Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022

Made under section 61 of the Security of Critical Infrastructure Act 2018 (the Act).

Compilation No. 1

Compilation date: 4 April 2025

Includes amendments: F2025L00324

About this compilation

This compilation

This is a compilation of the Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022 that shows the text of the law as amended and in force on 04/04/2025 (the compilation date).

The notes at the end of this compilation (the endnotes) include information about amending laws and the amendment history of provisions of the compiled law.

Uncommenced amendments

The effect of uncommenced amendments is not shown in the text of the compiled law. Any uncommenced amendments affecting the law are accessible on the Register (www.legislation.gov.au). The details of amendments made up to, but not commenced at, the compilation date are underlined in the endnotes. For more information on any uncommenced amendments, see the Register for the compiled law.

Application, saving and transitional provisions for provisions and amendments

If the operation of a provision or amendment of the compiled law is affected by an application, saving or transitional provision that is not included in this compilation, details are included in the endnotes.

Modifications

If the compiled law is modified by another law, the compiled law operates as modified but the modification does not amend the text of the law. Accordingly, this compilation does not show the text of the compiled law as modified. For more information on any modifications, see the Register for the compiled law.

Self‑repealing provisions

If a provision of the compiled law has been repealed in accordance with a provision of the law, details are included in the endnotes.

Contents

1  Name

3  Definitions

4  Application of Part 2 of the Act

5  Application of Part 2B of the Act

Endnotes

Endnote 1—About the endnotes

Endnote 2—Abbreviation key

Endnote 3—Legislation history

Endnote 4—Amendment history

1  Name

  This instrument is the Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022.

3  Definitions

  In this instrument:

Act means the Security of Critical Infrastructure Act 2018.

Aviation Transport Security Act means the Aviation Transport Security Act 2004.

Aviation Transport Security Regulations means the Aviation Transport Security Regulations 2005.

cargo terminal and cargo terminal operator have the meaning given by section 102B of the Customs Act 1901.

designated airport has the same meaning as in regulation 3.01B of the Aviation Transport Security Regulations.

prescribed air service has the meaning given by section 9 of the Aviation Transport Security Act.

regulated air cargo agent has the meaning given by regulation 4.42 of the Aviation Transport Security Regulations.

relevant carriage service provider asset is a critical infrastructure asset owned or operated by a carriage service provider where:

 (a) the asset is used in connection with the supply of at least 20,000 active total carriage services including any of the following:

 (i) broadband services;

 (ii) fixed telephone services;

 (iii) public mobile telecommunications services;

 (iv) voice only services; or

 (b) the responsible entity for the asset is aware that the asset is used in connection with carriage services supplied to a Commonwealth entity (other than a body corporate established by a law of the Commonwealth).

screened air service has the meaning given by regulation 4.02 of the Aviation Transport Security Regulations.

Note Expressions used in this instrument have the same meaning as in the Act from time to time—Legislation Act 2003, paragraph 13(1)(b).

4  Application of Part 2 of the Act

 (1) For paragraph 18A(1)(a) of the Act, each of the following assets, other than an asset mentioned in subsection (2), is specified:

 (a) a critical broadcasting asset;

 (b) a critical domain name system;

 (c) a critical data storage or processing asset;

 (d) a critical financial market infrastructure asset that is a payment system;

 (e) a critical food and grocery asset;

 (f) a critical hospital;

 (g) a critical freight infrastructure asset;

 (h) a critical freight services asset;

 (i) a critical public transport asset;

 (j) a critical liquid fuel asset;

 (k) a critical energy market operator asset;

 (l) a critical electricity asset that was not a critical infrastructure asset immediately before the commencement of section 18A of the Act;

 (m) a critical gas asset that was not a critical infrastructure asset immediately before the commencement of section 18A of the Act;

 (n) a critical telecommunications asset that is:

 (i) owned or operated by a carrier; or

 (ii) relevant carriage service provider asset.

Note 1 Under section 18A(1)(c) of the Act, Part 2 of the Act continues to apply to critical infrastructure assets that were critical infrastructure assets immediately before the commencement of section 18A.

Note 2 A data storage system that meets all of the requirements under subsection 9(7) of the Act in respect of a critical infrastructure asset specified in subsection (1) is taken to be part of the critical infrastructure asset.

