The primary dutyholders are “industry participants”, which the Act defines as “maritime industry participants”. That term is not defined in the instrument but is taken from section 4 of the Act. It generally includes owners, operators, and persons in control of ships or offshore facilities that are subject to the Act, as well as port operators and others involved in maritime transport. The instrument’s reporting obligations therefore apply to a broad spectrum of entities: shipping companies, port authorities, offshore facility operators, stevedoring firms, and any person required to have a maritime security plan under the Act. The instrument also reaches, indirectly, any employee, contractor, or agent of an industry participant who is tasked with making the report or providing information. Section 6(2)(a) requires the name, contact number and email address of the person making the report, not just the entity. That means individual employees may be named in reports, which has privacy and liability implications. Third parties who bring an incident to an industry participant’s attention are also referenced: s 6(8) requires that the report identify the third party and their employer, if applicable. This may deter external whistleblowers or security researchers from reporting vulnerabilities if they know their identity will be passed to the Secretary. The instrument’s jurisdictional scope is tied to the Act, which applies to security regulated ships in Australian waters, Australian flagged ships anywhere, and certain offshore facilities in Australian waters. That means foreign‑flagged ships in Australian ports will have reporting obligations through their local agents or operators. The instrument does not provide any exemption for small vessels, low‑risk operations, or entities with limited administrative capacity. The compliance burden is identical regardless of the size of the operator. The ACSC portal requirement for cyber security incident reports may also affect entities that have no existing relationship with that agency. The Department of Home Affairs, as the recipient of reports, is affected in its capacity as regulator, but the instrument imposes no duties on the Department beyond receiving and processing reports. The instrument does not create rights for third parties to access reports or enforce compliance.

The central duty is the obligation to make a report within a prescribed time after becoming aware of a security incident or cyber security incident. For security incidents, the report must be made “as soon as possible, but no later than 24 hours after they first become aware of the incident” (s 7(1)). If information required by section 6 is missing at the time of the initial report, the industry participant must provide that supplementary information within 24 hours of obtaining it (s 7(2)). For cyber security incidents, the duty is split: a significant cyber security incident triggers a 12‑hour deadline, a relevant cyber security incident a 72‑hour deadline (s 9(3)). The participant must report via the ACSC portal (s 9(1)), and then, if consent to share that report with the Secretary is not given, must submit the section 8 information via the Department’s online form (s 9(2)). Supplementary information for cyber incidents must be provided within 24 hours of obtaining it, with the same consent condition applying to the sharing pathway (s 9(4), (5)). The instrument does not grant any right to delay a report while investigating or verifying the incident. The term “becomes aware” is not defined, creating potential disputes about when constructive knowledge arises for an organisation. There is no de minimis exemption; every reportable incident must be reported. The instrument specifies the minimum information content: for security incidents, a comprehensive list in s 6(2) including details of the incident, whether it was a threat or actual interference, steps taken to prevent recurrence, and additional information if the incident involved a ship, offshore facility, prior reporting, or a third‑party notification. For cyber incidents, the content is shorter: name, employer details, state/postcode, date/time identified, whether ongoing, nature/type, and detailed description (s 8(2)). The instrument permits both oral and written channels for security incident reports (s 7(3)). However, if an oral report is made by phone, the participant must then provide the written information within 24 hours via the Department’s online form or email (s 7(4)). That creates a double‑reporting obligation for those who initially phone in. The instrument does not confer any right on the industry participant to receive feedback, a receipt, or confirmation of receipt from the Secretary. There is no right to suspend reporting while seeking legal advice. The duties are unilateral; the rights of the participant are essentially limited to choosing among the permitted reporting channels (subject to the ACSC portal requirement for cyber incidents) and deciding whether to consent to sharing of the cyber report.

The instrument itself does not create penalties. It is made under subsection 182(1) of the Act, which gives the Secretary power to make prescribed instruments, including specifying reporting requirements. The enforcement teeth lie in the Act. Part 9 of the Act (including Division 4) contains the obligation to report, and the Act provides for civil penalties and offences for non‑compliance or for providing false or misleading information. The specific penalty provisions are not reproduced in this instrument, so a reader must consult the Act. Typically, the Act’s penalty provisions for failing to report, or for reporting falsely, may involve fines or other administrative sanctions, but this instrument is silent. The Department’s enforcement approach is not indicated in the instrument. The instrument does impose a strict time obligation: “must make the security incident report as soon as possible, but no later than 24 hours”. That is a mandatory duty; there is no exception for force majeure, public holidays, or systems failure. Late reporting, even by a few minutes, could technically constitute a breach of the statutory duty. In practical terms, the 24‑hour and 12‑hour windows are tight, especially for cyber incidents where the participant may be in the middle of containment and remediation. The instrument also requires that if additional information is obtained, it must be provided within 24 hours. Failure to provide that additional information on time is also a breach. There is no safe harbour or voluntary self‑disclosure incentive. The Act likely provides for defences such as reasonable excuse, but that is not addressed in the instrument. Because the instrument is delegated legislation, it cannot create new criminal offences; it only prescribes details for compliance with the Act. The enforcement risks are therefore concentrated in the Act, and the instrument’s role is to make the reporting requirements more specific and thus easier to enforce. An industry participant that mistakenly classifies a significant cyber incident as merely relevant, and reports within 72 hours rather than 12, may face a penalty for late reporting if the regulator disagrees with the classification. The instrument does not provide a mechanism for disputing calls on severity. The lack of any penalty discussion in the instrument itself does not reduce the real liability; it means that the penalties are a hidden compliance cost that must be found elsewhere.

