How the Government will take action The Australian Government will continue to work closely with industry to defend our critical infrastructure and Systems of National Significance. We will protect these systems with multilayered defences to shield against the most sophisticated cyber attacks. Under this initiative, the Government will: 1. Enhance cyber security obligations for Systems of National Significance To protect our Systems of National Significance, the Government will expedite implementation of the Systems of National Significance framework. The framework will include Enhanced Cyber Security Obligations for these most vital systems, requiring them to have enhanced measures in place to ensure they bounce back quickly from a cyber attack. The Government will also scale up ASD’s Critical Infrastructure Uplift program, under which ASD’s cyber experts partner with critical infrastructure providers to harden their networks. 2. Ensure critical infrastructure is compliant with cyber security obligations The Government will ensure regulated entities are appropriately informed of their obligations under the SOCI Act – including the obligation to develop, maintain and comply with a critical infrastructure risk management program – by finalising a compliance monitoring and evaluation framework. As part of this framework, the Government will consult with industry on developing enhanced review and remedy powers, including the power to direct entities to uplift risk management plans if they are seriously deficient. 3. Help critical infrastructure manage the consequences of cyber incidents The Government will consult with industry on how it can help entities better manage the consequences of cyber incidents. This includes the proposal to introduce a last resort all-hazards consequence management power to help industry deal with secondary consequences stemming from significant incidents, where no other Commonwealth, state or territory legislative levers are available to provide an effective response. Under this proposed power, Government would be able to authorise specific actions to manage consequences of a nationally significant incident, including cyber attacks or other hazards. Such powers reflect calls from critical infrastructure for enhanced government support when managing the ongoing impacts of an incident. 15 Uplift cyber security of the Commonwealth Government The problem we face The Australian Government needs to hold itself to the same standard it imposes on industry. Government is an owner and operator of critical infrastructure, and it also holds some of the most sensitive data about our people, economy and national security. As part of their core functions, Commonwealth, state, territory and local governments all provide essential services to our society. They form a critical part of our nation’s digital infrastructure. 42 2023–2030 Australian Cyber Security Strategy