Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022

The instrument turns on a small number of interlocking concepts and cross‑references. Understanding those concepts is necessary to determine whether an asset is captured, when capture takes effect, and which external definitions govern.

Specified asset categories: The heart of the instrument is the two lists of asset categories. Section 4(1) sets out the categories for Part 2; section 5(1) sets out the categories for Part 2B. The lists are categorical (for example, “a critical broadcasting asset”, “a critical hospital”, “a critical freight infrastructure asset”) rather than asset-by-asset registries. For telecommunications assets the lists qualify the inclusion: a critical telecommunications asset is specified only if it is (i) owned or operated by a carrier, or (ii) a relevant carriage service provider asset (s 4(1)(n) and s 5(1)(u)).

Relevant carriage service provider asset: The instrument defines “relevant carriage service provider asset” in s 3. That definition contains two alternative tests. An asset qualifies if it is used in connection with the supply of at least 20,000 active total carriage services, including categories such as broadband, fixed telephone, public mobile telecommunications and voice-only services (s 3, definition). Alternatively, an asset qualifies where “the responsible entity for the asset is aware that the asset is used in connection with carriage services supplied to a Commonwealth entity (other than a body corporate established by a law of the Commonwealth)”. Both elements are part of the single statutory definition.

Cross‑reference to other instruments and Acts: The instrument imports definitions from other Commonwealth laws and regulations. It uses the Aviation Transport Security Act 2004 and the Aviation Transport Security Regulations 2005 to define “designated airport”, “prescribed air service” and “screened air service” (s 3). It uses the Customs Act 1901 (s 102B) for “cargo terminal” and “cargo terminal operator”. It also expressly notes that expressions in the instrument have the same meaning as in the Act, as modified by the Legislation Act 2003 (s 3 note).

Data storage systems and s 9(7): The instrument contains two notes (one in s 4 and one in s 5) that state: where a data storage system meets all of the requirements under s 9(7) of the Act in respect of a specified critical infrastructure asset, that data storage system is taken to be part of the critical infrastructure asset. The instrument does not reproduce s 9(7); it relies on the Act’s substantive test.

Named exclusions and asset ownership/operation: Both lists include a table of four named sugar mills and their specific corporate owners (s 4(2), s 5(3)). The instrument phrases the entries as assets that are excluded when they are “owned or operated by the entity mentioned in the item”. The instrument also contains an additional exclusion in s 5(4) for assets that become critical aviation or maritime assets on or after certain commencement dates of the Transport Security Amendment (Critical Infrastructure) Act 2022; that creates a carve‑out tied to the timing of other amendments.

Grace periods and commencement timing: The instrument defines grace periods that defer the application of the relevant Part for a defined period. For Part 2, s 4(3) provides that Part 2 does not apply to an asset mentioned in s 4(1) during the period beginning when the asset became a critical infrastructure asset and ending at the later of: (a) six months after the instrument’s commencement and (b) six months after the asset became a critical infrastructure asset mentioned in s 4(1). For Part 2B, s 5(5) provides an analogous deferral, but with a three-month period rather than six months. The grace periods are expressed relative both to the instrument’s commencement and to the date the asset became a critical infrastructure asset.

Statutory anchoring to the Act: The instrument operates by reference to particular paragraphs of the Act , paragraph 18A(1)(a) for Part 2 and paragraph 30BB(1)(a) for Part 2B (see s 4 and s 5 introductory words). It therefore functions as an application instrument that resolves the statutory question of which classes of assets are to be captured by those Parts.

Notes on continuity: The instrument contains a note in s 4 that points to the Act’s saving of Part 2 for assets that were already critical infrastructure assets before the commencement of s 18A of the Act. The instrument also explicitly includes electricity and gas assets that were not critical immediately before the commencement of s 18A (s 4(1)(l),(m)). Those textual points indicate a degree of continuity and an explicit widening for particular energy categories.

Collectively, these concepts determine mechanical scope (which categories are specified), temporal scope (when specification takes effect via grace periods), and the cross‑legislative interpretive regime (definitions imported from other Acts/regulations, and reliance on the Act’s own definitional and substantive provisions such as s 9(7)).

