Security of Critical Infrastructure (Naval shipbuilding precinct) Rules (LIN 23/007) 2023

This instrument, titled the Security of Critical Infrastructure (Naval shipbuilding precinct) Rules (LIN 23/007) 2023, designates a specific geographic area as a critical infrastructure asset for the purposes of the parent Act and prescribes the risk-management and personnel-control requirements that apply to that asset. Mechanically, it:

• Identifies the Osborne Naval Shipyard precinct on Lefevre Peninsula, South Australia, as the mapped area within which assets used for the primary purposes of naval shipbuilding or sustainment are to be treated as critical infrastructure assets (s 4(1); Schedule 1).
• Defines who is the responsible entity for those assets: either an entity that has been granted exclusive control and use under a licence or contractual arrangement for the duration of that arrangement, or otherwise Australian Naval Infrastructure Pty Ltd (ABN 45 051 762 639) (s 4(2)).
• Applies Part 2A of the Act to those critical infrastructure assets, with Part 2A applying immediately for certain purposes and generally applying 12 months after an asset becomes a critical infrastructure asset (s 5(1)-(2)).
• Specifies the Department of Defence as the relevant Commonwealth regulator for these assets for the Act’s definition of that term (s 6).
• Prescribes minimum elements of the required critical infrastructure risk management program, including a non-exhaustive list of material risks that must be considered (s 7), a definition of personnel hazards and operational measures to address them (s 8), and detailed rules for background checks and suitability assessments linked to the AusCheck scheme (ss 9-10).

The instrument operates by importing elements of the AusCheck statutory scheme for background checks and identity verification (ss 3, 9), and by cross-referencing provisions and decision points in those AusCheck Regulations (not reproduced in this instrument) that a responsible entity must take into account when assessing suitability (s 10(2)(a)). It does not itself reproduce penalties or enforcement mechanics; rather it sets the circumstances in which Part 2A of the Act applies and specifies program requirements that the responsible entity must establish and maintain as part of a CIRMP (ss 5(1), 7-10).

In short, the instrument creates a targeted regulatory overlay over the Osborne Naval Shipyard precinct by: defining the asset boundary; naming the responsible entity default; importing AusCheck background-check requirements; specifying core risk categories for a CIRMP; and setting procedural duties for access control, identity verification, recordkeeping and off-boarding. Each of those mechanics is expressed as an obligation on the responsible entity under the instrument and is tied back to the Act and to the AusCheck scheme where the instrument requires use of those established systems (ss 4-10).

The instrument relies on a small set of interlocking concepts that determine both scope and compliance obligations. These concepts are defined or used in the instrument and are central to what a responsible entity must do.

Critical infrastructure asset: An asset is a critical infrastructure asset for the purposes of paragraph 9(1)(f) of the Act if it is located within the area identified on the map in Schedule 1 and is used primarily for naval shipbuilding or sustainment (s 4(1)). The instrument therefore ties the legal label to a map boundary and to a primary use test.

Responsible entity: For the assets within that mapped area, the responsible entity is either the party that has been granted exclusive control and use of the asset or area under a licence or contractual arrangement while that arrangement remains in force, or otherwise Australian Naval Infrastructure Pty Ltd (ABN 45 051 762 639) (s 4(2)). The responsible entity is the actor upon whom duties to implement a CIRMP and to run background checks fall (see ss 8-10).

CIRMP (critical infrastructure risk management program): The instrument repeatedly references “CIRMP” and prescribes particular elements that must form part of it. These include identifying and responding to material risks (s 7), establishing processes to manage personnel hazards (s 8), and conducting background checks and suitability assessments in line with the AusCheck scheme (ss 9-10).

Material risks: Section 7 lists material risks that a CIRMP must address. These include: stoppage or major slowdown of the asset’s function for an unmanageable period; substantive loss of access to or manipulation of a critical component; interference with operational technology or ICT essential to functioning; storage, transmission or processing of sensitive operational information outside Australia (with an enumerated set of information types such as layout diagrams, schematics, geospatial information, configuration and operational tolerances, and confidential data) (s 7(a)-(d)); and remote access to operational control or monitoring systems (s 7(e)).

Personnel hazards: The instrument defines “personnel hazard” to include where a person, through malice or negligence, either compromises the proper function of the asset or causes significant damage to it (s 3). For personnel hazards, the CIRMP must establish and maintain processes for controlled unescorted access, identity cards, identity and contact data collection, recording access events, and off-boarding measures to minimise or eliminate material risks (s 8).

