Critical infrastructure operators must now report significant cyber breaches to the federal government within 12 hours of an attack, following the expiry of a three-month grace period that enabled nearly 2500 of them to prepare for the new rules.
The mandatory reporting will enable the Cyber and Infrastructure Security Centre and the ACSC to develop an overall threat picture and to respond to serious cyber incidents. A significant impact is where the availability of essential goods or services has been disrupted. Examples include where electricity, gas or liquid fuels cannot be provided, or where, say, the chemical values in a water treatment plant have been changed, or when ATMs are taken offline.Less serious cybersecurity incidents must be reported within 72 hours. If a verbal report is made through the ACSC hotline 1300Cyber1, it must be followed by a written report within 84 hours.
“The Department of Home Affairs has engaged with over 750 entities identified as responsible entities for critical infrastructure assets that will be required to report cyber incidents that meet the threshold under the SOCI Act,” a Home Affairs spokeswoman said. The new reporting rules were developed as part of hardening the defence of critical infrastructure amid growing concerns about its vulnerability to cyberattacks, especially from countries such as North Korea, China and Russia.