# Contents #### Part 1—Preliminary - 1 Short title - 2 Commencement - 3 Objects - 4 Simplified outline of this Act - 5 Extraterritoriality - 6 Act binds the Crown - 7 Concurrent operation of State and Territory laws - 8 Definitions - 9 Meaning of *cyber security incident* - 10 Meaning of *permitted cyber security purpose* - 11 Disclosure to State body #### Part 2—Security standards for smart devices ##### Division 1—Preliminary - 12 Simplified outline of this Part - 13 Application of this Part ##### Division 2—Security standards for relevant connectable products - 14 Security standards for relevant connectable products - 15 Compliance with security standard for a relevant connectable product - 16 Obligation to provide and supply products with a statement of compliance with security standard ##### Division 3—Enforcement - 17 Compliance notice - 18 Stop notice - 19 Recall notice - 20 Public notification of failure to comply with recall notice ##### Division 4—Miscellaneous - 21 Revocation and variation of notices given under this Part - 22 Internal review of decision to give compliance, stop or recall notice - 23 Examination to assess compliance with security standard and statement of compliance - 24 Acquisition of property #### Part 3—Ransomware reporting obligations ##### Division 1—Preliminary - 25 Simplified outline of this Part ##### Division 2—Reporting obligations - 26 Application of this Part - 27 Obligation to report following a ransomware payment - 28 Liability ##### Division 3—Protection of information - 29 Ransomware payment reports may only be used or disclosed for permitted purposes - 30 Limitations on secondary use and disclosure of information in ransomware payment reports - 31 Legal professional privilege - 32 Admissibility of information in ransomware payment report against reporting business entity #### Part 4—Coordination of significant cyber security incidents ##### Division 1—Preliminary - 33 Simplified outline of this Part - 34 Meaning of *significant cyber security incident* ##### Division 2—Voluntary information sharing with the National Cyber Security Coordinator - 35 Impacted entity may voluntarily provide information to National Cyber Security Coordinator in relation to a significant cyber security incident - 36 Voluntary provision of information in relation to other incidents or cyber security incidents - 37 Role of the National Cyber Security Coordinator ##### Division 3—Protection of information - 38 Information provided in relation to a significant cyber security incident—use and disclosure by National Cyber Security Coordinator - 39 Information provided in relation to other incidents—use and disclosure by National Cyber Security Coordinator - 40 Limitations on secondary use and disclosure - 41 Legal professional privilege - 42 Admissibility of information voluntarily given by impacted entity - 43 National Cyber Security Coordinator not compellable as witness ##### Division 4—Miscellaneous - 44 Interaction with other requirements to provide information in relation to a cyber security incident #### Part 5—Cyber Incident Review Board ##### Division 1—Preliminary - 45 Simplified outline of this Part ##### Division 2—Reviews - 46 Board must cause reviews to be conducted - 47 Board may discontinue a review - 48 Chair may request information or documents - 49 Chair may require certain entities to produce documents - 50 Civil penalty—failing to comply with a notice to produce documents - 51 Draft review reports - 52 Final review reports - 53 Certain information must be redacted from final review reports - 54 Protected review reports ##### Division 3—Protection of information relating to reviews - 55 Limitations on use and disclosure by the Board - 56 Limitations on secondary use and disclosure - 57 Legal professional privilege - 58 Admissibility of information given by an entity that has been requested or required by the Board - 59 Disclosure of draft review reports prohibited ##### Division 4—Establishment, functions and powers of the Board - 60 Cyber Incident Review Board - 61 Constitution of the Board - 62 Functions of the Board - 63 Independence ##### Division 5—Terms and conditions of appointment of the Chair and members of the Board - 64 Appointment of Chair - 65 Remuneration of the Chair - 66 Appointment of standing members of the Board - 67 Remuneration of standing members of the Board - 68 Acting Chair - 69 Terms and conditions etc. for standing members ##### Division 6—Expert Panel, staff assisting and consultants - 70 Expert Panel - 71 Arrangements relating to staff of the Department - 72 Consultants ##### Division 7—Other matters relating to the Board - 73 Board procedures - 74 Liability - 75 Certification of involvement in review - 76 Annual report - 77 Rules may prescribe reporting requirements etc. #### Part 6—Regulatory powers ##### Division 1—Preliminary - 78 Simplified outline of this Part ##### Division 2—Civil penalty provisions, enforceable undertakings and injunctions - 79 Civil penalty provisions, enforceable undertakings and injunctions ##### Division 3—Monitoring and investigation powers - 80 Monitoring powers - 81 Investigation powers ##### Division 4—Infringement notices - 82 Infringement notices ##### Division 5—Other matters - 83 Contravening a civil penalty provision #### Part 7—Miscellaneous - 84 Simplified outline of this Part - 85 How this Act applies in relation to non‑legal persons - 86 Delegation by Secretary - 87 Rules - 88 Review of this Act