11Notification of critical cyber security incidents

11 Notification of critical cyber security incidents

(1) Subject to subsection (5), when an eligible carriage service provider becomes aware that: (a) a cyber security incident has occurred or is occurring; and (b) the incident has had, or is having, a significant impact (whether direct or indirect) on the availability of any of its assets; and (c) the eligible carriage service provider must: (i) give ASD a report about the incident; and (ii) do so as soon as practicable, and in any event within 12 hours, after the eligible carriage service provider becomes so aware. Significant impact (2) For the purposes of subsection (1), a cyber security incident has a significant impact (whether direct or indirect) on the availability of an asset if, and only if, both: (a) the asset is used in connection with the provision of essential goods or services; and (b) the incident has materially disrupted the availability of those essential goods or services. Form of report (3) A report under subsection (1) may be given: (a) orally; or (b) in writing in the approved form. (4) If a report under subsection (1) is given orally, the carriage service provider must: (a) do both of the following: (i) make a written record of the report in the approved form; (ii) give a copy of the written record of the report to ASD; and (b) do so within 84 hours after the report is given. (5) The obligation under subsection (1) does not apply in respect of a particular cyber security incident if an authorised ASD officer has provided advice in writing to the carriage service provider that a report about the incident is not required. For the avoidance of doubt, such a notice is not a legislative instrument.