The instrument affects anyone who owns, operates, or otherwise controls an asset that falls into one of the specified categories in s 4(1) (for Part 2) or s 5(1) (for Part 2B) of the instrument. The statutory language repeatedly frames the operation in terms of assets “owned or operated by” entities, and the “responsible entity” concept in the definition of “relevant carriage service provider asset” places focus on the natural or legal person that is responsible for the asset (s 3).

Primary affected entities

• Owners and operators of assets described in the lists will be affected because the instrument makes those categories the subject of Parts 2 and 2B of the Act (s 4(1) and s 5(1)). The instrument does not restate the substantive duties in those Parts; accordingly, affected entities must read the Act to determine the specific obligations that will apply once the specification takes effect.
• Carriers are specifically targeted in the telecommunications entries. A critical telecommunications asset is specified only if it is owned or operated by a carrier (s 4(1)(n)(i), s 5(1)(u)(i)). Entities that are carriage service providers but do not meet the instrument’s “relevant carriage service provider asset” test may avoid coverage under the telecommunications limbs.

Entities in the technology and communications sector

• Providers of broadband services, fixed telephone services, public mobile telecommunications services and voice-only services are specifically implicated by the “relevant carriage service provider asset” test. The 20,000 active total carriage services threshold in the definition creates a quantitative capture point for telecommunications assets used in the supply of those services (s 3). Responsible entities that approach or exceed that active services threshold will need to assess whether their asset is a specified critical telecommunications asset.

Entities supplying Commonwealth entities

• The alternative limb in the “relevant carriage service provider asset” definition is awareness-based: coverage arises if the responsible entity is aware the asset is used in connection with carriage services supplied to a Commonwealth entity (other than a body corporate established by a law of the Commonwealth) (s 3). This awareness criterion brings within scope carriage assets supplying Commonwealth agencies where the responsible entity knows of the linkage. Responsible entities that supply or contract with Commonwealth entities therefore face a knowledge and evidence issue about what they know and when.

Operators of aviation and cargo terminal assets

• Section 5(2) specifies critical aviation assets with precise criteria: designated airports (as defined in the Aviation Transport Security Regulations), assets used to perform Australian prescribed air services operating screened air services departing a designated airport, and cargo terminals that are both owned/operated by a regulated air cargo agent who is also a cargo terminal operator and located at a designated airport. Those operating airports, screened air services, and qualifying cargo terminals are therefore directly targeted by the Part 2B specification (s 5(2)).

Named small‑group exclusions

• The instrument specifically excludes four sugar mills when owned or operated by the named corporate entities (s 4(2), s 5(3)). The naming of these assets and corporate owners means that those particular facilities , where owned/operated by the named entities , are not specified assets for the relevant Part. Entities owning or operating those listed mills are therefore not brought within the specified lists by this instrument, but other sugar mills are not addressed and may be covered if otherwise captured by the asset categories.

Third parties and contractual counterparties

• Suppliers, contractors, service providers, and counterparties that interact with a specified asset may be indirectly affected because the asset’s responsible entity will be subject to obligations under the referenced Parts of the Act. Although the instrument itself does not create duties for counterparties, it changes the legal status of the asset and therefore may affect procurement, contractual compliance, and operational arrangements.

Regulators, compliance and legal advisers

• Compliance professionals within affected entities, legal advisers and regulators must account for the instrument’s cross‑references to other legislative instruments and the Act itself when assessing coverage and timing. The instrument’s reliance on definitions in the Aviation Transport Security Act/Regulations and the Customs Act places an interpretive onus on affected entities to consult those instruments to determine whether they meet the s 5(2) criteria for aviation and cargo terminal assets.

Who does not become covered by the instrument itself

• The instrument does not create new offences or supervisory powers; it only specifies asset classes for application of existing Parts of the Act. If an asset is excluded by the named exclusion table (s 4(2) and s 5(3)), or otherwise fails the definition thresholds, the instrument does not, by itself, place new obligations on the owner/operator.

In short, the instrument’s practical effect is to reclassify whole categories of assets (and particular named assets) so that the substantive obligations and enforcement mechanisms in Parts 2 and 2B of the Act will apply at the dates determined by the instrument’s grace periods. Owners, operators, and responsible entities in the listed sectors should treat this instrument as a trigger point for a compliance assessment, with the telecommunications, aviation and Commonwealth-supplier relationships being particular focuses owing to the specific definitions and tests the instrument supplies.

