Security of Critical Infrastructure (Definitions) Rules (LIN 21/039) 2021

The instrument organises the Act’s scope through a short set of definitional devices. Those devices are the primary levers that change who the Act reaches and what information the Act treats as operational or reportable.

Key conceptual devices in the Rules are:

• Asset class rules with quantitative and qualitative triggers. For electricity, the Rules define a “critical electricity asset” by a two‑part test: a generator is critical if (a) it either is contracted to provide a system restart ancillary service or has installed capacity of at least 30 megawatts, and (b) it is connected to a wholesale electricity market. See s 5(1)(a)-(b). The instrument also defines what a system restart ancillary service entails (s 5(2)).
• Market and throughput thresholds. For gas, the Rules name specific pipelines as critical (the Tasmanian Gas Pipeline and the Carpentaria Gas Pipeline) and set nameplate rating thresholds for additional gas transmission pipelines by market (Eastern 200 TJ/day; Northern 80 TJ/day; Western 150 TJ/day). See s 6(1)-(2) and the table to s 6(2).
• Facility size thresholds. For liquid fuel, the instrument lists specific refineries and pipelines (s 7(1)-(2)) and sets a storage capacity threshold (more than 50 megalitres) for a liquid fuel storage facility to be critical (s 7(3)).
• Revenue and product‑type conditions for freight services. A freight business becomes “critical” where it has annual revenue of at least $150 million, supplies specified categories of freight services, and the services involve transporting or storing listed goods (for example food transported to or from a critical supermarket retailer, therapeutic goods on the Australian Register of Therapeutic Goods, specified medicines, liquid fuel to or from a critical liquid fuel asset, and other goods critical to operation of a critical infrastructure asset). See s 9(1)-(c).
• Financial market criteria that combine licence status and sustained market share or notional value metrics measured over at least two consecutive quarters. See s 10(1) for financial markets, and s 10(4) for derivative trade repositories and s 10(2)-(5) for other market infrastructure types.
• Named‑entity identification. The Rules specify particular corporate bodies as critical or as responsible entities for named assets and services: for example .au Domain Administration Ltd is critical to administration of the Australian domain name system (s 16(1)); three supermarket retailers and one grocery wholesaler are listed as critical (s 15(1)-(2)); four payment systems and their responsible entities are listed in s 10(5)(b) and table; TX Australia Pty Ltd is named in s 11.
• Operational information as a defined category. Section 17 defines “operational information,” including the condition that the data be maintained by an entity that is not the responsible entity for the asset and the various specific categories of data that will be treated as operational (the s 17 table). Section 17(2) prescribes the required content of a description of the arrangements under which that data is maintained.
• Limited specification of “relevant Commonwealth body.” Section 18 designates the Department as the relevant Commonwealth body for particular subsections of the Act (30BC(5) and 30BD(5)), and notes that the ASD is the relevant Commonwealth body for other Part 2B matters.

Mechanically, the Rules transform multipart statutory references in the Act into bright‑line tests and named lists. That transformation reduces uncertainty about which assets and data fall under the Act, at the cost that entities that sit just above or below the instrument’s numerical thresholds will find their regulatory status dictated by those precise numbers and named lists. The instrument is therefore a precision tool for scope allocation rather than a source of substantive duties.

The Rules change who falls within the Act’s reach by naming asset classes, supplying numerical cut‑offs, and listing specific entities. That design imposes identification obligations on several groups; the affected populations are the entities that own, operate, maintain, process data for, or provide services connected to the assets and systems named in the Rules.

