11Notification of critical cyber security incidents

11 Notification of critical cyber security incidents

(1) Subject to subsection (5), when a carrier becomes aware that: (a) a cyber security incident has occurred or is occurring; and (b) the incident has had, or is having, a significant impact (whether direct or indirect) on the availability of any of its assets; and (c) the carrier must: (i) give the ASD a report about the incident; and (ii) do so as soon as practicable, and in any event within 12 hours, after the carrier becomes so aware. Significant impact (2) For the purposes of subsection (1), a cyber security incident has a significant impact (whether direct or indirect) on the availability of an asset if, and only if, both: (a) the asset is used in connection with the provision of essential goods or services; and (b) the incident has materially disrupted the availability of those essential goods or services. Form of report (3) A report under subsection (1) may be given: (a) orally; or (b) in writing in the approved form. (4) If a report under subsection (1) is given orally, the carrier must: (a) do both of the following: (i) make a written record of the report in the approved form; (ii) give a copy of the written record of the report to the authorised ASD officer; and (b) do so within 84 hours after the report is given. (5) The obligation under subsection (1) does not apply in respect of a particular cyber security incident if an authorised ASD officer has provided advice in writing to the carrier that a report about the incident is not required. For the avoidance of doubt, such a notice is not a legislative instrument.