Regulation 6

Prescribed cybersecurity incidents for purposes of section 16I(4) of Act

of Cybersecurity (Providers of Essential Service Responsible for Cybersecurity of Third‑Party‑Owned Critical Information Infrastructure) Regulations 2026

Subsidiary LegislationIn forceProvision 6 of 8

For the purposes of section 16I(4)(a), (b) and (c) of the Act, the following incidents are prescribed cybersecurity incidents in respect of a relevant computer or computer system:

(a)

any unauthorised hacking of the relevant computer or computer system to gain unauthorised access to or control of the relevant computer or computer system;

(b)

any installation or execution of unauthorised software, or computer code, of a malicious nature on the relevant computer or computer system;

(c)

any man‑in‑the‑middle attack, session hijack or other unauthorised interception by means of a computer or computer system of communication between the relevant computer or computer system, and an authorised user of the relevant computer or computer system;

(d)

any denial of service attack or other unauthorised act or acts carried out through a computer or computer system that adversely affects the availability or operability of the relevant computer or computer system.

Read in full context — Cybersecurity (Providers of Essential Service Responsible for Cybersecurity of Third‑Party‑Owned Critical Information Infrastructure) Regulations 2026 →