Security of Critical Infrastructure Act 2018

What does it require?

If you're caught by this law, your obligations include:

1. Register your asset — provide detailed information about who owns and controls the asset (kept secret from the public)
2. Risk management programs — create and follow a formal plan for identifying and managing risks to your asset
3. Report cyber incidents — notify the government when cyberattacks or security breaches occur
4. Enhanced cyber security (for the most critical systems, called "systems of national significance") — stricter security measures, exercises, audits, and vulnerability assessments
5. Enhanced security for telcos — telecommunications companies face additional specific obligations
6. Government intervention powers — the Minister can direct you to take (or stop) certain actions if national security is at risk; in extreme cases, the government can intervene directly in your operations

What can the government do?

• Secretly declare an asset as critical infrastructure (you may be told but the public won't be)
• Demand information about your asset's ownership and operations
• Inspect and audit your security arrangements
• Direct you to change how you operate if there's a security risk
• Take direct action to respond to serious incidents (essentially, step in and run things)

Why does it matter?

Australia has faced increasing cyber threats to essential services. This law is the government's main tool to ensure that if something goes wrong — a cyberattack on the power grid, a foreign takeover of a port, or a breach of hospital systems — there are legal mechanisms to prevent, detect, and respond.

Non-compliance carries civil and criminal penalties. Breaches of some obligations can result in fines of tens of thousands of dollars.

Protected information

Much of the information collected under this law (ownership details, risk programs, incident reports) is treated as sensitive/protected — meaning it can't be freely shared or disclosed. This protects businesses from competitors and protects national security details from bad actors.