//
© 2026 Zoe. All rights reserved.
Zoe is a legal information platform. Always consult the Federal Register of Legislation for authoritative text.
Commonwealth act
The Security of Critical Infrastructure Act 2018 creates a national framework to protect Australia’s essential services and systems from cyberattack, sabotage and foreign interference. It affects a wide range of businesses—utilities, telcos, banks, hospitals, ports, data/cloud and others—with obligations to register assets, run risk‑management programs, report cyber incidents and meet enhanced security for the most critical systems.
The government gets strong, often secret powers to demand information, audit, direct operations or intervene in emergencies, with civil and criminal penalties for non‑compliance.
Want the full deep dive?
Zoe can write the in-depth analysis on top of the summary above: how it works, who it affects and what each part actually does.
Direct links to the current provisions in Security of Critical Infrastructure Act 2018.
Sourced from the Federal Register of Legislation (legislation.gov.au), CC BY 4.0.
An Act to create a framework for managing critical infrastructure, and for related purposes
This Act is the Security of Critical Infrastructure Act 2018.
(1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.
<table cellspacing="0" cellpadding="0" style="width:355.55pt; border-collapse:collapse"><thead><tr><td colspan="3" style="width:344.85pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Commencement information</span></p></td></tr><tr><td style="width:74.35pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p></td><td style="width:180.7pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p></td><td style="width:68.4pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Column 3</span></p></td></tr><tr><td style="width:74.35pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Provisions</span></p></td><td style="width:180.7pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Commencement</span></p></td><td style="width:68.4pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="TableHeading"><span>Date/Details</span></p></td></tr></thead><tbody><tr><td style="width:74.35pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="Tabletext"><span>1.</span><span> </span><span>The whole of this Act</span></p></td><td style="width:180.7pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="Tabletext"><span>A single day to be fixed by Proclamation.</span></p><p class="Tabletext"><span>However, if the provisions do not commence within the period of 3 months beginning on the day this Act receives the Royal Assent, they commence on the day after the end of that period.</span></p></td><td style="width:68.4pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.35pt; padding-left:5.35pt; vertical-align:top"><p class="Tabletext"><span>11</span><span> </span><span>July 2018</span></p></td></tr></tbody></table>
Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.
(2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.
The object of this Act is to provide a framework for managing risks relating to critical infrastructure, including by: (a) improving the transparency of the ownership and operational control of critical infrastructure in Australia in order to better understand those risks; and (b) facilitating cooperation and collaboration between all levels of government, and regulators, owners and operators of critical infrastructure, in order to identify and manage those risks; and (c) requiring responsible entities for critical infrastructure assets to identify and manage risks relating to those assets; and (d) imposing enhanced cyber security obligations on relevant entities for systems of national significance in order to improve their preparedness for, and ability to respond to, cyber security incidents; and (da) imposing enhanced security obligations on responsible entities for critical telecommunications assets; and (e) providing a regime for the Commonwealth to respond to serious incidents relating to critical infrastructure assets.
This Act creates a framework for managing risks relating to critical infrastructure.
The framework consists of the following:
(a) the keeping of a register of information in relation to critical infrastructure assets (the register will not be made public);
(b) requiring the responsible entity for one or more critical infrastructure assets to have, and comply with, a critical infrastructure risk management program (unless an exemption applies);
(c) requiring notification of cyber security incidents;
(d) imposing enhanced cyber security obligations that relate to systems of national significance;
(da) imposing enhanced security obligations for critical telecommunications assets;
(e) requiring certain entities relating to a critical infrastructure asset to provide information in relation to the asset, and to notify if certain events occur in relation to the asset;
(f) allowing the Minister to require certain entities relating to a critical infrastructure asset to do, or refrain from doing, an act or thing if the Minister is satisfied that there is a risk of an act or omission that would be prejudicial to security;
(g) allowing the Secretary to require certain entities relating to a critical infrastructure asset to provide certain information or documents;
(h) setting up a regime for the Commonwealth to respond to a serious incident that has had, is having, or is likely to have, one or more relevant impacts on one or more critical infrastructure assets;
(i) allowing the Secretary to undertake an assessment of a critical infrastructure asset to determine if there is a risk to national security relating to the asset.