Categories of affected parties, and the concrete mechanisms by which they are exposed to the Act, include:

• Owners and operators of generation stations. Generators with installed capacity of at least 30 MW that are connected to a wholesale electricity market are captured (s 5(1)(a)(ii) and (1)(b)). Generators contracted to provide a system restart ancillary service are captured regardless of installed capacity, provided they are connected to a wholesale market (s 5(1)(a)(i) and (1)(b)). The instrument defines the functional capability that qualifies as a system restart ancillary service (s 5(2)).
• Gas pipeline owners/operators. The Tasmanian Gas Pipeline and Carpentaria Gas Pipeline are named as critical (s 6(1)). Additional pipelines are captured where they meet the nameplate rating thresholds specified by gas market (s 6(2) and table).
• Liquid fuel sector participants. Two refineries are listed as critical (Corio and Lytton) and a set of pipelines are listed (s 7(1)-(2)). Storage facilities are captured where capacity exceeds 50 ML (s 7(3)).
• Freight infrastructure owners/operators. Intermodal transfer facilities at locations in Schedule 1 are critical where they are owned or operated by the entities listed (s 8(1)), and Schedule 1 names specific facilities and the responsible entities.
• Freight service businesses. A business that provides certain freight services and has annual revenue of at least $150 million is treated as critical where the services involve transporting specified goods or supplies (s 9(1)-(c)). The goods categories include food and groceries for critical supermarket retailers, therapeutic goods on the Australian Register of Therapeutic Goods, certain medicines, liquid fuel to or from critical liquid fuel assets, supplies required for water treatment, and other goods critical for operation of a critical infrastructure asset (s 9(1)(c)(i)-(vi)).
• Financial market infrastructure operators and providers. Critical status applies to financial markets operated by entities holding a Tier 1 market licence that meet sustained turnover or market‑share thresholds (s 10(1)); clearing and settlement facilities that must meet Reserve Bank financial stability standards are captured (s 10(2)); significant financial benchmarks declared under the Corporations Act are captured (s 10(3)); derivative trade repositories meeting a $20 trillion average daily notional outstanding transactions test for at least two consecutive quarters are captured (s 10(4)); and named payment systems and responsible entities are listed in s 10(5) and table.
• Broadcasting transmission operator. TX Australia Pty Ltd is specified as critical to broadcasting transmission (s 11).
• Large banking, insurance, superannuation and RSE licensees. Thresholds for assets under management or assets on balance sheet determine capture: ADIs and bodies corporate with assets over $50 billion for banking (s 12); insurance entities and bodies corporate with thresholds at $2 billion, $5 billion and $500 million for different insurance classes (s 13); and RSE licensees with registrable superannuation entity assets over $20 billion (s 14).
• Food and grocery retailers/wholesalers. Aldi, Coles Group and Woolworths are listed as critical supermarket retailers, and MetCash Trading Limited is listed as a critical grocery wholesaler (s 15).
• Domain name system operators and specific DNS assets. .au Domain Administration Ltd and entities that administer the .au ccTLD system are critical for domain name administration (s 16(1)-(2)). Within the .au ccTLD the instrument lists the registry database, public WHOIS service, .au top‑level authoritative servers and several second‑level authoritative servers as critical assets (s 16(3)(a)-(d) and subitems).
• Entities that maintain data for critical infrastructure assets but are not the responsible entity for those assets. Section 17 treats specific categories of data maintained by third parties as “operational information,” and prescribes required descriptive information about the arrangements. That affects cloud service providers, data centres, and any third‑party service provider holding operational datasets relevant to critical assets.
• Excluded operators. Four named sugar mills are explicitly excluded from critical electricity asset status despite otherwise meeting element(s); the table in s 19 names the assets and owning entities.

Because the instrument names specific companies and sets bright lines, risk allocation for compliance is granular. Entities near threshold levels, or that act as third‑party data hosts for critical assets, should assume they are affected at the precise points set out in the Rules and treat those entries as determinative unless and until the instrument is amended.

The Rules themselves are largely definitional and do not create statutory duties or rights independent of the Act. Instead the Rules define the scope of the Act by specifying which assets, entities and data are “critical” for the Act’s purposes. The key legal consequence is that an entity or asset falling within a Rule‑defined class becomes subject to the Act’s obligations, powers and rights in respect of critical infrastructure. The Rules therefore determine who will be subject to duties that the Act contains; they do not list those duties in this instrument.

