The owners, operators, or vendors of critical infrastructure must register assets with the government, providing detailed information such as asset location, service areas, utilisation arrangements, data storage or processing, and operational dependencies. Failure to register your assets can result in breach of the legislative act and regulatory standards.

Asset owners and operators should maintain holistic digital and physical structural security, as well as supply chain security, such as strong measures for the data service providers involved in storing or processing data related to the critical infrastructure assets.

PSO requires the establishment of a Critical Infrastructure Risk Management Program (CIRMP), for vulnerability assessment and risk mitigation, which must be reported to Cyber and Infrastructure Security Centre (CISC) annually for compliance monitoring.

The implementation of a Risk Management Program (RMP) should holistically cover various types of hazards, whether technological issues like digital ecosystem malfunction, operational failures, or physical dysfunctionalities due to natural disasters. As a part of RMP, the legislation requires a cyber security incident response plan, to be developed and submitted to the secretary department of home affairs. Critical infrastructure assets must go under cyber security testing and simulated attacks, which will be reviewed by the authorised representative from the Australian Cyber Security Centre (ACSC) and check if critical assets are equipped to address security challenges. Also, annual reports must be submitted according to the Australian financial year and regulatory standards, as a support document outlining the measures taken for advancing security and threat defence mechanism.

In failure of compliance with RMP obligations, there can be regulatory action. However, the act currently limits the regulator’s ability to issue directions on remediation.

Cyber incidents must be reported to ACSC within 12 hours, with track of occurrence, analyses, and response to threats. In case of ransom payments, while ambiguously legal, there is a requirement to report within 72 hours of the events under ransom payment notification obligations. Any changes related to the internal information management system such as contact information, reporting entity, change in ownership, or changes in power and control should be disclosed near-real-time. In consideration of an overall incident management uplift, reporting cyber incidents within the recommended timeframe will assist with response and recovery procedures.

According to the reforms, an ‘all-hazards’ approach should be followed, which includes, not only incidents post-occurrence but also consequence management of potential events like ransom payments.

To avoid legal risks and authorities’ limited ability, the SOCI Act allows government to intervene in case of significant threats and offer assistance to ensure quick response and recovery. The government will also provide instruction on using and disclosing sensitive information related to national security. By establishing a mechanism for sharing reports and information on critical infrastructure management, authorities can issue guidelines and remediation help in crisis management, through the framework.