Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023 (Cth)

LIN 23/006 Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023 I, Clare O'Neil, Minister for Home Affairs, make this instrument under section 61 of the Security of Critical Infrastructure Act 2018 (the Act). Dated 31 January 2023 Clare O'Neil Minister for Home Affairs

Part 1 Preliminary

1 Name This instrument is the Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023.

2 Commencement This instrument commences on the later of: (a) immediately after the AusCheck Legislation Amendment (Critical Infrastructure Background Check) Regulations 2023 commence; and (b) the day after registration.

3 Definitions Note A number of phrases used in this instrument are defined in the Act, including: (a) critical component; (b) critical infrastructure asset; (c) critical hospital; (d) critical worker; (d) relevant impact; (e) responsible entity; (f) security. In this instrument: AusCheck Act means the AusCheck Act 2007. AusCheck Regulations means the AusCheck Regulations 2017. background check means a background check under the AusCheck Act. CI asset means a critical infrastructure asset. CIRMP is short for critical infrastructure risk management program. CIRMP criminal record has the same meaning as defined in the AusCheck Regulations. criminal history criteria means the assessment of: (a) whether the person has a CIRMP criminal record; and (b) the nature of the offence. cyber and information security hazard includes where a person, whether authorised or not: (a) improperly accesses or misuses information or computer systems about or related to the CI asset; or (b) uses a computer system to obtain unauthorised control of, or access to the CI asset that might impair its proper functioning. designated hospital means a critical hospital mentioned in Schedule 1. major supplier means any vendor that by nature of the product or service they offer, has a significant influence over the security of a responsible entity's CI asset. natural hazard includes fire, flood, cyclone, storm, heatwave, earthquake, tsunami, space weather or biological health hazard (such as a pandemic). personnel hazard includes where a critical worker acts, through malice or negligence: (a) to compromise the proper function of the asset; or (b) to cause significant damage to the asset. physical security hazard includes the unauthorised access to, interference with, or control of CI assets, to compromise the proper function of the asset or cause significant damage to the asset. Secretary has the same meaning as defined in the AusCheck Act. supply chain hazard includes malicious people both internal and external exploiting, misusing, accessing or disrupting the supply chain and over-reliance on particular suppliers.