Specific mechanical allocations in the Rules that translate into duties or rights under the Act include:

• Responsible entity designations. The Rules specify who is the “responsible entity” for particular assets. For example, s 8(2) designates the entity mentioned in Schedule 1’s table as the responsible entity for the intermodal transfer facility itemised. In the financial‑market payment‑system table at s 10(5)(b) the instrument identifies the responsible entity for each listed payment system. That designation matters because the Act’s operational rules, reporting obligations and direction powers are applied to the responsible entity named for an asset.
• Data‑description obligations for third parties. Section 17 prescribes that, for data that is treated as operational information and which is maintained by an entity that is not the responsible entity, a description of the arrangements must include specified items: the name of the maintaining entity (s 17(2)(a)); if the entity is not the responsible entity for the asset, the entity’s ABN or other similar business number if incorporated outside Australia, head office address and country of incorporation (s 17(2)(b)(i)-(iii)); the address where the data is held and, to the extent practicable, the address where the computers or servers are located (s 17(2)(c)); for data held using a cloud service, the cloud service name (s 17(2)(d)); and the kind of data maintained (s 17(2)(e)). Those prescriptive content items create concrete information‑provision obligations which map to the Act’s reporting and notification duties.
• WHOIS and registrant information definitions. Section 3(1) defines “WHOIS service” and enumerates the kinds of domain information included (for example domain registrar, registrar contact information, DNS name servers, DNSSEC information, registrant information and contact details). Section 3(1) also defines “registrant information” by listing the fields that form the registrant record (for example registrant legal entity name, registrant identification number, eligibility type, eligibility name, eligibility identification). These definitions set the expectation that domain‑management entities will maintain or make available those specific fields when the Act’s domain system provisions apply.
• Designation of relevant Commonwealth body. Section 18 specifies that, for two named subsections of the Act’s Part 2B (30BC(5) and 30BD(5)), the Department is the relevant Commonwealth body; the instrument also notes that ASD is the relevant body for other Part 2B provisions. That allocation determines which Commonwealth decision‑maker will exercise certain functions under the Act for those subsections.

Because duties and enforcement mechanisms sit in the Act, the practical legal rights or obligations that a person has will depend on whether the Rules have placed them inside the statutory net. The Rules therefore function as a scope machine: if your asset is listed or meets a threshold in ss 5-16, you will be subject to the Act’s duties; if your data falls within s 17’s operational information definition and is held by a third party, the description requirements apply to the data holder. The instrument does not itself create independent rights, exemptions or penalties, except where it expressly excludes assets from critical status (s 19) which removes them from application of the Act’s critical‑asset rules.

The instrument contains no penalty or enforcement provisions. It is a definitions instrument that prescribes how various terms in the Security of Critical Infrastructure Act 2018 are to be interpreted and which particular assets and entities are to be treated as “critical”. Penalties, enforcement mechanisms, notices, directions, civil sanctions or criminal offences would be found in the Act itself. The Rules therefore function upstream of enforcement by determining scope and identifying responsible entities that the Act will then regulate.

Consequence mechanics to note from the Rules:

• Identifying the responsible entity. By naming a responsible entity for a payment system or for an intermodal transfer facility (see s 10(5)(b) and s 8(2) with Schedule 1), the Rules determine which legal person will be on the receiving end of any directions, notices or orders under the Act.
• Information provision required by the Rules. Section 17(2) mandates the content of a description of the arrangements under which operational information is maintained. While the Rules themselves do not create penalties for failing to provide that description, the description requirement situates data holders so that, if the Act contains a notification or disclosure power tied to “operational information” or tied to data‑holders, the Act’s enforcement provisions will apply to these actors.
• Allocation of decision‑maker for Part 2B matters. The Rules specify the Department as the relevant Commonwealth body for certain Part 2B subsections (s 18(1)-(2)), and note that the Australian Signals Directorate is the relevant Commonwealth body for other Part 2B provisions. This allocation affects which Commonwealth agency exercises the Act’s enforcement or administrative powers in those contexts.

