Cybersecurity Act 2018 · 2020 Revised Edition · Part 3A · Providers of Essential Service Responsible for Cybersecurity of Third‑Party‑Owned Critical Information Infrastructure
16I. Duty to report cybersecurity incident in respect of third‑party‑owned critical information infrastructure, etc.
Feedback & supportLast amended by an amending law of 2024.
A designated provider responsible for third‑party‑owned critical information infrastructure must obtain a legally binding commitment from the owner of the third‑party‑owned critical information infrastructure for which the provider is responsible for its cybersecurity, that the owner of the third-party-owned critical information infrastructure will notify the provider of the occurrence of any of the following within the prescribed period after becoming aware of such occurrence:
third‑party‑owned critical information infrastructure
“third‑party‑owned critical information infrastructure” means the computer or computer system in relation to which a designation of a designated provider responsible for third‑party‑owned critical information infrastructure under section 16A(1) is in effect;
a prescribed cybersecurity incident in respect of the third‑party‑owned critical information infrastructure;
a prescribed cybersecurity incident in respect of any computer or computer system under the owner’s control that is interconnected with or that communicates with the third‑party‑owned critical information infrastructure;
any other type of cybersecurity incident in respect of the third‑party‑owned critical information infrastructure that the Commissioner has specified by written direction to the designated provider responsible for third-party-owned critical information infrastructure.
Where subsection (1) is not complied with, the Commissioner may order the designated provider responsible for third‑party‑owned critical information infrastructure to cease using, directly or indirectly, the third-party-owned critical information infrastructure for which the provider is responsible for its cybersecurity.
Commissioner
“Commissioner” means the Commissioner of Cybersecurity appointed under section 4(1)(a);
Any designated provider responsible for third‑party‑owned critical information infrastructure who, without reasonable excuse, fails to comply with an order issued under subsection (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000 or to imprisonment for a term not exceeding 2 years or to both and, in the case of a continuing offence, to a further fine not exceeding $5,000 for every day or part of a day during which the offence continues after conviction.
The designated provider responsible for third‑party‑owned critical information infrastructure must notify the Commissioner of the occurrence of any of the following in the prescribed form and manner, within the prescribed period after becoming aware of such occurrence:
a prescribed cybersecurity incident in respect of the third‑party‑owned critical information infrastructure;
a prescribed cybersecurity incident in respect of any computer or computer system under the owner’s control or the provider’s control, that is interconnected with or that communicates with the third-party-owned critical information infrastructure;
a prescribed cybersecurity incident in respect of any other computer or computer system under the provider’s control that does not fall within paragraph (b);
any other type of cybersecurity incident in respect of the third-party-owned critical information infrastructure that the Commissioner has specified by written direction to the designated provider responsible for third-party-owned critical information infrastructure.
The designated provider responsible for third-party-owned critical information infrastructure must establish such mechanisms and processes for the purposes of becoming aware of any cybersecurity threats and incidents in respect of the third-party-owned critical information infrastructure, as set out in any applicable code of practice.
cybersecurity
“cybersecurity” means the state in which a computer or computer system is protected from unauthorised access or attack, and because of that state —(a)the computer or computer system continues to be available and operational;(b)the integrity of the computer or computer system is maintained; and(c)the integrity and confidentiality of information stored in, processed by or transmitted through the computer or computer system is maintained;
Any designated provider responsible for third-party-owned critical information infrastructure who, without reasonable excuse, fails to comply with subsection (4) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000 or to imprisonment for a term not exceeding 2 years or to both.