Part 2Requirements for a critical infrastructure risk management program

Part 2 Requirements for a critical infrastructure risk management program

7 Material risks

For subsection 30AH(8) of the Act, the material risks include the following:

(a) a stoppage or major slowdown of the critical infrastructure asset’s function for an unmanageable period;

(b) a substantive loss of access to, or deliberate or accidental manipulation of, a critical component of the critical infrastructure asset;

Note: Example The position, navigation and timing systems affecting provision of service or functioning of the asset.

(c) an interference with the critical infrastructure asset’s operation technology or information communication technology essential to the functioning of the asset;

Note: Example A Supervisory Control and Data Acquisition (SCADA) system.

(d) the storage, transmission or processing of sensitive operational information outside Australia, which includes:

(i) layout diagrams;

(ii) schematics;

(iii) geospatial information;

(iv) configuration information;

(v) operational constraints or tolerances information;

(vi) data that a reasonable person would consider to be confidential or sensitive about the asset;

(e) remote access to operational control or operational monitoring systems of the critical infrastructure asset.

8 Personnel hazards

(1) For paragraph 30AH(1)(c) of the Act, for personnel hazards, a responsible entity must establish and maintain a process or system in a CIRMP:

(a) to permit a person unescorted access to a critical infrastructure asset mentioned in subsection 4(1) only where:

(i) a background check of the person has been conducted in accordance with section 9; and

(ii) a person has been found suitable to have unescorted access to the critical infrastructure asset in accordance with section 10; and

(iii) an identity card has been issued to a person who meets the requirements in subparagraphs (i) and (ii); and

(b) to collect the identity and contact information for each person who has access to the critical infrastructure asset; and

(c) to record the date, time and duration of access to the critical infrastructure asset by each person; and

(d) as far as it is reasonably practicable to do so—to minimise or eliminate material risks:

(i) arising from a malicious or negligent person; and

(ii) arising from the off-boarding process for outgoing employees and contractors.

(2) For subsection 30AH(12) of the Act, the establishment and maintenance of processes or systems mentioned in subsection (1) is taken to be action that mitigates the relevant impact of personnel hazards on the critical infrastructure asset.