Because the instrument does not provide the enforcement architecture, any practitioner or compliance officer must consult the Act to identify:

• the civil or criminal penalties that attach to contraventions of the Act’s operative provisions;
• the process for directions, notices, or other administrative actions; and
• appeal, review or administrative law pathways.

The Rules identify who will be inside the Act’s perimeter; they do not set out the enforcement penalties or procedural frameworks. For those, see the Security of Critical Infrastructure Act 2018.

The instrument is explicitly drafted to cross‑reference and interact with other Commonwealth law and regulatory instruments. The instrument’s own text contains a number of direct interactions and cross‑links that practitioners must be aware of.

Direct cross‑references within the Rules:

• The instrument defines a number of terms as having the same meaning as in other Acts, explicitly linking those definitions to the broader legal framework. For example, the Rules adopt definitions from the Therapeutic Goods Act for “current Poisons Standard” and “medical device” (s 3(2)). They adopt the Corporations Act concepts for financial market licences and for the Reserve Bank’s financial stability standards (see s 10(1) and s 10(2) cross‑referencing subsection 795B(1) and section 827D of the Corporations Act, and s 10(3) cross‑referencing section 908AC(2) of the Corporations Act).
• The instrument uses the definition of “registrable superannuation entity” from the Superannuation Industry (Supervision) Act 1993 to set the scope for critical superannuation assets (s 3(1) and s 14).
• The instrument explicitly refers to the Australian Register of Therapeutic Goods and the Therapeutic Goods Act when specifying the kinds of freight movements that capture critical freight services (s 3 and s 9(1)(c)(ii)).
• By defining “Cash Market Product” and “Futures Market Contract” by reference to ASIC Market Integrity Rules (s 3), the Rules require practitioners to consult ASIC instruments to compute thresholds in s 10.

Operational data and privacy law:

• Section 17 treats personal information of at least 20,000 persons and “sensitive information” as operational information where those data are maintained by an entity that is not the responsible entity. Those terms are defined by reference to the Privacy Act 1988 (s 17(1)(c)(i)-(ii)), so interactions with privacy law, data breach notification regimes and data‑holding obligations will be consequential for entities identified under s 17.

Interconnections with the Act:

• The Rules are intended to be read as part of the Act’s scheme: notably s 3(1) has a legislative note that expressions used in the instrument are defined in the Act and have the same meaning in the instrument (the note cites Legislation Act 2003, s 13). The Rules therefore operate as a legally integrated part of the Act’s definition apparatus.

Regulatory and administrative interactions:

• The Rules allocate certain Part 2B decision responsibilities to the Department for discrete subsections and note ASD’s role for others (s 18 and the note to s 18). That allocation will affect which agency applies related laws and technical standards and which agency’s risk assessments apply when the Act’s measures are exercised.
• The Rules’ listing of responsible entities for payment systems, intermodal facilities and .au domain assets creates a point of contact for other regulatory regimes that already interact with these industries, for example ASIC, RBA, the Therapeutic Goods Administration and telecommunications regulators. For example, a payment system operator named at s 10(5) will also operate in regulated spaces under the Corporations Act and Reserve Bank rules.

In summary, the Rules are tightly cross‑referenced to other Commonwealth regimes, and they import thresholds and concepts from the Corporations Act, ASIC Market Integrity Rules, the Therapeutic Goods Act and the Privacy Act. Practitioners must therefore coordinate compliance with the Act, the Rules, and the cross‑referenced instruments to form an accurate compliance position.

The instrument is identified by its title and legislative instrument number: Security of Critical Infrastructure (Definitions) Rules (LIN 21/039) 2021 (Part 1, s 1). The text supplied contains no express amendment history, no dates of making or commencement beyond the title, and no schedules showing later changes to the instrument. The Rules, as provided, show the original numbering and content including Part 1 (Preliminary), Division 2.1 classes of critical infrastructure assets, Division 2.2 other definitions, Division 2.3 exclusions, and Schedule 1.

