How does the Australia Cyber Security Act overlap with the Security of Critical Infrastructure Act?
The Cyber Security Act does not supersede the Security of Critical Infrastructure Act 2018 (SOCI Act). It imports SOCI concepts for a critical infrastructure asset and a responsible entity, and its ransomware payment reporting regime expressly covers a responsible entity for a critical infrastructure asset to which SOCI Act Part 2B applies.
That means a ransomware payment incident can need a Cyber Security Act ransomware payment report while the same incident is also assessed against SOCI Act cyber security incident notification duties. The overlap question starts with asset status and entity role, not with whether the affected system is a consumer smart device.
- Confirm whether the affected system is a critical infrastructure asset under SOCI Act materials.
- Identify whether the organisation is the responsible entity for that asset.
- If a ransomware payment was made by, or on behalf of, that entity, assess the Cyber Security Act ransomware report obligation alongside SOCI Part 2B incident notification.
Defines critical infrastructure asset and responsible entity by reference to the SOCI Act and sets when responsible entities for Part 2B assets are reporting business entities.
Primary SOCI source for the critical infrastructure asset, responsible entity, and Part 2B cyber security incident notification concepts referenced by the Cyber Security Act.
Application Rules source for checking whether SOCI Act Part 2 or Part 2B applies before treating the organisation as in the critical-infrastructure overlap path.