This instrument does not itself set out duties, rights, or enforcement powers; it functions to identify which assets are covered by Parts 2 and 2B of the Act. Consequently, the substantive duties and rights continue to be those contained in the Act’s Parts 2 and 2B. The instrument’s legal operation is to render those duties and rights applicable to the specified asset classes; the instrument pins temporal and scope parameters around that application. The following points explain the mechanical transmission of duties and the practical rights and triggers the instrument creates, with citation to the instrument where relevant.

Activation of Act provisions

• Where an asset is specified by the instrument for the application of Part 2 (s 4(1)) or Part 2B (s 5(1)), the consequences are that the obligations, powers, and rights contained in the referenced Part of the Act attach to that asset and to the responsible entity as provided in the Act. The instrument itself does not restate those obligations, so readers must consult the Act to identify the precise duties (the instrument refers to paragraph 18A(1)(a) for Part 2 and to paragraph 30BB(1)(a) for Part 2B).

Triggering conditions for telecommunications assets

• The instrument sets out two triggers that make a telecommunications asset a specified asset: ownership/operation by a carrier, and the “relevant carriage service provider asset” test (s 4(1)(n), s 5(1)(u), s 3). If either trigger is met, the asset becomes subject to the duties and rights in the relevant Part of the Act.

Quantitative threshold duty trigger

• The 20,000 active total carriage services threshold in the definition of a relevant carriage service provider asset (s 3) is a quantitative trigger. Where an asset is used in connection with the supply of at least that number of active services (broadband, fixed telephone, public mobile telecommunications, voice-only) the asset is specified. That numeric threshold converts into duties where the Act’s provisions require protective measures, incident reporting, or other compliance actions for specified assets; responsible entities must therefore be ready to calculate and demonstrate whether the threshold is met.

Knowledge-based trigger

• The alternative, awareness-based limb of the “relevant carriage service provider asset” definition brings in assets when the responsible entity is aware the asset is used in connection with carriage services supplied to a Commonwealth entity (excluding certain corporate bodies) (s 3). This awareness test ties specification to the state of the responsible entity’s knowledge, so duties can be triggered by the responsible entity’s factual awareness. The practical consequence is that the responsible entity will have to be able to show what it knew and when, because the Act’s duties will apply once the asset is specified.

Temporal deferral of duties (grace periods)

• The instrument provides a time-limited deferral (a grace period) before Part 2 or Part 2B duties apply to a newly specified asset. For Part 2, application is deferred for the period beginning when the asset became critical and ending at the later of six months after the instrument commences or six months after the asset became critical (s 4(3)). For Part 2B, the corresponding period is three months (s 5(5)). Those grace periods define when the rights and duties in the Act begin to run against the responsible entity.

Exclusions change entitlement to duties

• The named exclusions in s 4(2) and s 5(3) mean that, for the listed sugar mills owned or operated by the named entities, the instrument does not specify those assets for the relevant Part. In practice, that means the statutory duties and rights in the relevant Part will not be triggered by this instrument for those particular assets when they are owned or operated by the named entity. Conversely, where one of those mills is owned or operated by a different entity, the exclusion does not apply and the asset may be specified.

Interplay with data storage systems

• The instrument’s notes regarding s 9(7) of the Act mean that a data storage system that meets s 9(7) requirements in relation to a specified asset is treated as part of the asset (s 4 note; s 5 note). As a result, duties and rights that attach to the specified asset may extend to associated data storage systems that satisfy s 9(7)’s requirements.

Rights of entities to establish that an asset is not specified

• The instrument’s text creates definitional and temporal criteria that responsible entities can apply to determine whether their asset is specified. The presence of quantitative and awareness tests, the named exclusions, and the grace periods provide factual and documentary levers for entities seeking to prove that their asset is not subject to the Act’s Parts. For example, an entity can show that the asset is not used in connection with 20,000 active carriage services, or that it lacked the requisite awareness of supply to a Commonwealth entity, or that it is one of the named excluded assets owned by the named entity.

Absence of new enforcement provisions

• Because the instrument does not add enforcement mechanisms or create offences itself, it does not confer additional enforcement rights on regulators beyond those already in the Act for Parts 2 and 2B. The practical effect is that the instrument only changes the set of assets against which existing enforcement rights may be exercised; the duties and rights themselves remain in the Act.