Practical implications for users:

• Where a user needs to know whether later amendments altered thresholds, added or removed named entities, or changed the content required under s 17(2), they must consult the official Commonwealth legislation register or relevant notices that might postdate this instrument. The instrument itself does not contain an annexed amendment history. The presence of an instrument number and year (LIN 21/039 2021) indicates the instrument was made in 2021 but does not reveal commencement or subsequent amendments.
• Because the Rules name specific corporate entities and numerical thresholds, even a small amendment could materially change who is captured. Users should confirm the currency of this instrument against the Federal Register of Legislation or the Attorney‑General’s compilation.

No retrospective amendments, repeal provisions, or transitional arrangements appear within the supplied text. The instrument contains no express savings or transitional provisions in the excerpt supplied. Users requiring a reliable, current compliance position should therefore check for any later legislative instruments that may have varied the definitions, added or removed entries from Schedule 1, or changed thresholds for asset capture.

The supplied instrument contains no record or reference to litigation, judicial interpretation, or administrative review decisions. It lists no cases, no references to decisions, and contains no internal notes on challenge or dispute.

What this means in practice:

• Any judicial or tribunal interpretation of these Rules (for example on the construction of the 30 megawatt threshold in s 5(1)(a)(ii) or the application of the operational information rules in s 17) will have to be located outside this instrument in court or tribunal records. The supplied text does not disclose any such jurisprudence.
• Given the instrument’s function as a definitions instrument that names specific entities, litigation risk exists in hypothetical terms where affected parties might challenge (a) the inclusion of a particular asset, (b) the legal effect of being designated a responsible entity, or (c) the adequacy of procedural fairness in any subsequent Act‑based administrative decision. None of that is evidenced in the text supplied.
• Practitioners should therefore search case law databases and administrative review decisions for any judicial or tribunal commentary on the Security of Critical Infrastructure Act 2018 that references these Rules, because the Rules themselves do not record litigation history.

In short, the Rules present a set of objective definitions and named lists; the supplied instrument does not record any litigation that would establish interpretive precedents.

The Rules contain specific, often technical, provisions that can catch practitioners by surprise if they are not read carefully. Below are concrete “gotchas” grounded in the instrument’s text.

1. Bright‑line numerical thresholds. Many definitions turn on exact numerical thresholds. Examples include:

   • Electricity generators: the 30 megawatt installed capacity threshold and the requirement to be connected to a wholesale electricity market (s 5(1)(a)(ii) and (1)(b)). A generator of 29.9 MW will be outside the Rule; a generator of 30.0 MW will be inside.
   • Gas pipelines: nameplate ratings specified by market (Eastern 200 TJ/day; Northern 80 TJ/day; Western 150 TJ/day) (s 6(2) and table).
   • Liquid fuel storage: >50 megalitres (s 7(3)).
   • Freight business revenue: annual revenue at least $150 million (s 9(1)(a)).
   • Financial market turnover and notional value tests that must be met for at least two consecutive quarters (s 10(1)). The “two consecutive quarters” requirement creates timing sensitivity. Precision matters for compliance. A small measurement error or an accounting change can move an entity in or out of scope.

2. Contracted functions qualify irrespective of size. For electricity, being contracted to provide a system restart ancillary service (s 5(1)(a)(i)) can make an asset critical even without the 30 MW threshold, provided the asset connects to a wholesale market (s 5(1)(b)). The instrument also defines the capability required for such a service (s 5(2)). Service contracts therefore matter as well as physical capacity.

3. Operational information depends on who holds the data. Section 17 treats specific categories of data as “operational information” only where the data is maintained by an entity that is not the responsible entity for the asset (s 17(1)(b)). That means third‑party cloud providers, outsourcers or contractors holding relevant data become focal points for the Act’s data‑related measures; those parties have to provide the descriptive items listed in s 17(2).

