With increased threats to critical infrastructure worldwide the Australian Federal Government has heightened cyber security requirements for service providers critical to Australian infrastructure.
Regulatory changes made to the Critical Infrastructure Bill expanded the scope to apply to more industries. The changes also make company directors personally accountable for cyber security failures in these areas.
The amendments to the Security of Critical Infrastructure (SOCI) Act 2018, which came into effect 1 April 2022, give the Federal Government unprecedented powers to enforce the obligations of the organisations concerned. The act governs domestic national security risks presented by foreign interference such as espionage, sabotage and coercion in our national critical infrastructure.
There is a mandatory reporting obligation amendment in the event of a cyber incident with an impact deemed critical or relevant, whereby service providers under these obligations are required to report within 12 to 72 hours.
What are the critical infrastructure sectors with cyber security obligations in Australia?
The scope of what is considered critical infrastructure and assets includes 11 essential sectors.
- Communications — critical telecommunications, broadcasting, domain name system
- Data storage or processing
- Defence industry
- Energy — critical electricity, gas, energy market operation, liquid fuel
- Financial services and markets
- Food and grocery — critical food and grocery assets
- Healthcare and medical — a critical hospital
- Higher education and research — a critical education asset
- Space technology
- Transport — critical port, freight infrastructure, public transport, aviation assets
- Water and sewerage.
What are the critical infrastructure cyber security obligations?
The act significantly increases the Federal Government's ability to enforce obligations for critical infrastructure assets and to intervene in the security response of private organisations.
Under the SOCI amendments owners or operators of critical infrastructure assets are required to develop a cyber risk management program and have this signed off by their board, council or other governing body before registering it with the government's Cyber and Infrastructure Security Centre.
In developing these measures the organisations concerned must also comply with a set of risk management rules focusing on cyber and information security, as well as personnel hazards, supply chains, physical security and natural hazards.
Reporting of cyber incidents in these industries to the Cyber and Infrastructure Security Centre is obligatory, with hefty penalties for failure to comply. Significantly, company directors can be held personally accountable if the response to cyber breaches is found to be lacking.
Providers of key public services that fail to register their critical infrastructure assets, risk management and continuity plans for protecting them potentially face governmental intervention under extraordinary powers.
Extra government powers over infrastructure cyber security
The revised SOCI act provides for intervention measures giving the government last resort powers in cases where no existing regulations apply to a cyber incident likely to seriously affect national social or economic security, defence or security.
Under these powers the Minister of Home Affairs can authorise the Secretary of Home Affairs to direct an organisation to take specific actions in response to incidents, provided the organisation is consulted and/or is unwilling or unable to take the action deemed necessary.
Cyber security a board level management issue
This legislation extends responsibility for cyber security from the IT division to the boardroom, putting the focus on cyber security strategy and protection, affecting how businesses approach risk management and the need for documented protocols for responding to cyber incidents.
As well as implementing measures to prevent cyber attacks, businesses also need to address data cache and supply chain risks. They will need to know what information they hold, where it's stored, how it's secured and what the procedure is for protecting and disposing of it.
Similarly they need to ascertain the cyber security provisions in place in their supply chain and ensure that they too are adequate.
How Gallagher can help
In addition to cyber insurance protection Gallagher offers expertise, advice and resources for building business resilience to withstand cyber security incidents.
