Document ID: chunk:federal_register_of_legislation:F2023L00112:front:0:p2
Version: federal_register_of_legislation:F2023L00112
Segment Type: other
Provision Reference: 
Character Range: 2846–5800

or disrupting the supply chain and over-reliance on particular suppliers.

4 Application of Part 2A of the Act
       (1) For paragraph 30AB(1)(a) of the Act, each of the following is specified:
(a) a critical broadcasting asset;
(b) a critical domain name system;
(c) a critical data storage or processing asset;
(d) a critical electricity asset;
(e) a critical energy market operator asset;
(f) a critical gas asset;
(g) a designated hospital;
(h) a critical food and grocery asset;
(i) a critical freight infrastructure asset;
(j) a critical freight services asset;
(k) a critical liquid fuel asset;
(l) a critical financial market infrastructure asset mentioned in paragraph 12D(1)(i) of the Act;
(m) a critical water asset.
       (2) For subsection 30AB(3) of the Act, Part 2A of the Act does not apply to a CI asset mentioned in subsection 4(1) during the period beginning when the asset became a CI asset and ending the later of:
(a) 6 months after the commencement of this instrument; and
(b) 6 months after the asset became a CI asset.
       (3) The requirements specified in this instrument for paragraph 30AH(1)(c), and subsections 30AKA(1), (3) and (5) of the Act, apply to a CI asset:
(a) that is:
 (i) specified in subsection 4(1); and
 (ii) not specified in another instrument for paragraph 30AB(1)(a) of the Act; or
(b) referred to in paragraph 30AB(1)(b) of the Act.

5 Relevant Commonwealth regulator
        For subparagraph (b)(ii) of the definition of relevant Commonwealth regulator in section 5 of the Act, the Reserve Bank of Australia is specified for a critical financial market infrastructure asset mentioned in paragraph 12D(1)(i) of the Act.

Part 2 Requirements for a critical infrastructure risk management program

6 Material risk
        For subsection 30AH(8) of the Act, material risk includes:
(a) a stoppage or major slowdown of the CI asset's function for an unmanageable period;
(b) a substantive loss of access to, or deliberate or accidental manipulation of, a critical component of the CI asset;
Example The position, navigation and timing systems affecting provision of service or functioning of the asset.
(c) an interference with the CI asset's operational technology or information communication technology essential to the functioning of the asset;
Example A Supervisory Control and Data Acquisition (SCADA) system.
(d) the storage, transmission or processing of sensitive operational information outside Australia, which includes:
 (i) layout diagrams;
 (ii) schematics;
 (iii) geospatial information;
 (iv) configuration information;
 (v) operational constraints or tolerances information;
 (vi) data that a reasonable person would consider to be confidential or sensitive about the asset;
(e) remote access to operational control or operational monitoring systems of the CI asset.

7 General—all hazards
       (1) For paragraph 30AH(1)(c) of the Act, a responsible entity must establish and maintain