The instrument is expressly made under the Maritime Transport and Offshore Facilities Security Act 2003 and is subject to that Act’s provisions. It is a legislative instrument, not a primary act, and therefore must be read consistently with the Act. The instrument is also linked to the Transport Security Amendment (Security of Australia’s Transport Sector) Act 2025, which inserted or amended provisions in the Act that this instrument supports. The instrument commences on the later of the day after registration and “immediately after the commencement of Part 1 of Schedule 1” of that amending Act (s 2). That means the instrument is designed to come into effect as part of a broader reform of transport security reporting. There is potential interaction with the Security of Critical Infrastructure Act 2018 (SOCI Act) and its related rules. Cyber incidents affecting offshore facilities or maritime infrastructure may also be reportable under the SOCI Act’s mandatory incident reporting obligations for critical infrastructure assets. The same incident could trigger dual reporting duties under both regimes, with different thresholds, timeframes, and recipients (Home Affairs for this instrument, the Cyber and Infrastructure Security Centre for the SOCI Act). The instrument does not recognise or coordinate with those overlapping obligations. Similarly, the Privacy Act 1988 may apply to the personal information (names, contact details, employer) that must be collected and reported under s 6(2) and s 8(2). Industry participants will need to ensure that their reporting practices do not breach Australian Privacy Principles, especially if they include third‑party information without consent. The instrument’s reference to the ACSC portal and the Department’s online form means that data will be handled by multiple Commonwealth agencies. The instrument does not address how that data will be used, stored, or shared beyond the Secretary. It also interacts with maritime security plans required under the Act; the reporting obligations supplement the incident response procedures that those plans must contain. The repealing and saving provisions in Part 3 mean that reports made before commencement under the 2018 instrument are still governed by that instrument unless additional information is provided after commencement, in which case the new instrument applies to that additional information. That preserves continuity but may create confusion about which version applies to partial follow‑up reports.

This instrument is a standalone instrument that repeals and replaces the Maritime Transport and Offshore Facilities Security (Incident Reporting) Instrument 2018. The 2018 instrument is wholly repealed by Schedule 1. The instrument does not amend any other instruments. It was made on 26 March 2026 by Matthew Pedler, Acting First Assistant Secretary, as delegate of the Secretary of the Department of Home Affairs. The authority cited is subsection 182(1) of the Act. The instrument itself has not been amended since its making. As a new legislative instrument, it has no prior amendment history of its own. The repeal of the 2018 instrument means that any reporting templates, guidance notes, or stakeholder materials referencing the 2018 instrument are no longer current. Industry participants who have built compliance systems around the 2018 instrument must update those systems. The instrument contains transitional provisions at s 10, but those only cover reports made after commencement and additional information for pre‑commencement reports. There is no grandfathering for the 2018 instrument’s content requirements. Any report made after commencement, even if the incident started before commencement, must comply with the new information requirements and new timeframes. That could catch operators who rely on prior reporting procedures. The instrument also does not provide a table of changes or a summary of differences from the 2018 instrument. To identify what has changed, a practitioner would need to compare the two instruments side by side. The new instrument introduces a separate cyber security incident reporting regime with its own timelines and portal requirements; that was likely not present in the 2018 instrument in the same detail. The 2018 instrument is not provided in the source text, so this cannot be verified, but the structural differences are evident from the 2026 instrument’s content.

The source material does not record any litigation regarding this instrument. It is newly made (March 2026) and has not been tested in court. There is no reference to any case law in the instrument itself. The predecessor 2018 instrument may have been subject to judicial consideration, but the source does not mention any. The absence of litigation history does not imply that the instrument is uncontroversial; it simply means no decided cases involving this specific instrument are cited. Challenges could arise on administrative law grounds (e.g., procedural fairness in reporting, scope of delegated power) or on interpretation of the Act’s definitions. Because the instrument is delegated legislation, it could be challenged as ultra vires if it went beyond what subsection 182(1) authorises. The instrument specifies “information that must be included” and “the way in which a report is to be made”, which are squarely within the power. However, the definitional reliance on concepts such as “significant impact” and “relevant impact” from the Act could generate disputes about whether the Secretary has correctly prescribed the content or whether the instrument impermissibly expands the reporting duty. No such litigation is reported. Similarly, the requirement to report via the ACSC portal and to manage consents may be challenged as imposing an additional burden not contemplated by the Act, but again, no cases exist. Practitioners should monitor the Administrative Appeals Tribunal and Federal Court for any reviews of enforcement decisions that may touch on the instrument’s validity or application. For now, the litigation history is a blank slate.

