12Notification of other cyber security incidents

12 Notification of other cyber security incidents

(1) Subject to subsection (5), when an eligible carriage service provider becomes aware that: (a) a cyber security incident has occurred, is occurring or is imminent; and (b) the incident has had, is having, or is likely to have, a relevant impact on an asset of the eligible carriage service provider; the eligible carriage service provider must: (c) give ASD, a report about the incident, and (d) do so as soon as practicable, and in any event within 72 hours, after the eligible carriage service provider becomes so aware. Relevant impact (2) For the purposes of subsection (1), each of the following is a relevant impact of a cyber security incident on an asset: (a) an impact (whether direct or indirect) of the incident on the availability of the asset; (b) an impact (whether direct or indirect) of the incident on the integrity of the asset; (c) an impact (whether direct or indirect) of the incident on the reliability of the asset; (d) an impact (whether direct or indirect) of the incident on the confidentiality of: (i) information about the asset; or (ii) if information is stored in the asset—that information; or (iii) if the asset is computer data—that computer data. (3) A report under subsection (1) may be given: (a) orally; or (b) in writing in the approved form. (4) If a report under subsection (1) is given orally, the eligible carriage service provider must: (a) do both of the following: (i) make a written record of the report in the approved form; (ii) give a copy of the written record of the report to ASD; and (b) do so within 48 hours after the report is given. (5) The obligation under subsection (1) does not apply in respect of a particular cyber security incident if an authorised ASD officer has provided advice in writing to the eligible carriage service provider that a report about the incident is not required.

Note: Staff members of ASD are subject to section 40G of the Intelligence Services Act 2001 (Cth), which makes imposes an offence for those staff members, relating the intentional unauthorised dealings with certain records obtained by reason of his or her being, or having been, a staff member of ASD. A breach of section 40G carries a maximum penalty of imprisonment for 3 years.