Certain documents or information obtained, generated or adopted under, or relating to the operation of, this Act is protected information. There are restrictions on when a person may make a record of, use or disclose protected information.
Civil penalty provisions of this Act may be enforced using civil penalty orders, injunctions or infringement notices, and enforceable undertakings may be accepted in relation to compliance with civil penalty provisions. The Regulatory Powers Act is applied for these purposes. Certain provisions of this Act are subject to monitoring and investigation under the Regulatory Powers Act. Certain provisions of this Act may be enforced by imposing a criminal penalty.
The Minister may privately declare an asset to be a critical infrastructure asset.
The Minister may privately declare a critical infrastructure asset to be a system of national significance.
The Secretary must give the Minister reports, for presentation to the Parliament, on the operation of this Act.
In this Act:
ABN has the same meaning as in the A New Tax System (Australian Business Number) Act 1999.
access, in relation to a computer program, means the execution of the computer program.
access to computer data means:
(a) in a case where the computer data is held in a computer—the display of the data by the computer or any other output of the data from the computer; or
(b) in a case where the computer data is held in a computer—the copying or moving of the data to:
(i) any other location in the computer; or
(ii) another computer; or
(iii) a data storage device; or
(c) in a case where the computer data is held in a data storage device—the copying or moving of the data to:
(i) a computer; or
(ii) another data storage device.
acquisition of property has the same meaning as in paragraph 51(xxxi) of the Constitution.
adverse security assessment has the same meaning as in Part IV of the Australian Security Intelligence Organisation Act 1979.
aircraft operator has the same meaning as in the Aviation Transport Security Act 2004.
airport has the same meaning as in the Aviation Transport Security Act 2004.
airport operator has the same meaning as in the Aviation Transport Security Act 2004.
air service has the same meaning as in the Aviation Transport Security Act 2004.
appointed officer, for an unincorporated foreign company, means:
(a) the secretary of the company; or
(b) an officer of the company appointed to hold property on behalf of the company.
approved form means a form approved by the Secretary.
approved staff member of the authorised agency has the meaning given by section 35BJ.
ASD means the Australian Signals Directorate.
asset includes:
(a) a system; and
(b) a network; and
(c) a facility; and
(d) a computer; and
(e) a computer device; and
(f) a computer program; and
(g) computer data; and
(h) premises; and
(i) any other thing.
associate has the meaning given by section 8B.
associated entity has the same meaning as in the Corporations Act 2001.
associated transmission facility means:
(a) an antenna; or
(b) a combiner; or
(c) a feeder system; or
(d) an apparatus; or
(e) an item of equipment; or
(f) a structure; or
(g) a line; or
(h) an electricity cable or wire;
that is associated with a radiocommunications transmitter.
AusCheck scheme has the same meaning as in the AusCheck Act 2007.
Australia, when used in a geographical sense, includes the external Territories.
Australian CS facility licence has the same meaning as in the Corporations Act 2001.
Australian derivative trade repository licence has the same meaning as in the Corporations Act 2001.
Australian market licence has the same meaning as in the Corporations Act 2001.
