Security of critical infrastructure Schedule 1 General amendments Part 1 (i) make a written record of the report in the approved form; (ii) give a copy of the written record of the report to the relevant Commonwealth body (see section 30BF); and (b) do so within 84 hours after the report is given. Civil penalty: 50 penalty units. (4) If the report is given in writing, the entity must ensure that the report is in the approved form. Civil penalty: 50 penalty units. Exemption—written record (5) The head (however described) of the relevant Commonwealth body (see section 30BF) may, by written notice given to an entity, exempt the entity from subsection (3) in relation to a report about a specified cyber security incident. Note: For specification by class, see subsection 13(3) of the Legislation Act 2003. (6) A notice under subsection (5) is not a legislative instrument. (7) The head (however described) of the relevant Commonwealth body (see section 30BF) may, by writing, delegate any or all of the head’s powers under subsection (5) to a person who: (a) is an SES employee, or acting SES employee, in the relevant Commonwealth body; or (b) holds, or is acting in, a position in the relevant Commonwealth body that is equivalent to, or higher than, a position occupied by an SES employee. Note: The expressions SES employee and acting SES employee are defined in section 2B of the Acts Interpretation Act 1901. (8) In exercising powers under a delegation, the delegate must comply with any directions of the head (however described) of the relevant Commonwealth body. 30BD Notification of other cyber security incidents (1) If: No. 124, 2021 Security Legislation Amendment (Critical Infrastructure) Act 2021 Authorised Version C2021A00124 57