Cybersecurity (Amendment) Bill

The Cybersecurity (Amendment) Bill amends the Cybersecurity Act 2018 with the following key updates:

• It redefines "critical information infrastructure" to "provider-owned critical information infrastructure" and introduces new categories including "third-party-owned critical information infrastructure," "systems of temporary cybersecurity concern," "entities of special cybersecurity interest," and "major foundational digital infrastructure service providers."
• The bill grants the Commissioner of Cybersecurity enhanced powers, allowing for civil penalties for non-compliance and regulating the cybersecurity obligations of these new categories.
• It specifies obligations regarding audits, risk assessments, and incident reporting for different types of designated infrastructures and service providers.
• New sections establish codes of practice, procedures for appeals, and mechanisms for monitoring compliance, including the ability to impose fines for breaches.
• It incorporates provisions to include virtual computers and systems in the regulatory framework and enables the Commissioner to designate and manage new classes of cybersecurity infrastructures effectively.