Cybersecurity Act 2018 · 2020 Revised Edition · Part 3A · Providers of Essential Service Responsible for Cybersecurity of Third‑Party‑Owned Critical Information Infrastructure
16L. Cybersecurity exercises
Feedback & supportLast amended by an amending law of 2024.
The Commissioner may conduct cybersecurity exercises for the purpose of testing the state of readiness of different designated providers responsible for third‑party‑owned critical information infrastructure in responding to significant cybersecurity incidents.
Commissioner
“Commissioner” means the Commissioner of Cybersecurity appointed under section 4(1)(a);
A designated provider responsible for third‑party‑owned critical information infrastructure must participate in a cybersecurity exercise if directed in writing to do so by the Commissioner.
third‑party‑owned critical information infrastructure
“third‑party‑owned critical information infrastructure” means the computer or computer system in relation to which a designation of a designated provider responsible for third‑party‑owned critical information infrastructure under section 16A(1) is in effect;
Any person who, without reasonable excuse, fails to comply with a direction under subsection (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $100,000.