Document ID: chunk:federal_register_of_legislation:F2024C00120:reg:11
Version: federal_register_of_legislation:F2024C00120
Segment Type: reg
Provision Reference: reg 11
Character Range: 17743–19533

11  Notification of critical cyber security incidents
        (1) Subject to subsection (5), when a carrier becomes aware that:
         (a) a cyber security incident has occurred or is occurring; and
         (b) the incident has had, or is having, a significant impact (whether direct or indirect) on the availability of any of its assets; and
         (c) the carrier must:
            (i) give the ASD a report about the incident; and
            (ii) do so as soon as practicable, and in any event within 12 hours, after the carrier becomes so aware.
       Significant impact
        (2) For the purposes of subsection (1), a cyber security incident has a significant impact (whether direct or indirect) on the availability of an asset if, and only if, both:
         (a) the asset is used in connection with the provision of essential goods or services; and
         (b) the incident has materially disrupted the availability of those essential goods or services.
       Form of report
        (3) A report under subsection (1) may be given:
         (a) orally; or
         (b) in writing in the approved form.
        (4) If a report under subsection (1) is given orally, the carrier must:
         (a) do both of the following:
            (i) make a written record of the report in the approved form;
            (ii) give a copy of the written record of the report to the authorised ASD officer; and
         (b) do so within 84 hours after the report is given.
        (5) The obligation under subsection (1) does not apply in respect of a particular cyber security incident if an authorised ASD officer has provided advice in writing to the carrier that a report about the incident is not required.  For the avoidance of doubt, such a notice is not a legislative instrument.