Several provisions in this instrument might trap unwary industry participants. First, the double‑reporting obligation for security incident reports made by phone: s 7(4) requires that if the initial report is oral via the 1300 number, the participant must also submit the written information (the full s 6 content) within 24 hours via the online form or email. An operator who phones in quickly and assumes the matter is closed will breach the duty unless they follow up in writing. Second, the consent mechanism for cyber incident reports is ambiguous. An industry participant that reports via the ACSC portal might have its report automatically shared with the Secretary unless it expressly withholds consent. If it withholds consent, it must then separately submit the same information to the Department via another online form, leading to duplication. The instrument does not state how consent is given or withdrawn; the ACSC portal’s design will determine the practical effect. If the portal defaults to sharing, a participant must affirmatively opt out. Third, the definitions of “relevant” and “significant” cyber incident are imported from the Act but not reproduced. A participant may misclassify an incident and use the wrong deadline. The 12‑hour clock for significant incidents is extremely tight. Missing it, even by an hour, violates the duty. There is no grace period for after‑hours or weekends. Fourth, the requirement to provide “a detailed description of the security incident” (s 6(2)(k)) and the steps taken to prevent recurrence (s 6(2)(l)) may compel the participant to disclose information that could be self‑incriminating or commercially sensitive. There is no explicit protection for legal professional privilege or without‑prejudice communications in the instrument. The Secretary may use the report for enforcement purposes. Fifth, if a third party brings an incident to an industry participant’s attention, the participant must report the third party’s name and employer (s 6(8)). That could discourage external reporting of vulnerabilities. Sixth, the 24‑hour deadline for providing supplementary information (s 7(2)) applies even if the participant learns the information long after the initial 24‑hour report. If a piece of information is not obtained until months later, the participant still must report it within 24 hours of obtaining it. There is no limitation or materiality threshold. Seventh, the instrument applies to additional information provided in connection with a Division 4 report made before commencement (s 10(b)). That means if an operator is supplying follow‑up information on an incident reported under the old 2018 instrument, that follow‑up must comply with the new instrument’s requirements (e.g., reporting via the portal, not by email if the Department changes its preferred method). Eight, the requirement to report “the name of the employer of the person making the report (where applicable)” (s 6(2)(c)) may be confusing for sole traders or self‑employed individuals. They may not have an employer, but the provision says “where applicable”. The instrument does not say what to do if not applicable - presumably omit, but that could be considered incomplete.

Compliance with this instrument requires a systematic approach. First, an industry participant must ensure its staff understand the difference between a security incident and a cyber security incident under the Act, and within the cyber category, the distinction between a relevant and a significant impact. Since the instrument does not define those terms, the participant should review the Act and any accompanying guidance from Home Affairs. Training should emphasise the strict timelines: 24 hours for security incidents; 12 hours for significant cyber incidents; 72 hours for relevant cyber incidents. The 24‑hour deadline for supplementary information also applies. Second, the participant should establish internal procedures for immediate notification of any potential incident to a designated reporting officer. The officer must have authority to decide classification and report quickly. The “becomes aware” trigger means that knowledge of an incident by any employee or agent may be imputed to the industry participant. Implement a policy that any employee who suspects a security incident must escalate immediately, even if details are incomplete. Third, prepare templates for the information required by sections 6 and 8. For security incidents, the template should include fields for all items in s 6(2) and the additional items in subsections (3) to (8) as applicable. For cyber incidents, a separate template should cover the s 8(2) fields. Pre‑fill known details such as company name, contact details, and the preferred reporting channel. Fourth, decide which reporting channels will be used. For security incidents, the options are phone (1300 791 581), online form, or email. Note that if the phone is used, a follow‑up written report is mandatory within 24 hours. For cyber incidents, the primary channel is the ACSC portal. The participant must decide in advance whether to consent to sharing that report with the Secretary. If consent is not given, a separate submission to the Department’s form is required within the same deadline. Document the decision. Fifth, maintain a log of all reports made, including date, time, channel, and a copy of the information submitted. This is crucial for demonstrating compliance if the Secretary investigates a delay. Sixth, ensure that any additional information obtained after the initial report is provided within 24 hours. Set reminders and assign responsibility. Seventh, if a third party notifies the participant of an incident, the participant must inform the third party that their identity may be disclosed to the Secretary. Obtain consent or at least give notice. Eighth, review existing privacy policies to ensure that collecting and reporting personal information (names, contact details, employers) is compliant with the Privacy Act. Ninth, coordinate with any overlapping reporting obligations under the SOCI Act or other regimes. Where possible, align internal reporting protocols to avoid missing deadlines due to confusion. Tenth, because the instrument repeals the 2018 instrument, destroy or archive old templates and update all internal documentation. Ensure that any automatic systems or emails referencing the old instrument are updated with the new deadlines (especially the 12‑hour cyber deadline, which is new). Finally, monitor the Department’s website for any revisions to the reporting forms or portal addresses, as the instrument specifies URLs that may change. The Department may also issue guidance that interprets “significant impact” or “relevant impact”; such guidance may be relied upon in enforcement but is not binding. The safest approach is to report promptly whenever an incident could reasonably meet the threshold.