4. Detailed data‑holding description requirements. The description must include ABN or equivalent business number for entities incorporated outside Australia, the head office address, country of incorporation, the address where data is held and, where practicable, the server location, the cloud service name for cloud‑hosted data, and the kinds of data maintained (s 17(2)(a)-(e)). For cloud providers this requires operational detail they may not readily disclose without a contract clause change.

5. WHOIS and registrant fields are explicitly specified. s 3(1) enumerates WHOIS fields and s 3(1) separately lists registrant information fields (for example registrant legal entity name, registrant identification number, eligibility type and identification). Domain registrars and .au administrators must take note that the instrument expects those fields to exist where the Act applies to the domain system (s 16).

6. Named entities and ABNs. The Rules identify particular companies by name and ABN for payment systems, supermarkets, wholesale grocery, broadcasting transmitter and intermodal facilities (see ss 10(5) table, s 11 and s 15, and Schedule 1). That means corporate reorganisations, changes in ABN, or sale of assets can alter who the Act treats as the responsible entity unless the Rules are amended.

7. Exclusion list for certain sugar mills. Section 19 explicitly excludes four sugar mills and lists corporate owners. If an entity owns or operates one of those mills, the Rules treat the mill as not a critical infrastructure asset for electricity notwithstanding other parts of the Act (s 19(1)-(2).)

8. Schedule numbering irregularity. Schedule 1 includes item numbers with a duplicate 12 and a 12A (items 12 and 12A) which could cause confusion when referencing the table. Practitioners should reference the location and entity rather than assuming continuous numbering.

9. Data volume threshold for personal information. The operational information definition treats personal information of at least 20,000 persons as operational information (s 17(1)(c)(i)). This is a bright‑line population threshold that creates an intersection with privacy obligations.

10. Interaction with other legislative definitions. Several definitions rely on other statutes and regulatory instruments (for example Corporations Act, ASIC Market Integrity Rules, Therapeutic Goods Act, Privacy Act). Interpreting the Rules therefore requires parallel reference to those instruments. See s 3 and the cross‑references in s 10 and s 17.

These are not theoretical issues. Each is a concrete, documentable trigger that can move an entity into or out of the Act’s perimeter. Practitioners should map their assets against each threshold and named list in the Rules and track changes to corporate ownership, contract status, data hosting arrangements and quarterly market metrics.

Because the Rules define scope rather than set out operational duties, compliance starts with accurate scoping and then proceeds to document and adjust arrangements required by the Act and the Rules. The following step‑by‑step checklist is drawn from the instrument’s text and maps directly to the sections that impose definitional or descriptive requirements.

1. Asset identification and threshold testing

   • Map your asset base against the classes in Division 2.1 (ss 5-16). For each asset, record which Rule provision potentially applies. For electricity generators check s 5; for gas pipelines check s 6; for liquid fuel facilities check s 7; for freight infrastructure and services check ss 8-9; for financial market infrastructure check s 10; for broadcasting check s 11; for banking, insurance, superannuation thresholds check ss 12-14; for food and grocery retailers and wholesalers check s 15; for domain name system assets check s 16.
   • Apply the precise numerical thresholds. Example checks: installed capacity quantification for generators (s 5(1)(a)(ii)); nameplate rating testing for gas pipelines (s 6(2) and table); storage capacity measurement for liquid fuel facilities (s 7(3)); annual revenue calculation for freight businesses and whether it reaches $150 million (s 9(1)(a)); two consecutive quarters measurement for financial market turnover checks (s 10(1)).
   • Document whether the entity is connected to a wholesale electricity market where relevant (s 5(1)(b)) or contracted to supply system restart ancillary services (s 5(1)(a)(i) and s 5(2)).

2. Responsible entity designation and corporate housekeeping

   • For assets where the Rules name a responsible entity (for example payment systems in s 10(5) and intermodal facilities in Schedule 1 referred to by s 8(2)), confirm corporate identity, ABN, legal status, and whether the entity named in the Rules is the current owner or operator. If there has been a sale, merger or restructuring, document the change and consider whether to seek an update to the Rules or a formal clarification from the Department or relevant minister.
   • Keep a register of all assets that are captured and make sure legal and governance documents reflect the responsible entity status.

