Register as a responsible entity / direct interest holder under SOCI
Captured critical-infrastructure assets must be registered with Home Affairs.
Who must comply
The responsible entity for a critical infrastructure asset (defined for each asset class in s 12L), and direct interest holders: an entity, alone or with associates, holding a direct or joint interest of at least 10% in the asset, or an interest that puts it in a position to directly or indirectly influence or control the asset. Executors, liquidators and administrators must report for an entity that dies or fails; an agent may lodge on an entity's behalf.
What triggers it
Becoming a reporting entity for an asset to which Part 2 applies, or a notifiable event: a change that makes the operational or interest and control information held on the Register incorrect or incomplete.
When due
Initial information by the later of the end of the asset's grace period and 30 days after becoming a reporting entity (s 23). Notifiable events within 30 days after the event (s 24).
Evidence required
Asset-class assessment against the CISC definition guidance; lodged operational information or interest and control information in the approved form and its acknowledgement; ownership and control register mapping 10% interests and associates; change-management trigger so notifiable events reach the register within 30 days; records of best endeavours where information could not be obtained (s 25).
Max penalty
Each of s 23 and s 24 is a civil penalty provision of 50 penalty units ($18,200). Under Regulatory Powers (Standard Provisions) Act 2014 s 82(5) a court can order a body corporate to pay up to 5 times that amount, $91,000. Civil penalty provisions of the SOCI Act can also be enforced by infringement notices, enforceable undertakings and injunctions
Who must comply with this? The applicability test by industry, business structure and size.
Summary
Part 2 of the Security of Critical Infrastructure Act 2018 (Cth) requires the Secretary of Home Affairs to keep a Register of Critical Infrastructure Assets, which is not made public. For each asset to which Part 2 applies (assets specified in the rules or declared by the Minister), the responsible entity must give operational information about the asset, and each direct interest holder must give interest and control information about itself and the asset. After the first lodgement, the reporting entity must notify any event that makes the registered information incorrect or incomplete, or that makes a new entity a reporting entity. The Cyber and Infrastructure Security Centre (CISC) administers the register as the first of the Act's positive security obligations, alongside cyber incident reporting and a risk management program.
Enforced by
Source legislation
Topics
Related
- CWLTHApply for a Director Identification Number (Director ID)Every director needs a Director ID before appointment — apply via ABRS.
- CWLTHMaintain Financial Adviser registration + standards (s 921B)Relevant providers must be on the Financial Advisers Register and meet education + CPD + Code of Ethics.
- CWLTHComply with SOCI Positive Security Obligation (PSO) per sectorSector-specific cyber + risk obligations under SOCI Part 2.
- CWLTHReport cyber security incidents to ASD (SOCI)Critical infrastructure asset operators must report critical incidents within 12 hours and other incidents within 72 hours.
- CWLTHMaintain AHPRA registration and CPDRegistered health practitioners must hold current registration and meet annual CPD per their National Board standards.
- CWLTHAustralian Business Number (ABN) applicationEntities carrying on an enterprise in Australia need an ABN — without one, payers must withhold 47% PAYG from your payments. How to apply and who's eligible.
Frequently asked questions
- Who must comply with a responsible entity / direct interest holder under SOCI?
- The responsible entity for a critical infrastructure asset (defined for each asset class in s 12L), and direct interest holders: an entity, alone or with associates, holding a direct or joint interest of at least 10% in the asset, or an interest that puts it in a position to directly or indirectly influence or control the asset. Executors, liquidators and administrators must report for an entity that dies or fails; an agent may lodge on an entity's behalf.
- What triggers a responsible entity / direct interest holder under SOCI?
- Becoming a reporting entity for an asset to which Part 2 applies, or a notifiable event: a change that makes the operational or interest and control information held on the Register incorrect or incomplete.
- When is a responsible entity / direct interest holder under SOCI due?
- Initial information by the later of the end of the asset's grace period and 30 days after becoming a reporting entity (s 23). Notifiable events within 30 days after the event (s 24).
- What is the maximum penalty for a responsible entity / direct interest holder under SOCI?
- Each of s 23 and s 24 is a civil penalty provision of 50 penalty units ($18,200). Under Regulatory Powers (Standard Provisions) Act 2014 s 82(5) a court can order a body corporate to pay up to 5 times that amount, $91,000. Civil penalty provisions of the SOCI Act can also be enforced by infringement notices, enforceable undertakings and injunctions
- What evidence is required for a responsible entity / direct interest holder under SOCI?
- Asset-class assessment against the CISC definition guidance; lodged operational information or interest and control information in the approved form and its acknowledgement; ownership and control register mapping 10% interests and associates; change-management trigger so notifiable events reach the register within 30 days; records of best endeavours where information could not be obtained (s 25).
Source: https://www.cisc.gov.au/how-we-support-industry/regulatory-obligations. Rules Mate is not a law firm. Always verify against the live regulator source before acting.