In sum, the instrument operates as a scope-setting device. Its key substantive consequence is to determine which assets will attract the Act’s existing duties and rights, when they will do so (subject to the grace periods), and under what definitional tests (carrier ownership, the 20,000 active services threshold, and the awareness test). Responsible entities therefore must map these criteria to their assets and prepare to comply with the Act’s Parts once the instruments’ temporal and factual triggers have been met.

The instrument itself contains no penalty provisions, enforcement powers, or administrative sanctions. Its function is to specify which asset classes fall within Parts 2 and 2B of the Security of Critical Infrastructure Act 2018. Therefore, any penalty or enforcement regime that becomes applicable to an asset specified under this instrument is derived from the Act’s own provisions contained in Part 2 or Part 2B. The instrument refers expressly to paragraph 18A(1)(a) for Part 2 and paragraph 30BB(1)(a) for Part 2B (see s 4 and s 5), which is how the Act’s machinery is brought into operation for the listed assets.

Implications for enforcement mechanics

• Because the instrument is a scope‑defining instrument, the enforcement mechanics that apply to an asset will be those that the Act provides for specified assets. The instrument does not alter, limit or expand the Act’s enforcement powers in textual form; it simply renders those powers applicable to additional asset classes by naming them. Entities and advisers must therefore consult the Act to identify the precise enforcement powers, regulatory notices, directions, or penalty regimes that apply once an asset becomes specified.

Temporal enforcement window (grace periods)

• The instrument’s grace periods delay the commencement of the Act’s Part 2 or Part 2B application for a window of time (s 4(3), s 5(5)). Enforcement under the Act’s Parts will typically not be applicable during that deferral window, subject to the specific terms of the Act. The instrument therefore creates an interim period in which statutory enforcement powers tied to the specified Parts do not apply to newly specified assets.

Enforcement risk tied to definitional tests

• Because the instrument establishes definitional tests that are either quantitative (the 20,000 active total carriage services threshold) or subjective (the responsible entity’s awareness of supply to a Commonwealth entity) (s 3), enforcement risk will centre on factual determinations. In any compliance or enforcement action, proof that an asset met the threshold or that the responsible entity possessed awareness at a particular time will be material. The instrument thereby shifts some enforcement attention to record-keeping and evidentiary questions about active service counts and the responsible entity’s knowledge.

Exclusions and enforcement non-application

• The instrument’s named exclusions (the four sugar mills when owned or operated by specified entities at s 4(2) and s 5(3)) mean that enforcement under the referenced Parts would not be applicable to those assets by virtue of this instrument. That alters enforcement coverage for those facilities when owned/operated by the named entities, but it does not preclude coverage under other mechanisms or future instruments.

No new regulator role created

• The instrument does not name a regulator or create a distinct enforcement body. Any enforcement must therefore proceed under the Act’s existing scheme and delegated authorities.

Practical enforcement considerations for entities

• For responsible entities whose assets become specified, enforcement exposure will depend on the Act’s obligations and the timing of the grace periods. Entities should anticipate that failure to comply with the Act’s Part 2 or Part 2B duties after expiry of the applicable grace period could expose them to whatever administrative or civil penalties the Act prescribes. The instrument itself does not define those penalties, and so the operational enforcement consequences must be ascertained from the Act.

In short, the instrument is an applicatory instrument that changes the perimeter of enforceable coverage under the Act. It does not itself create penalties or enforcement processes; those aspects remain matters for the Act. The instrument’s main enforcement-related effects are therefore indirect: it determines who will fall within the scope of the Act’s existing enforcement architecture and when.

The instrument is heavily cross‑referential. It relies on, and interacts with, the Security of Critical Infrastructure Act 2018 by specifying which assets Part 2 and Part 2B apply to. It also imports or depends on definitions from the Aviation Transport Security Act 2004, the Aviation Transport Security Regulations 2005, and the Customs Act 1901. The instrument’s operation is therefore tightly integrated with those laws.

Primary cross‑reference to the Act

• The instrument is explicitly designed to operate under particular paragraphs of the Act: paragraph 18A(1)(a) for Part 2 and paragraph 30BB(1)(a) for Part 2B (s 4 and s 5). It does not duplicate the Act’s substantive clauses; instead, it identifies which asset classes will be subject to the Act’s substantive and enforcement provisions. The instrument also references the Act’s s 9(7) indirectly via notes that treat compliant data storage systems as part of a specified asset. Therefore, interpretation of the instrument cannot be separated from the Act’s definitional and operative provisions.

