Document ID: chunk:federal_register_of_legislation:F2023L00112:front:0:p1
Version: federal_register_of_legislation:F2023L00112
Segment Type: other
Provision Reference: 
Character Range: 0–3097

LIN 23/006
Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023
I, Clare O'Neil, Minister for Home Affairs, make this instrument under section 61 of the Security of Critical Infrastructure Act 2018 (the Act).
Dated 31 January 2023
Clare O'Neil
Minister for Home Affairs

Part 1 Preliminary

1 Name
        This instrument is the Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023.

2 Commencement
        This instrument commences on the later of:
(a) immediately after the AusCheck Legislation Amendment (Critical Infrastructure Background Check) Regulations 2023 commence; and
(b) the day after registration.

3 Definitions
Note A number of phrases used in this instrument are defined in the Act, including:
        (a)  critical component;
        (b)  critical infrastructure asset;
        (c)  critical hospital;
        (d)  critical worker;
(d) relevant impact;
      (e) responsible entity;
      (f) security.
        In this instrument:
AusCheck Act means the AusCheck Act 2007.
AusCheck Regulations means the AusCheck Regulations 2017.
background check means a background check under the AusCheck Act.
CI asset means a critical infrastructure asset.
CIRMP is short for critical infrastructure risk management program.
CIRMP criminal record has the same meaning as defined in the AusCheck Regulations.
criminal history criteria means the assessment of:
       (a)   whether the person has a CIRMP criminal record; and
       (b)   the nature of the offence.
cyber and information security hazard includes where a person, whether authorised or not:
(a) improperly accesses or misuses information or computer systems about or related to the CI asset; or
(b) uses a computer system to obtain unauthorised control of, or access to the CI asset that might impair its proper functioning.
designated hospital means a critical hospital mentioned in Schedule 1.
major supplier means any vendor that by nature of the product or service they offer, has a significant influence over the security of a responsible entity's CI asset.
natural hazard includes fire, flood, cyclone, storm, heatwave, earthquake, tsunami, space weather or biological health hazard (such as a pandemic).
personnel hazard includes where a critical worker acts, through malice or negligence:
(a) to compromise the proper function of the asset; or
(b) to cause significant damage to the asset.
physical security hazard includes the unauthorised access to, interference with, or control of CI assets, to compromise the proper function of the asset or cause significant damage to the asset.
Secretary has the same meaning as defined in the AusCheck Act.
supply chain hazard includes malicious people both internal and external exploiting, misusing, accessing or disrupting the supply chain and over-reliance on particular suppliers.

4 Application of Part 2A of the Act
       (1) For paragraph 30AB(1)(a) of the Act, each of the following is specified:
(a) a critical broadcasting asset;
(b) a critical domain