The Department of Home Affairs has released an initial draft of the Critical Infrastructure Asset Definition Rules (the draft Rules) for public consultation.  The draft Rules provide further insight into the proposed assessment process for determining whether an asset is to be considered a “critical asset” under the to-be-amended Security of Critical Infrastructure Act 2018 (Cth(the SOCI Act), including rules tailored to capture specific assets.

The draft rules are in addition to the “critical asset” definitions to be introduced by the Security Legislation Amendment (Critical Infrastructure) Bill 2020 (Cth) (the Critical Infrastructure Bill) anticipated to be introduced to Parliament in mid-2021.

Our previous alerts on the purpose of the reforms and the content of the Critical Infrastructure Bill are available here and here.

The Department of Home Affairs is accepting public submissions on the draft Critical Infrastructure Asset Definition Rules until 4.00 AEST on Friday, 14 May 2021. 

Sector assessment – additional rules for “critical asset” classifications

The draft Rules provide further clarity on the definition of “critical asset” for 12 of the 22 asset classes identified in the Critical Infrastructure Bill.  These rules are proposed to complement the sector-specific definitions in the Critical Infrastructure Bill by specifying assets that will be “critical assets” (including in some cases assets that would not otherwise be captured by the definition in the Critical Infrastructure Bill) or prescribing the requirements to be met by an asset to make it a “critical asset”.  

The remaining 10 classes are proposed to require no further rules.  This means that whether assets within those sectors are “critical assets” for the purposes of the amended SOCI Act is to be determined by reference to the asset definitions to be introduced by the Critical Infrastructure Bill.  These classes are outlined below for completeness.

Classes with proposed rules

Specific asset rules

Many of the qualifiers proposed in the draft Rules are asset-specific and are proposed with the intention of ensuring a particular asset is considered a “critical asset”.  These assets are addressed by name in commentary contained the draft Rules and fall within the following classes:

  • Critical broadcasting assets – assets owned by TXAustralia.
  • Critical domain name systems – the .au country code Top Level Domain (ccTLD) as a whole (distinguishable from an individual .au site).
  • Critical liquid fuel assets – the Geelong and Lytton refineries, and a collection of liquid fuel pipelines across Australia (see Page 11 of the draft Rules for the full list).
  • Critical financial market infrastructure assets – the Mastercard, Visa and EFTPOS systems, and the New Payments Platform.
  • Critical food and grocery assets – the Woolworths Group, Coles Group, Aldi, Costco and Metcash Group.
  • Critical education assets – the Australian National University.
  • Critical freight infrastructure – 49 intermodal terminals (see Appendix B of the draft Rules for the full list).

Broader asset rules

The remaining qualifiers proposed in the draft Rules are broader qualifiers intended to expand the scope of assets considered “critical assets” by introducing additional criteria.  The effect of these rules is that assets, which are not “critical assets” under the definitions in Critical Infrastructure Bill, will be considered “critical assets” for the purposes of any obligations in the amended SOCI Act.

Additional defined terms

The draft Rules also propose to introduce a limited set of definitions for terms undefined in the Critical Infrastructure Bill to provide further clarity to the proposed “critical asset” definitions.  In the current draft Rules, this is limited to defining “derivative trade repositories” as assets which:

  • hold an Australia derivative trade repository licence; and
  • where the derivative trade repository has at least $20 trillion average daily notional value of outstanding transactions for all asset classes for at least two consecutive quarters.

Classes with no further rules

The draft Rules consider that the 10 remaining critical infrastructure asset classes are fully defined in the Critical Infrastructure Bill and therefore require no further rules.  These classes include;

  • critical telecommunications assets;
  • critical data storage and processing assets;
  • critical water assets;
  • critical energy market operator assets;
  • critical hospital assets;
  • critical education assets;
  • critical port assets;
  • critical public transport assets;
  • critical aviation assets; and
  • critical defence industry assets.

Next Steps

The submissions received by the Department will inform the final draft Rules submitted to the Minister for Home Affairs, who holds the final discretion for determining the application of the critical infrastructure obligations across the impacted sectors.  Changes to the draft Rules could result in changes in draft thresholds, the inclusion of other specific assets that are not captured under the draft Rules or Critical Infrastructure Bill and the inclusion of additional rules for any of the 22 classes of assets.

The Department of Home Affairs is accepting public submissions on the draft Critical Infrastructure Asset Definition Rules until 4.00 AEST on Friday, 14 May 2021. Further information about the consultation process for Critical Infrastructure Asset Definition Rules is available here