Interaction with aviation and customs law

• The instrument borrows defined terms from the Aviation Transport Security Act and Regulations to identify “designated airport”, “prescribed air service” and “screened air service” (s 3). It also adopts the Customs Act 1901 definition of “cargo terminal” and “cargo terminal operator” (s 3). Notably, s 5(2) uses those aviation and customs definitions to establish which aviation or cargo terminal assets are specified for Part 2B. As a result, any change in those aviation or customs definitions or criteria (or the way they are applied) will affect whether a given airport asset or cargo terminal meets the instrument’s thresholds.

Legislative definitions flow‑through

• The instrument includes an express note that expressions used in it have the same meaning as in the Act from time to time, pursuant to the Legislation Act 2003, s 13(1)(b) (s 3 note). That means definitional changes in the Act may alter the operation of the instrument without further amendment to the instrument itself. Entities must therefore monitor changes in the Act and the referenced external instruments to understand whether the instrument’s scope has shifted.

Transport Security Amendment (Critical Infrastructure) Act 2022

• Section 5(4) cites commencement milestones in the Transport Security Amendment (Critical Infrastructure) Act 2022 and links that Act’s commencement dates to an exclusion for assets that become critical aviation or maritime assets on or after the respective dates. The instrument therefore interacts with that amending Act by creating timing-based exclusions tied to its commencement provisions. The practical consequence is that the timing of other legislative changes affects whether certain new aviation or maritime assets are specified by this instrument.

Data storage systems and s 9(7) of the Act

• The instrument’s notes in s 4 and s 5 treat a data storage system that meets all the requirements under s 9(7) of the Act in respect of a specified asset as being part of that asset. This creates a cross‑flow between data storage systems and the asset classification in the Act. Entities providing or using data storage systems will need to interpret s 9(7) of the Act and assess whether their storage systems are taken to be part of the specified asset.

No conflict-resolution provisions in the instrument

• The instrument does not contain provisions resolving conflicts between this instrument and other laws; rather, it operates by reference and relies on standard statutory interpretation principles. Because it imports definitions and depends on other Acts, it is subject to the legal hierarchy and can be affected by changes or judicial interpretation of those other laws.

Operational consequences for contracts and regulatory regimes

• The instrument’s cross‑references mean that existing regulatory licences, aviation security clearances, customs processes, and carriage service provider registration regimes may have bearing on whether an asset is specified. For example, whether a cargo terminal is a “cargo terminal operator” within the meaning of the Customs Act will determine if that cargo terminal meets s 5(2)(c)(i) and thus whether Part 2B applies.

In summary, the instrument does not operate in isolation. It creates a network of legal interactions: it triggers application of Parts 2 and 2B of the Act, it imports aviation and customs definitions, it depends on the Legislation Act for meaning flows, and it links to the Transport Security Amendment (Critical Infrastructure) Act 2022 for timing-based exclusions. Entities must therefore analyse the instrument together with the Act and the referenced statutes and regulations to determine applicability and legal consequences.

The instrument is titled the Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022 (s 1). The instrument itself contains no internal amendment history or record of subsequent amendments within the text provided. It sets out current operative provisions as a single instrument.

What the text records

• Section 1 provides the instrument’s title and identifies it as LIN 22/026 2022. No further entries, schedules or historical notes appear in the instrument’s text provided here.

Implicit amendment context

• The instrument refers to the commencement of section 18A of the Act (see s 4 note and s 4(1)(l),(m)), and to the commencement of Parts of Schedule 3 to the Transport Security Amendment (Critical Infrastructure) Act 2022 (see s 5(4)). Those references place the instrument in a legislative context of amendments to the Security of Critical Infrastructure Act and related transport security legislation, but the instrument does not itself record amendments to those Acts. It instead operates as an application instrument that responds to the statutory architecture created by the Act and related amending Acts.

No intra‑instrument amendment schedule

• The instrument does not contain any clauses in the text supplied that amend prior instruments or that record prior instruments it replaces. The instrument appears to be a standalone specification exercise under the Act, rather than a consequential amending instrument that modifies earlier rules.

Consequences for users

• Because the instrument’s content is a function of its 2022 version number and title, users seeking to determine whether there have been subsequent amendments must consult the legislative instrument register or the printed compilation of applicable instruments. The text provided here offers no record of post‑publication changes, revocations or substitutions; the absence of an amendment history in the instrument means that determining later amendments requires checking the formal legislative record maintained by the relevant official sources.