Australian waters has the same meaning as in Schedule 3A to the Telecommunications Act 1997.
authorised agency means ASD.
authorised APS employee means an APS employee in the Department in respect of whom an authorisation under section 44A is in force.
authorised deposit‑taking institution has the same meaning as in the Banking Act 1959.
background check has the same meaning as in the AusCheck Act 2007.
banking business has the same meaning as in the Banking Act 1959.
benchmark administrator licence has the same meaning as in the Corporations Act 2001.
broadcasting re‑transmission asset means:
(a) a radiocommunications transmitter; or
(b) a broadcasting transmission tower; or
(c) an associated transmission facility;
that is used in connection with the transmission of a service to which, as a result of section 212 of the Broadcasting Services Act 1992, the regulatory regime established by that Act does not apply.
broadcasting service has the same meaning as in the Broadcasting Services Act 1992.
broadcasting transmission asset means:
(a) a radiocommunications transmitter; or
(b) a broadcasting transmission tower; or
(c) an associated transmission facility;
that is used, or is capable of being used, in connection with the transmission of: (d) a national broadcasting service; or (e) a commercial radio broadcasting service; or (f) a commercial television broadcasting service.
broadcasting transmission tower has the same meaning as in Schedule 4 to the Broadcasting Services Act 1992.
business critical data means:
(a) personal information (within the meaning of the Privacy Act 1988) that relates to at least 20,000 individuals; or
(b) information relating to any research and development in relation to a critical infrastructure asset; or
(c) information relating to any systems needed to operate a critical infrastructure asset; or
(d) information needed to operate a critical infrastructure asset; or
(e) information relating to risk management and business continuity (however described) in relation to a critical infrastructure asset.
carriage service has the same meaning as in the Telecommunications Act 1997.
carriage service provider has the same meaning as in the Telecommunications Act 1997.
carrier has the same meaning as in the Telecommunications Act 1997.
chief executive of the authorised agency means the Director‑General of ASD.
civil penalty provision has the same meaning as in the Regulatory Powers Act.
clearing and settlement facility has the same meaning as in the Corporations Act 2001.
commencing day means the day this Act commences.
commercial radio broadcasting service has the same meaning as in the Broadcasting Services Act 1992.
commercial television broadcasting service has the same meaning as in the Broadcasting Services Act 1992.
communications sector means the sector of the Australian economy that involves:
(a) supplying a carriage service; or
(b) providing a broadcasting service; or
(c) owning or operating assets that are used in connection with the supply of a carriage service; or
(d) owning or operating assets that are used in connection with the transmission of a broadcasting service; or
(e) administering an Australian domain name system.
computer means all or part of:
(a) one or more computers; or
(b) one or more computer systems; or
(c) one or more computer networks; or
(d) any combination of the above.
computer data means data held in:
(a) a computer; or
(b) a data storage device.
computer device means a device connected to a computer.
confidential commercial information means the following:
(a) information relating to trade secrets;
(b) other information that has a commercial value that would be, or could reasonably be expected to be, destroyed or diminished if the information were communicated.
connected includes connection otherwise than by means of physical contact, for example, a connection by means of radiocommunication.
constable has the same meaning as in the Crimes Act 1914.
corporate entity means an entity other than an individual.
credit facility has the meaning given by regulations made for the purposes of paragraph 12BAA(7)(k) of the Australian Securities and Investments Commission Act 2001.
credit facility business means a business that offers, or provides services in relation to, a credit facility.
critical aviation asset means:
(a) an asset that:
(i) is used in connection with the provision of an air service; and
(ii) is owned or operated by an aircraft operator; or
(b) an asset that:
(i) is used in connection with the provision of an air service; and
(ii) is owned or operated by a regulated air cargo agent; or
(c) an asset that is used by an airport operator in connection with the operation of an airport.
Note: The rules may prescribe that a specified critical aviation asset is not a critical infrastructure asset (see section 9).
critical banking asset has the meaning given by section 12G.
Note: The rules may prescribe that a specified critical banking asset is not a critical infrastructure asset (see section 9).
critical broadcasting asset has the meaning given by section 12E.
Note: The rules may prescribe that a specified critical broadcasting asset is not a critical infrastructure asset (see section 9).
critical component of a critical infrastructure asset, means a part of the asset, where absence of, damage to, or compromise of, the part of the asset:
(a) would prevent the proper function of the asset; or
(b) could cause significant damage to the asset;
as assessed by the responsible entity for the asset.
cri
This is an opening excerpt, not the complete document.