Background checks and suitability assessments: Background checks must be conducted under the AusCheck scheme (s 9(2)), must cover the matters set out in paragraphs 5(a)-(d) of the AusCheck Act (s 9(3)), must assess the criminal history criteria (as defined in the instrument) (s 9(3)(a)), and must include both electronic and in-person identity checks (s 9(3)(b)). Background checks are required before unescorted access and, where ongoing access is needed, once every two years (s 9(1)). Following a background check, the responsible entity must assess suitability to have unescorted access, taking into account advice from the Secretary under specified provisions of the AusCheck Regulations, whether access would be prejudicial to security, and any other relevant information (s 10).

The instrument allocates duties and obligations to named actors and affects various categories of people and organisations that interact with the identified naval shipbuilding precinct.

Responsible entities: The primary legal actor affected is the responsible entity for each critical infrastructure asset within the area identified in Schedule 1. The instrument specifies who qualifies as responsible entity: either an entity holding exclusive control and use under a licence or contractual arrangement for as long as that arrangement remains in force, or otherwise Australian Naval Infrastructure Pty Ltd (ABN 45 051 762 639) (s 4(2)). That entity bears the statutory duties to create and maintain the CIRMP, to run background checks and suitability assessments, to issue identity cards, to collect and retain identity and contact information, to record access times and durations, and to manage off-boarding processes (s 8; ss 9-10).

Persons requiring access to the asset: Employees, contractors, subcontractors, visitors and any other person who requires unescorted access to the asset are directly affected. Before being granted unescorted access a person must undergo a background check under the AusCheck scheme (s 9(1)-(2)), be assessed as suitable (s 10(1)), and, if suitable, be issued an identity card that meets the instrument’s conditions (s 8(1)(a)(iii)). Where access is ongoing, a background check is required every two years (s 9(1)(b)).

The Department of Defence and the AusCheck Secretary: The instrument specifies the Department of Defence as the relevant Commonwealth regulator for these assets (s 6). It also embeds the AusCheck scheme into the requirements for background checks (s 9(2)), and it requires the responsible entity to consider advice from the Secretary under particular provisions of the AusCheck Regulations when assessing suitability (s 10(2)(a)). The instrument therefore affects these Commonwealth bodies by creating interaction points: the Department of Defence is the regulator for the Act’s purposes and the AusCheck Secretary’s advice and processes are inputs to the responsible entity’s suitability determinations.

Australian Naval Infrastructure Pty Ltd: Where there is no exclusive licence or contractual holder that meets the instrument’s test, Australian Naval Infrastructure Pty Ltd is designated as the responsible entity (s 4(2)(b)). That company is consequently affected as a potential default duty-holder for assets in the precinct.

Operators and service providers: Organisations that provide identity-verification technology, access-control systems, recordkeeping and data storage services, and any vendors needed to implement electronic and in-person identity checks will be indirectly affected because the responsible entity must procure those services to meet ss 8-9.

The instrument imposes specific duties on the responsible entity and creates defined rights or processes affecting persons who seek access. The duties are procedural and programme-oriented, focused on risk management, personnel vetting and recordkeeping.

Duties of the responsible entity

• Establish and maintain a CIRMP that, for personnel hazards, includes a process or system to permit unescorted access only where a person has had a background check under the AusCheck scheme, has been found suitable, and has been issued an identity card meeting the instrument’s requirements (s 8(1)(a)(i)-(iii)).
• Collect the identity and contact information for each person who has access to the asset (s 8(1)(b)).
• Record the date, time and duration of access to the asset by each person (s 8(1)(c)).
• To the extent reasonably practicable, minimise or eliminate material risks that arise from malicious or negligent persons and from the off-boarding process for outgoing employees and contractors (s 8(1)(d)(i)-(ii)); the instrument treats the establishment and maintenance of these processes as action that mitigates the relevant impact of personnel hazards (s 8(2)).
• Conduct background checks before granting unescorted access and, for ongoing access, once every two years (s 9(1)).
• Ensure that background checks are carried out under the AusCheck scheme and include assessments of the matters in paragraphs 5(a)-(d) of the AusCheck Act, apply the instrument’s criminal history criteria, and include both electronic and in-person identity verification (s 9(2)-(3)).
• Notify the Secretary if a background check is no longer required for a person (s 9(4)).
• After a background check, assess the person’s suitability to have unescorted access, taking into account advice from the Secretary under specified provisions of the AusCheck Regulations, whether granting unescorted access would be prejudicial to security, and any other relevant information (s 10(1)-(2)).