Practical note

• Entities should treat the instrument as effective from its commencement date (which is not stated in the excerpt provided) and be alert to the instrument’s cross‑references to commencement dates in other Acts (for example, the Transport Security Amendment (Critical Infrastructure) Act 2022). For a definitive amendment history or alterations after publication, practitioners must consult the legislative instrument database or gazette records.

In short, the instrument is presented as a 2022 legislative instrument (LIN 22/026) without further internal amendment annotations in the provided text. Any subsequent changes would not be visible from the instrument alone and must be checked against official legislative registers.

The text of this instrument contains no references to litigation, court decisions, or judicial consideration. There is no litigation history recited or embedded within the instrument. It is a rules instrument that specifies asset classes for statutory application; the instrument does not include case citations, judicial determinations, or summaries of legal challenges.

Practical implications of absence

• The lack of litigation history in the instrument itself means there are no precedential judicial interpretations of the instrument’s particular phrasing within the instrument’s text. Interpretive issues that might give rise to litigation,such as the meaning of the awareness test in the definition of relevant carriage service provider asset, the calculation of “active total carriage services”, or the scope of the named exclusions,are not decided within the instrument. If disputes arise about those matters, they will be resolved under the courts’ usual processes and by reference to the Act and any relevant external instruments, unless administrative remedies are available under the Act.

How litigation might proceed (observational, not predictive)

• Any litigation concerning the operation of this instrument would necessarily involve two components: (1) statutory interpretation of the instrument’s language and its cross‑references, and (2) interpretation and application of the Act’s Parts once the instrument’s specification has been triggered. Because the instrument repeatedly invokes concepts defined in other machinery (for example, Aviation Transport Security Regulations, the Customs Act, and the Act itself), litigation would likely involve those materials as well. The instrument itself, however, reports no pre-existing litigation.

Check official records for judicial history

• Practitioners seeking whether any litigation has since arisen concerning the operation of this instrument must consult court databases, tribunal records or administrative law reports. The instrument’s text supplies no such history and therefore does not establish whether the statutory classification decisions implemented by the instrument have been subject to challenge.

In sum, from the instrument’s own text there is no litigation history to report. Any authoritative statement on litigation would require searching external judicial and administrative records.

Several points in the instrument are likely to cause confusion or to generate practical compliance traps if read without careful attention to the text and its cross‑references. The instrument’s precision on certain thresholds and its reliance on external definitions create a number of specific operational “gotchas” that responsible entities and advisers should monitor.

Awareness‑based test is subjective and fact‑sensitive (s 3)

• The “relevant carriage service provider asset” definition includes an alternative awareness test: an asset is specified if “the responsible entity for the asset is aware that the asset is used in connection with carriage services supplied to a Commonwealth entity (other than a body corporate established by a law of the Commonwealth)” (s 3). The word “aware” imports a subjective standard that will turn on the entity’s knowledge and internal records. That can be a compliance trap: responsible entities who have received internal communications, managed contracts with government bodies, or had operational contact with Commonwealth entities may be taken to be aware, even if they had not considered the legal consequences. Documenting what was known and when will be critical to establishing whether the awareness limb applies.

Quantitative threshold of 20,000 active total carriage services (s 3)

• The 20,000 active total carriage services threshold is a clear numeric trigger, but the instrument does not define “active total carriage services” within its text. Entities must locate the Act’s definitions or otherwise determine what counts as an active service for the purpose. Miscounting or failing to aggregate services across business units could lead to unexpected capture once an entity crosses the numeric threshold.

Carrier ownership versus carriage service provider asset (s 4(1)(n), s 5(1)(u))

• A critical telecommunications asset is given two separate paths to specification: ownership/operation by a carrier, and meeting the relevant carriage service provider asset tests. Entities that are carriers should not assume that only the numeric threshold matters. Conversely, carriage service providers that are not carriers must pay attention to the two‑limb test to determine whether their assets are captured.

Named exclusions limited to ownership/operation by specific entities (s 4(2), s 5(3))

• The four sugar mills listed in the tables are excluded only where owned or operated by the named corporate entities. If ownership or operational control changes, the exclusion will no longer apply. A change in corporate ownership, merger, sale, outsourcing or long‑term lease could therefore result in previously excluded assets becoming specified assets. The specificity of the table is a potential transfer-of-control trap: different corporate ownership will change the instrument’s application.

