Australia : Reform of "Protecting Critical Infrastructure and Systems of National Significance" Framework - Release of exposure draft legislations

24-hour hotline : 23 922 922

e-mail address : enquiry@tid.gov.hk

Ref: EIC 891/1/2

18 November 2020

Dear Sirs,

Further to Commercial Information Circular No. 721/2020 cum Textiles Trader Registration Circular No.12/2020 of 28 September 2020, the Australian Government released on 9 November 2020 the Security Legislation Amendment (Critical Infrastructure) Bill 2020 (the "Bill") and the Intelligence Services Regulations 2020 to give effect to the proposed Reform of Protecting Critical Infrastructure and Systems of National Significance Framework. This circular provides information for traders' reference.

2.The Bill seeks to amend the Security of Critical Infrastructure Act 2018 (the "Act") to implement an enhanced framework to uplift the security and resilience of Australia's critical infrastructure. The Bill includes three key definitions outlying the expanded coverage of the Act -

1. Critical infrastructure sector - The Bill will expand its existing coverage of the Act (covering only electricity, gas, water and maritime ports sectors) to eleven sectors which include communications; financial services and markets; data storage and processing; defence industry; higher education and research; energy; food and grocery; health care and medical; space technology; transport; and water and sewerage.
2. Critical infrastructure asset - The definitions of critical infrastructure assets within each of the eleven critical sectors will be introduced.
3. Systems of national significance - The Australian Minister for Home Affairs will have the power to declare a critical infrastructure asset as a "system of national significance", which is a significantly smaller subset of critical infrastructure assets.

3.Those fall within the definitions newly covered in the Bill will be subject to the powers in the following aspects: (i) "Positive Security Obligation" for critical infrastructure entities, including, amongst others, to adopt and maintain an all-hazards critical infrastructure a risk management programme; (ii) "Enhanced Cyber Security Obligations" for "systems of national significance" to undertake one or more prescribed cyber security activities; and (iii) Government assistance to industry in response to immediate and serious cyber-attacks to Australian systems.

4.The new definitions and powers under the Bill are expected to take effect in mid-2021. The exposure draft legislation is available at the following link (English version only) - https://www.homeaffairs.gov.au/reports-and-publications/submissions-and-discussion-papers/protecting-critical-infrastructure-systems.

5.The Australian Government is inviting public views and feedback on the exposure draft legislation by 27 November 2020 (5 pm, AEDT). Submissions can be made to the Australian Government direct at the following link (English only) - https://www.homeaffairs.gov.au/reports-and-publications/submissions-and-discussion-papers/protecting-critical-infrastructure-systems/submission-form.

6.For enquiries concerning the content of this circular, please contact us at 2398 5594.

Yours faithfully,

(Miss Carmen Chan)
for Director-General of Trade and Industry

Note: While every effort is made to ensure the accuracy of the above information, the Department cannot guarantee this to be so and will not be held liable for any reliance placed on the same.