Rights, inputs and decision considerations

• The responsible entity is the decision-maker for suitability, but that decision must consider advice from the Secretary under specified AusCheck Regulations provisions (s 10(2)(a)). The instrument does not transfer final decision-making authority to the Secretary; rather it requires the responsible entity to consider the Secretary’s advice.
• The instrument prescribes a reporting interface where, in certain circumstances, a responsible entity may be required to inform the Secretary of a decision to grant or revoke access (note following s 10, citing AusCheck Regulations, s 21ZA). That creates an information exchange right and duty for the Secretary to be informed in prescribed circumstances.

The instrument establishes obligations and the framework for regulatory oversight, but it does not itself set penalties or specify enforcement mechanisms within its text. Instead, it does two things relevant to enforcement and penalties:

• It makes Part 2A of the Act applicable to the critical infrastructure assets identified by this instrument (s 5(1)). By doing so it brings the assets within the Act’s statutory regime, including whatever enforcement powers, compliance obligations, civil or criminal penalties, and enforcement processes are set out in Part 2A of the Act. The instrument leaves those provisions in the Act as the source of penalties and enforcement.
• It specifies the Department of Defence as the relevant Commonwealth regulator for these assets for the purposes of the Act’s definition of that term (s 6). This designation identifies which Commonwealth body has the role, under the Act, of exercising regulatory functions in relation to these assets.

What is contained in the instrument

• The instrument prescribes mandatory operational requirements: background checks under the AusCheck scheme, periodic re-checks every two years for ongoing access, electronic and in-person identity verification, recordkeeping of identity, contact and access events, issuance of identity cards to approved persons, and processes to minimise personnel-related risks including off-boarding (ss 8-10). Failure to perform those obligations would therefore be a breach of the duties imposed on the responsible entity by this instrument and by the Act insofar as the Act enforces breaches of Part 2A obligations, which the instrument activates (s 5(1)).

What is not contained in the instrument

• The instrument does not set specific fines, criminal offences, civil penalties, compliance notices, or administrative measures. It does not reproduce the Act’s enforcement sections. It does reference elements of the AusCheck Regulations as inputs to suitability assessments and reporting, but the instrument does not itself set penalties for non-compliance with the AusCheck Act or Regulations.

Consequences for practitioners

• To understand concrete penalties and enforcement routes for non-compliance with the duties the instrument imposes, a practitioner must consult the Act’s Part 2A provisions and the enforcement regime contained there. The instrument makes clear that those parts of the Act apply to these assets (s 5(1)), and that the Department of Defence is the relevant regulator (s 6). Absent text to the contrary in this instrument, enforcement and penalties therefore derive from the parent Act and its enforcement architecture.

The instrument is explicitly framed as an instrument that operates in tandem with the Act and with the AusCheck statutory scheme. Its provisions rely on, incorporate and direct interaction with those other statutory instruments.

Interaction with the parent Act

• The instrument repeatedly references provisions of the Act as the legal foundation for its effect. It specifies that the assets identified in Schedule 1 qualify as critical infrastructure assets for paragraph 9(1)(f) of the Act (s 4(1)). It applies Part 2A of the Act to those assets (s 5(1)). It specifies timing for the application of Part 2A consistent with subsection 30AB(3) of the Act (s 5(2)). It also supplies the required responsible entity definition for subsection 12L(23) of the Act (s 4(2)) and supplies a relevant Commonwealth regulator for the Act’s definition in section 5 (s 6). The instrument therefore functions as a location- and-purpose-specific implementation of the Act’s mechanistic references, plugging in the map, the responsible entity, and the regulator where the Act calls for such specification.

Interaction with the AusCheck Act and AusCheck Regulations

• The instrument makes background checks a condition of unescorted access and requires those checks to be conducted under the AusCheck scheme (s 9(2)). It requires background checks to include assessment of the matters mentioned in paragraphs 5(a)-(d) of the AusCheck Act (s 9(3)). It also defines “CIRMP criminal record” with the same meaning as in the AusCheck Regulations (s 3). Suitability assessments must consider advice from the Secretary under particular provisions of the AusCheck Regulations (s 10(2)(a)), and the instrument’s notes point to a separate AusCheck Regulations notification obligation in relation to decisions to grant or revoke access (note following s 10). Thus the instrument integrates the AusCheck machinery as the authorised vehicle for criminal-history and identity vetting, while preserving the responsible entity’s assessment function.