Grace periods counted from when asset became critical and instrument commencement (s 4(3), s 5(5))

• The grace periods run from the later of two dates: a set period after the instrument’s commencement or a set period after the asset became a critical infrastructure asset. Entities must be able to demonstrate the date on which their asset became a "critical infrastructure asset" for the purpose of calculating the grace period. The instrument does not define the mechanics of proving that date; ambiguity may arise where assets change status over time or where the "became a critical infrastructure asset" determination is contested.

Data storage treated as part of asset only if s 9(7) of the Act is met (s 4 note, s 5 note)

• The instrument’s notes state that a data storage system is taken to be part of the critical infrastructure asset only where it meets all requirements under s 9(7) of the Act. Compliance practitioners must therefore inspect s 9(7) itself to determine whether particular data centres or cloud storage arrangements fall within the asset definition. Relying on an assumption that data storage is automatically part of the asset would be a mistake.

Dependence on external definitions (s 3, s 5(2))

• The instrument imports terms from the Aviation Transport Security Act and Regulations and the Customs Act. For example, whether an airport is a “designated airport” is a function of the Aviation Transport Security Regulations. Misreading or failing to reconcile those external definitions may result in an incorrect conclusion about whether an aviation or cargo terminal asset is specified.

Transport Security Amendment tie‑outs (s 5(4))

• Section 5(4) creates exclusions tied to the commencement of Parts of another Act. The timing language means that an asset’s status might change as other Acts commence. Practitioners should not assume finality based solely on current status; subsequent commencements could alter whether an asset is excluded.

No new penalties in the instrument , duties in the Act only

• A common misreading would be to assume the instrument lays out new obligations or penalties. It does not. The substantive obligations, any penalties and the enforcement architecture are in the Act. The instrument’s role is to cause those existing mechanisms to apply to additional assets. Missing this distinction could mislead organisational compliance planning.

Ambiguity over “owned or operated by”

• The instrument repeatedly uses the phrase “owned or operated by” but does not define the boundaries of operational control, beneficial ownership, or contractual control for the purpose of specification. Long-term outsourcings, managed services agreement, and operator-of-last-resort arrangements may raise difficult questions about whether an asset is "operated by" a given entity.

Exclusions do not equal permanent immunity

• The instrument excludes particular assets only in the narrow terms specified. Exclusions are not broad immunity from future specification under other instruments or legislative changes. Practitioners should not conflate the present exclusion with a durable exemption.

In essence, the instrument contains a number of points at which factual or definitional ambiguity can materially change whether an asset is specified. The most likely compliance pitfalls are the awareness-based test, the counting and definition of active carriage services, the interaction of ownership/operation with corporate changes, the timing of grace periods, and the necessity of checking s 9(7) and the external statutory definitions in aviation and customs law.

This instrument is an applicability instrument: it specifies which assets will be brought within Parts 2 and 2B of the Security of Critical Infrastructure Act 2018. Compliance therefore has two stages: (1) determine whether an asset is specified by the instrument; and (2) if it is specified, comply with the relevant duties in the Act once the applicable grace period expires. The steps below are directed to responsible entities and advisers tasked with assessing and implementing compliance.

Step 1 , Identify whether the asset category is specified

• Map each of your facilities, systems and services against the two lists in s 4(1) (Part 2) and s 5(1) (Part 2B). Do not assume that an asset’s industry label suffices; instead, ask whether the asset falls within the instrument’s wording (for example, “critical broadcasting asset”, “critical hospital”, “critical freight infrastructure asset”, etc.).
• For telecommunications assets, apply the two‑limb test in the definition at s 3: (i) is the asset owned or operated by a carrier; or (ii) is the asset used in connection with the supply of at least 20,000 active total carriage services, or is the responsible entity aware the asset is used in connection with carriage services supplied to a Commonwealth entity? Document the factual basis for your conclusion.

Step 2 , Check named exclusions and ownership

• Verify whether any of your assets are identical to the four named sugar mills in the tables at s 4(2) and s 5(3). If so, check whether they are owned or operated by the exact corporate entities named. If ownership/operation is by the named entity, the instrument’s table entries exclude those assets. Keep documentary proof of ownership and operational arrangements (contracts, titles, registers) to demonstrate the exclusion, if needed.

