This Act creates a framework for managing risks to national security relating to critical infrastructure.
The framework consists of the following:
(a) the keeping of a register of information in relation to critical infrastructure assets (the register will not be made public);
(b) requiring certain entities relating to a critical infrastructure asset to provide information in relation to the asset, and to notify if certain events occur in relation to the asset;
(c) allowing the Minister to require certain entities relating to a critical infrastructure asset to do, or refrain from doing, an act or thing if the Minister is satisfied that there is a risk of an act or omission that would be prejudicial to security;
(d) allowing the Secretary to require certain entities relating to a critical infrastructure asset to provide certain information or documents;
(e) allowing the Secretary to undertake an assessment of a critical infrastructure asset to determine if there is a risk to national security relating to the asset.
Certain information obtained under, or relating to the operation of, this Act is protected information. There are restrictions on when a person may make a record of, use or disclose protected information.
Civil penalty provisions of this Act may be enforced using civil penalty orders or injunctions, and enforceable undertakings may be accepted in relation to compliance with civil penalty provisions. The Regulatory Powers Act is applied for these purposes. Certain other provisions of this Act may be enforced by imposing a criminal penalty.
The Minister may privately declare a particular asset to be a critical infrastructure asset so that this Act applies to it. A private declaration can only be made if there would be a risk to national security if it were publicly known that the asset is critical infrastructure that affects national security .
The Secretary must give the Minister reports, for presentation to the Parliament, on the operation of this Act.