Division of roles and information flows

• The instrument places operational vetting and decision duties on the responsible entity, but it explicitly requires the responsible entity to take the AusCheck Secretary’s advice into account when assessing suitability (s 10(2)(a)). The instrument also requires notification to the Secretary if a background check is no longer required for a person (s 9(4)). This creates a bilateral information flow: the AusCheck statute supplies vetting capability and Secretary advice, and the responsible entity must use and report back to that system as required by the AusCheck Regulations referenced in the instrument.

The instrument itself contains a short header that identifies it by name and Legislative Instrument Number: the Security of Critical Infrastructure (Naval shipbuilding precinct) Rules (LIN 23/007) 2023 (s 1). No other amendments, prior versions, revocations or transitional provisions appear in the text supplied. The instrument contains a single schedule (Schedule 1) that identifies a geographic area by map (Osborne Naval Shipyard precinct).

What the text shows

• The instrument sets out its operative name at the start (s 1) and contains definitions, substantive rules and a single map-based schedule. There are no clauses or notes within the supplied text that record prior amendments, savings, transitional arrangements beyond the 12-month application timing in s 5(2), or repeal of earlier instruments.

Practical observation for users

• Because the instrument does not include an amendment history or transitional schedule beyond the 12-month clause applying Part 2A under subsection 30AB(3) of the Act (s 5(2)), practitioners should assume the Rules as supplied are the operative form unless and until a later amending instrument, repeal instrument, or consolidated instrument appears in the Federal Register of Legislation or other official registers. The instrument also contains an express mechanism to avoid overlap where other instruments cover the same paragraph of the Act (s 5(3)), implying that the legislative architecture allows for multiple instruments addressing different assets; practitioners should check for the existence of any such other instruments that might displace particular requirements.

No internal amendment log supplied

• The instrument text contains no annotation of prior versions, no marginal notes indicating amendment dates, and no reference to commencement beyond the substantive clauses. The single temporal provision of note is that Part 2A applies 12 months after the asset becomes a critical infrastructure asset for the purposes of subsection 30AB(3) of the Act (s 5(2)). The absence of a recorded amendment history in this text is therefore notable; any user seeking evidence of amendment or repeal must consult the public legislative database or the issuing authority’s records for post-2023 instruments.

In short, the instrument is presented as a 2023 legislative instrument with no internal amendment history in the supplied text. Users should verify on official registers for any subsequent changes, and should be alert to other instruments that may specify the same paragraph of the Act for other assets and thereby affect the operation of s 5(3).

The instrument supplies no litigation history. There are no references in the text to any court proceedings, judicial interpretations, or administrative appeals relating to these Rules. The text contains only statutory provisions, definitions and procedural requirements; it does not record any judicial decisions, challenges, or case law.

Implications of the absence of litigation references

• Because the instrument is a targeted legislative instrument that prescribes regulatory obligations for a specific precinct, the absence of litigation in the text suggests either that no public challenges had been finalised or recorded at the time this text was compiled, or that litigation history is recorded elsewhere. The instrument itself does not summarise or annotate any disputes about its interpretation or application.

What practitioners should do

• If the legal position on interpretation, enforcement or constitutionality of the instrument is relevant to a client matter, practitioners must search external sources for decisions that interpret the Act’s Part 2A provisions, the AusCheck scheme, or any judicial consideration of this instrument. The instrument explicitly links to the Act and the AusCheck Regulations as authoritative texts that will be the subject of litigation in future disputes, but the instrument does not itself report any such litigation.

How future litigation might arise

• Potential areas that could give rise to litigation, based on the instrument’s content, include disputes about: which entity is the responsible entity under s 4(2) where multiple parties claim exclusive control; the adequacy of a CIRMP in meeting the prescribed elements in ss 7-8; the scope and standard of suitability assessments under s 10; or the interaction between the responsible entity’s discretion and the AusCheck Secretary’s advice. None of these are adjudicated or mentioned in the instrument’s text, so any such litigation would be found outside the instrument and must be located through case law searches.

In short, the instrument records no litigation history and offers no judicially settled interpretations within its text. Practitioners requiring precedent or adjudicative history will need to consult court records and case reports that concern the parent Act, the AusCheck scheme, or instruments under the Act.