Step 3 , Establish relevant dates and calculate grace periods

• Identify the date on which each asset “became a critical infrastructure asset” for the purpose of the instrument, document that date, and calculate the applicable grace period:
  • For Part 2 assets, the deferral runs until the later of six months after the instrument’s commencement and six months after the asset became a critical infrastructure asset (s 4(3)).
  • For Part 2B assets, the deferral runs until the later of three months after the instrument’s commencement and three months after the asset became a critical infrastructure asset (s 5(5)).
• Retain contemporaneous records that substantiate the date the asset became critical. This might include board minutes, regulatory filings, internal assessments, contract start dates, or notifications from government.

Step 4 , For communications assets, measure services and document awareness

• For assets potentially captured by the 20,000 active total carriage services test, compile verifiable data on active service counts and service categories (broadband, fixed telephone, public mobile, voice-only, etc.) and maintain a clear calculation methodology. Establish a periodic reporting process to identify when the threshold is crossed.
• For the awareness limb, implement processes to record and review interactions with Commonwealth entities: contracts, purchase orders, service requests, letters of engagement, and communications from government clients. Because the instrument ties specification to the responsible entity’s awareness, contemporaneous documentation demonstrating what the responsible entity knew and when will be critical.

Step 5 , For aviation and cargo terminals, review external regulatory definitions

• If you operate an airport, an asset performing Australian prescribed air services, or a cargo terminal, consult the Aviation Transport Security Act and Regulations and the Customs Act (as cross-referenced in s 3 and s 5(2)) to determine whether your facility is a “designated airport”, a facility used to perform a “prescribed air service” operating “screened air services”, or a cargo terminal that is a regulated air cargo agent and cargo terminal operator located at a designated airport. Keep copies of regulatory determinations or licencing documents that establish that status.

Step 6 , Assess data storage linkages under s 9(7) of the Act

• For data centres, cloud providers and storage vendors, determine whether any data storage system “meets all of the requirements under subsection 9(7) of the Act in respect of a critical infrastructure asset” because the instrument treats such systems as part of the critical infrastructure asset (s 4 note, s 5 note). Review s 9(7) of the Act and assemble contractual and technical evidence showing whether the data storage system satisfies those statutory requirements.

Step 7 , Prepare for Act obligations and enforcement

• Assuming an asset is specified and a grace period has expired (or will expire soon), prepare to meet the substantive obligations in the Act’s Parts 2 or 2B. Because the instrument does not replicate those duties, consult the Act itself to create an implementation plan tailored to the Act’s requirements (incident reporting, plans, supply chain measures, directions compliance, etc., as set out in the Act).
• Establish internal governance, designated compliance owners, and a timeline to meet obligations by the end of the applicable grace period.

Step 8 , Update contracts and procurement

• Where the specification of an asset affects third-party service arrangements (outsourced network functions, managed data centres, contracted telecom infrastructure), review and, if necessary, renegotiate contracts to ensure they allow the responsible entity to comply with the Act’s duties (access to information, notices, supply chain obligations, data residency, or other compliance tasks that the Act may require).

Step 9 , Maintain records and evidence

• Keep contemporaneous records of:
  • Ownership and operational control documents.
  • Calculations of active service counts.
  • Evidence of awareness of supply to Commonwealth entities.
  • Dates used to calculate grace periods.
  • Correspondence with regulators and any notices received.
• These records will be central if regulatory bodies allege that an asset was specified earlier than claimed or if enforcement action follows.

Step 10 , Seek legal and regulatory advice where doubtful

• Because many critical determinations hinge on definitions outside the instrument (for example, s 9(7) of the Act, the Aviation Transport Security Regulations, and the Customs Act) and on potentially ambiguous factual standards (such as “awareness”), obtain legal advice to resolve borderline questions and to design the documentation and control framework. Document legal conclusions and the factual basis for them.

In practical terms, compliance requires first answering the factual questions posed by the instrument (ownership, operation, service counts, awareness, and specific aviation/customs statuses), then preparing to meet the Act’s obligations before the applicable grace period expires. The instrument’s precise numerical and timing rules provide clear compliance checkpoints, but implementation depends upon careful record-keeping and an ability to substantiate factual positions against the definitional tests the instrument establishes.