 (2) An asset mentioned in an item the following table that is owned or operated by the entity mentioned in the item.

Grace period

 (3) For subsection 18A(3) of the Act, Part 2 of the Act does not apply to an asset mentioned in subsection (1) during the period beginning when the asset became a critical infrastructure asset and ending at the later of:

 (a) 6 months after the commencement of this instrument; and

 (b) 6 months after the asset became a critical infrastructure asset mentioned in subsection (1).

5  Application of Part 2B of the Act

 (1) For paragraph 30BB(1)(a) of the Act, each of the following assets, other than an asset mentioned in subsection (3) and (4), is specified:

 (a) a critical broadcasting asset;

 (b) a critical domain name system;

 (c) a critical data storage or processing asset;

 (d) a critical banking asset;

 (e) a critical superannuation asset;

 (f) a critical insurance asset;

 (g) a critical financial market infrastructure asset;

 (h) a critical food and grocery asset;

 (i) a critical hospital;

 (j) a critical education asset;

 (k) a critical freight infrastructure asset;

 (l) a critical freight services asset;

 (m) a critical public transport asset;

 (n) a critical liquid fuel asset;

 (o) a critical energy market operator asset;

 (p) a critical aviation asset mentioned in subsection (2);

 (q) a critical port;

 (r) a critical electricity asset;

 (s) a critical gas asset;

 (t) a critical water asset.

 (u) a critical telecommunications asset that is:

 (i) owned or operated by a carrier; or

 (ii) a relevant carriage service provider asset.

Note A data storage system that meets all of the requirements under subsection 9(7) of the Act in respect of a critical infrastructure asset specified in subsection (1) is taken to be part of the critical infrastructure asset.

 (2) A critical aviation asset that is any of the following:

 (a) a designated airport;

 (b) an asset used to perform an Australian prescribed air service operating screened air services that depart from a designated airport;

 (c) a cargo terminal that:

 (i) is owned or operated by a regulated air cargo agent that is also a cargo terminal operator; and

 (ii) is located at a designated airport.

 (3) An asset mentioned in an item the following table that is owned or operated by the entity mentioned in the item.

 (4) An asset that:

 (a) on or after the commencement of Part 1 of Schedule 3 to the Transport Security Amendment (Critical Infrastructure) Act 2022—is a critical aviation asset; or

 (b) on or after the commencement of Part 2 of Schedule 3 to the Transport Security Amendment (Critical Infrastructure) Act 2022—is a critical maritime asset.

Grace period

 (5) For subsection 30BB(3) of the Act, Part 2B of the Act does not apply to an asset mentioned in subsection (1) during the period beginning when the asset became a critical infrastructure asset and ending at the later of:

 (a) 3 months after the commencement of this instrument; and

 (b) 3 months after the asset became a critical infrastructure asset mentioned in subsection (1).

Endnotes

Endnote 1—About the endnotes

The endnotes provide information about this compilation and the compiled law.

The following endnotes are included in every compilation:

Endnote 1—About the endnotes

Endnote 2—Abbreviation key

Endnote 3—Legislation history

Endnote 4—Amendment history

Abbreviation key—Endnote 2

The abbreviation key sets out abbreviations that may be used in the endnotes.

Legislation history and amendment history—Endnotes 3 and 4

Amending laws are annotated in the legislation history and amendment history.

The legislation history in endnote 3 provides information about each law that has amended (or will amend) the compiled law. The information includes commencement details for amending laws and details of any application, saving or transitional provisions that are not included in this compilation.

The amendment history in endnote 4 provides information about amendments at the provision (generally section or equivalent) level. It also includes information about any provision of the compiled law that has been repealed in accordance with a provision of the law.

Misdescribed amendments

A misdescribed amendment is an amendment that does not accurately describe how an amendment is to be made. If, despite the misdescription, the amendment can be given effect as intended, then the misdescribed amendment can be incorporated through an editorial change made under section 15V of the Legislation Act 2003.

If a misdescribed amendment cannot be given effect as intended, the amendment is not incorporated and “(md not incorp)” is added to the amendment history.

Endnote 2—Abbreviation key

Endnote 3—Legislation history

Endnote 4—Amendment history