Document ID: chunk:federal_register_of_legislation:C2025C00045:section:35ab:p2
Version: federal_register_of_legislation:C2025C00045
Segment Type: section
Provision Reference: s 35AB (pt 2/4)
Character Range: 221136–224035

or more specified requests under section 35AX that relate to the incident and one or more specified critical infrastructure sector assets.
Note 1: Section 35AK deals with information gathering directions.
Note 2: Section 35AQ deals with action directions.
Note 3: Section 35AX deals with intervention requests. The Minister must not give an authorisation under paragraph (2)(e) or (f) unless the Minister is satisfied that the incident is a cyber security incident: see subsection (10).
 (3) An authorisation under subsection (2) is to be known as a Ministerial authorisation.
 (4) Subsection 33(3AB) of the Acts Interpretation Act 1901 does not apply to subsection (2) of this section.
Note: Subsection 33(3AB) of the Acts Interpretation Act 1901 deals with specification by class.

Information gathering directions
 (5) A Ministerial authorisation under paragraph (2)(a) or (b):
 (a) is generally applicable to the incident and the asset or assets concerned; and
 (b) is to be made without reference to any specific directions.
 (6) The Minister must not give a Ministerial authorisation under paragraph (2)(a) or (b) unless the Minister is satisfied that the directions that could be authorised by the Ministerial authorisation are likely to facilitate a practical and effective response to the incident.

Action directions
 (7) The Minister must not give a Ministerial authorisation under paragraph (2)(c) or (d) in relation to a specified entity unless the Minister is satisfied that:
 (a) the specified entity is unwilling or unable to take all reasonable steps to respond to the incident; and
 (b) the specified direction is reasonably necessary for the purposes of responding to the incident; and
 (c) the specified direction is a proportionate response to the incident; and
 (d) compliance with the specified direction is technically feasible.
Note: Section 12P provides examples of responding to an incident (including a cyber security incident).
 (8) In determining whether the specified direction is a proportionate response to the incident, the Minister must have regard to:
 (a) the impact of the specified direction on:
 (i) the activities carried on by the specified entity; and
 (ii) the functioning of the asset or assets concerned; and
 (b) the consequences of compliance with the specified direction; and
 (c) such other matters (if any) as the Minister considers relevant.
 (9) The Minister must not give a Ministerial authorisation under paragraph (2)(c) or (d) in relation to a specified entity if the specified direction:
 (a) requires the specified entity to permit the authorised agency to do an act or thing that could be the subject of a request under section 35AX; or
 (b) requires the specified entity to take offensive cyber action against a person who is directly or indirectly responsible for the incident.
 (9A) Without limiting paragraph (2)(c) or (d), a direction