Several specific features of the Rules can cause compliance surprises if not anticipated. These “gotchas” are matters where the instrument’s drafting, cross-references or operational choices create precise obligations, potential gaps or timing effects that deserve close attention.

Geographic and use-based scope is narrow and map-bound (s 4(1); Schedule 1)

• Only assets located within the boundary shown in Schedule 1 and used for the primary purposes of naval shipbuilding or sustainment qualify as critical infrastructure assets under this instrument (s 4(1)). A facility physically inside the map but used for other primary purposes may fall outside the instrument’s scope. Conversely, a facility outside the boundary will not be covered by these Rules, even if functionally integrated with shipbuilding operations. Confirm the map boundary and the primary-use characterisation to determine whether the Rules apply.

Responsible entity depends on exclusive control or default company (s 4(2))

• Where exclusive control and use under a licence or contractual arrangement exists, that licence-holder is the responsible entity for as long as the licence remains in force (s 4(2)(a)). If no such exclusive licence applies, Australian Naval Infrastructure Pty Ltd becomes the responsible entity by default (s 4(2)(b)). Parties should determine whether exclusive control exists at a granular level, because that determines who carries the compliance and reporting obligations.

12-month application window may create a transitional compliance period (s 5(2))

• Part 2A applies 12 months after the asset becomes a critical infrastructure asset for the purposes of subsection 30AB(3) of the Act (s 5(2)). This creates a calendared window where some Part 2A obligations may be in abeyance; practitioners must track the relevant “becomes” date to know when full obligations begin.

Limited self-contained enforcement detail , enforcement in Act (s 5(1))

• The instrument does not set penalties. Enforcement, compliance notices and penalties are found in the Act’s Part 2A which is activated by these Rules (s 5(1)). Users must consult the Act to assess potential exposure for non-compliance.

AusCheck dependency and Secretary advice (ss 9-10)

• Background checks must be conducted under the AusCheck scheme and must include the specific matters in the AusCheck Act and AusCheck Regulations references (s 9(2)-(3)). Suitability must consider advice from the Secretary under specified paragraphs of the AusCheck Regulations (s 10(2)(a)). If the AusCheck scheme changes or its administrative processes are delayed, that may directly affect the responsible entity’s ability to onboard personnel and grant unescorted access.

This section gives an operational checklist mapped to the instrument’s provisions. The responsible entity should use this as a practical compliance roadmap anchored to the specific sections cited.

1. Confirm applicability and responsible entity (s 4(1)-(2); Schedule 1)

   • Verify whether the asset sits within the Schedule 1 map boundary and is used primarily for naval shipbuilding or sustainment (s 4(1); Schedule 1).
   • Determine if an entity holds exclusive control and use under a licence or contractual arrangement. If so, that entity is the responsible entity for the duration of the licence/contract (s 4(2)(a)). If not, confirm that Australian Naval Infrastructure Pty Ltd is the default responsible entity (s 4(2)(b)).

2. Note timing for Part 2A obligations (s 5(1)-(2))

   • Track the date the asset “becomes” a critical infrastructure asset to determine when Part 2A obligations apply. Part 2A will apply 12 months after that date for the purposes of subsection 30AB(3) of the Act (s 5(2)).

3. Design and document the CIRMP to address material risks (s 7)

   • Incorporate an explicit risk register that covers the material risks listed in s 7: stoppage/major slowdown, loss of access/manipulation of critical components, interference with operational technology/ICT (including SCADA systems as an example), storage/transmission/processing of sensitive operational information outside Australia (include layout diagrams, schematics, geospatial information, configuration details, operational constraints and confidential data), and remote access to operational control/monitoring systems (s 7(a)-(e)).
   • Map potential controls, monitoring, incident response steps and residual-risk tolerances against each material risk.

4. Implement personnel-hazard controls and lifecycle processes (s 8)

   • Create a documented process to permit unescorted access only after: a background check under AusCheck, a suitability finding, and issuance of an identity card that meets internal criteria (s 8(1)(a)(i)-(iii)).
   • Maintain a secure registry of identity and contact information for all persons with access (s 8(1)(b)).
   • Implement access logging systems that record date, time and duration of each person’s access (s 8(1)(c)).
   • Design and document off-boarding procedures to revoke access, reclaim credentials and remove privileges promptly, aiming to minimise material risks arising from off-boarding (s 8(1)(d)(ii)).