3. Operational information: identify, describe and record

   • Inventory all data maintained by third parties that relates to critical infrastructure assets. Section 17(1) specifies the data kinds that qualify; map datasets to the s 17 table (for example consumer smart‑meter electricity consumption, WHOIS queries, ICU usage).
   • Prepare the “description of the arrangements” required under s 17(2). That description must include: the name of the entity that maintains the data (s 17(2)(a)); if the maintaining entity is not the responsible entity then the entity’s ABN or equivalent business number if incorporated outside Australia, the head office or principal place of business address, and the country of incorporation (s 17(2)(b)(i)-(iii)); the address where the data is held and the server locations where practicable (s 17(2)(c)); the name of the cloud service where a cloud service is used (s 17(2)(d)); and the kinds of data the entity maintains (s 17(2)(e)).
   • Ensure data‑hosting contracts contain clauses enabling the required disclosures and providing for prompt updates on changes in data location or hosting provider.

4. Domain name system compliance

   • If you administer or operate parts of the .au ccTLD system, verify that the assets listed at s 16(3) are identified in your asset register: registry database, the public WHOIS service, .au top‑level authoritative name servers and second level authoritative servers (.com.au, .net.au, .org.au, .asn.au, .id.au, .edu.au, .gov.au).
   • Ensure WHOIS and registrant information fields listed in s 3(1) are maintained and can be produced if required by the Act’s operative provisions.

5. Financial market and payment systems monitoring

   • If you operate a financial market or a clearing, settlement, payment or trade repository, calculate the relevant market share, average daily values and notional transaction values for the statutory test periods (two consecutive quarters where required). See s 10(1)-(4).
   • For the payment systems named in s 10(5) table, confirm responsible entity details and account for any operational obligations arising under the Act.

6. Freight and logistics

   • For freight businesses with revenues near $150 million, assess whether the kinds of goods transported or stored match the categories in s 9(1)(c). If you transport groceries, therapeutic goods, certain medicines, liquid fuel to or from critical liquid fuel assets, or water‑treatment supplies, document routes and counterparties (for example which critical supermarket retailer or critical grocery wholesaler is involved).

7. Corporate and regulatory liaison

   • Maintain a direct line to the Department for matters where the Rules designate the Department as the relevant Commonwealth body for particular Part 2B subsections (s 18(1)-(2)). For other Part 2B matters, note the instrument’s directive that ASD is the relevant body.
   • Coordinate compliance with other regulators referenced in the Rules: ASIC/Corporations Act for market licences and financial stability standards (s 10); Therapeutic Goods Administration where freight of therapeutic goods is involved (s 9 and s 3(2) references); privacy regulators where large volumes of personal or sensitive information are involved (s 17(1)(c)).

8. Record‑keeping and audit trail

   • Keep dated records of how thresholds were calculated, who is the responsible entity for each asset, the content of s 17(2) descriptions, and any communications with Commonwealth bodies. The instrument’s emphasis on specific data fields and ABNs means that records showing contemporaneous compliance are important.

9. Review and update

   • Recompute market‑share and turnover metrics quarterly in order to detect when two consecutive quarters’ thresholds will be met under s 10(1). Review asset capacities and nameplate ratings annually and after major upgrades. Update the s 17(2) description promptly if a third‑party data host changes.

10. Legal verification

• Finally, because the Rules are definitional, you must read them in conjunction with the Security of Critical Infrastructure Act 2018 to determine the actual duties, reporting timelines, directions, and penalties that will apply once you have been placed in scope by the Rules.

This checklist is derived from the Rules’ concrete requirements (see particularly ss 3, 5-7, 9-10 and 17) and should be adapted into operational compliance checklists, contractual terms with third‑party providers, and board‑level reporting for entities that fall within the instrument’s definitions.