Australia : Reform of "Protecting Critical Infrastructure and Systems of National Significance" Framework

24-hour hotline : 23 922 922

e-mail address : enquiry@tid.gov.hk

Ref: EIC 891/1/2

20 January 2022

Dear Sirs,

Further to Commercial Information Circular No. 845/2020 cum Textiles Trader Registration Circular No.15/2020 of 18 November 2020 informing the trade, amongst others, of the release of the Security Legislation Amendment (Critical Infrastructure) Bill 2020 (the "Bill") by the Australian Government which gave effect to its reform of Protecting Critical Infrastructure and Systems of National Significance Framework (the Reform), this circular sets out the latest development of the Reform.

2.In response to the increasing cyber security threats to essential services, businesses and all levels of the Australian Government, the Reform was initiated to provide a framework for managing risks to national security relating to critical infrastructure. While the substance of the Bill basically remains unchanged, it has been split into two separate bills to accord priority to certain measures. The first bill entitled the Security Legislation Amendment (Critical Infrastructure) Act 2021 (the SLACI Act) has already come into force with effect from 2 December 2021. The SLACI Act expands the coverage to 11 critical infrastructure sectors and defines 22 critical infrastructure assets. Entities which fall within the defined assets are subject to the new powers of "Positive Security Obligation" and Government assistance. Details of the SLACI Act is available at the following link (English version only) - https://www.legislation.gov.au/Details/C2021A00124.

3.The second bill, entitled the Security Legislation Amendment (Critical Infrastructure Protection) Bill 2022 (the SLACIP Bill), captures the non-urgent elements which are not covered in the SLACI Act -

1. To introduce an additional "Positive Security Obligation" in the form of a requirement in adopting and maintaining a critical infrastructure Risk Management Program;
2. To introduce "Enhanced Cyber Security Obligation" with a view to strengthening the cyber preparedness and resilience of entities that operate critical infrastructure assets of the highest criticality (namely, "systems of national significance");
3. To empower the Australian Government to declare a critical infrastructure asset to be a system of national significance and thus impose the "Enhanced Cyber Security Obligation"; and
4. To stipulate rules governing disclosure of information under certain conditions.

The exposure draft legislation of the SLACIP Bill is available at the following link (English version only) - https://www.homeaffairs.gov.au/reports-and-publications/submissions-and-discussion-papers/slacip-bill-2022. The Australian Government is inviting public views and feedback by 1 February 2022 (9am, AEDT). Submissions can be made to the Australian Government direct via CI.Reforms@homeaffairs.gov.au.

4.As part of the Reform, the Australian Government has also released the exposure draft legislation on the Transport Security Amendment (Critical Infrastructure) Bill 2022, which covers the aviation and maritime transport sectors, for public consultation by 1 February 2022 (11:59pm, AEDT). Details are available at the following link (English version only) - https://www.homeaffairs.gov.au/reports-and-publications/submissions-and-discussion-papers/exposure-draft-transport-security-amendment-critical-infrastructure-bill-2021.

5.For enquiries concerning the content of this circular, please contact us at 2398 5594.

Yours faithfully,

(Miss Ingrid Lee)
for Director-General of Trade and Industry

Note: While every effort is made to ensure the accuracy of the above information, the Department cannot guarantee this to be so and will not be held liable for any reliance placed on the same.