Cyber Security (Cyber Incident Review Board) Rules 2025

Administered by Department of Home Affairs

Legislation au F2025L00277 In force Legislative Instrument

Legislation content

EXPLANATORY STATEMENT

Issued by authority of the Minister of Home Affairs

Cyber Security Act 2024

Cyber Security (Cyber Incident Review Board) Rules 2025

Legislative Authority

The Cyber Security (Cyber Incident Review Board) Rules 2025 (the Rules) are made under sections 46, 66, 69, 70 and 73 of the Cyber Security Act 2024 (the Act). 

Purpose and background

Part 5 of the Act establishes the Cyber Incident Review Board (CIRB) as an independent, advisory body with a remit to conduct no-fault, post-incident reviews of significant cyber security incidents in Australia. Following its reviews, the CIRB will disseminate recommendations to both Government and industry to strengthen Australia’s collective cyber resilience.

The CIRB is comprised of three parts: a Chair and standing members, which together form the core component of the CIRB, and an Expert Panel who form a pool of industry experts that can be called upon for individual reviews. Each review will be conducted by the Chair, the standing members and at least two members of the Expert Panel, who will be allocated based on expertise and experience most relevant to the review. Each review will be conducted in accordance with its own specific Terms of Reference, which is approved by the Minister.

The Act provides that a number of the machinery aspects of the functioning of the CIRB are to be determined by Rules made by the Minister.  Part 2, Division 2 of these Rules prescribe requirements relating to how and what needs to be considered after a written referral to conduct a review is made to the CIRB. Broadly, Division 2 determines:

  • the process the CIRB must take when a referral is made, and what the CIRB must consider when prioritising referrals to the CIRB;
  • what the terms of reference for a review undertaken by the CIRB must specify; and
  • the timing and notification of reviews.

Part 2, Divisions 3 and 4 of the Rules respectively prescribe requirements relating to the appointment of standing members, including the Chair, and Expert Panel members. Broadly, Divisions 3 and 4 specify respective requirements for standing members and Expert Panel members relating to:

  • eligibility for appointment;
  • disclosure of interests, resignation and termination; and
  • other terms of appointment, including remuneration for the Expert Panel members.

Part 2, Division 5 of the Rules specifies other requirements that govern how the CIRB operates and other procedures relating to the CIRB. For this purpose, Division 5 of the Rules prescribes requirements relating to how CIRB meetings are to be convened and conducted, including the decision-making and voting process.

The whole of the Rules commence the later of the start of the day after the Rules are registered or at the same time as Part 5 of the Act commences.

Consultation

The Rules are made by the Minister for Cyber Security in accordance with the requirements of subsection 87(3) of the Act. This subsection specifies, the Minister, before making or amending Rules under the Act, must publish a notice that:

  • sets out the draft rules or amendments, and
  • invites persons to make submissions to the Minister about the draft rules within a period not shorter than 28 days.

The Minister must also consider any submissions received during the period specified in the notice. 

In accordance with these requirements, the draft Rules were published on the Department’s website on 16 December 2024 and closed for submissions on 14 February 2025, with 37 submissions received. The majority of submissions were broadly supportive of the proposed Rules, with several stakeholders requesting the Department publish further guidance material on the functions and governance arrangements for the CIRB.

The Department consulted broadly across the Australian economy, including peak bodies, businesses and across the public sector. The Department hosted 7 deep dive sessions in January and February 2025 for all of the rules, with over 900 attendees cumulatively across the sessions, and an average of 130 attendees per session. The Cyber Incident Review Board deep dive sessions saw over 180 attendees across two sessions.

In these circumstances, the Minister was satisfied that appropriate consultation was undertaken, in accordance with section 17 of the Legislation Act 2003 because:

  • persons likely to be affected by the Rules had an adequate opportunity to comment on the draft Rules for a period of at least 28 days, with significant consultation across the economy; and
  • throughout the consultation process, affected persons did not raise any significant concerns regarding the Rules. 

An impact analysis statement was not required by the Office of Impact Analysis.

Other matters

The Rules are a legislative instrument for the purposes of the Legislation Act 2003 and is subject to disallowance.

Details of the Rules are set out in Attachment A. 

A Statement of Compatibility with Human Rights provides that the Rules are compatible with human rights because it promotes the protection of human rights, and to the extent that it may limit human rights, those limitations are reasonable, necessary and proportionate to pursue the legitimate objective of national security and public order. The Statement is included at Attachment B.


 

ATTACHMENT A

Details of the Cyber Security (Cyber Incident Review Board) Rules 2025

Part 1 – Preliminary

Section 1 Name

This section provides that the name of the instrument is the Cyber Security (Cyber Incident Review Board) Rules 2025 (the Rules). 

Section 2 Commencement

Section 2 provides for the commencement of the Rules.

Subsection 2(1) provides that each provision of Rules specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table.  

The effect of column 2 is that the whole of the Rules will commence on the later of the start of: 

•        the day after the Rules are registered; or 

•        at the same time as Part 5 of the Cyber Security Act 2024 (the Act) commences. 

Part 5 of the Act will commence on a single day to be fixed by Proclamation, or will otherwise commence automatically 6 months after the day the Act received Royal Assent; this means that Part 5 would commence on 29 May 2025 if not proclaimed earlier.

The note at the foot of the table explains that the table relates only to the provisions of the Rules as originally enacted. The table will not be amended to deal with any later amendments of the Rules. 

Subsection 2(2) provides that any information in column 3 of the table is not part of the Rules Information may be inserted in this column, or information in it may be edited, in any published version of the Rules. 

Section 3 Authority

This section provides that the Rules are made under the Act.  

Section 4 Definitions

Section 4 sets out the definition of terms used in the Rules.

The note in this section provides that a number of expressions used in the Rules are defined in the Act, including Chair, Cyber Incident Review Board (CIRB), cyber security incident and Expert Panel.

Act is defined to mean the Cyber Security Act 2024.

Australian Government security clearance is defined to have the same meaning of the Criminal Code. At the time of making the Rules, section 4 of the Criminal Code defines Australian Government security clearance to mean a security clearance given by the Australian Government Security Vetting Agency or by another Commonwealth, State or Territory agency that is authorised or approved by the Commonwealth to issue security clearances.

Board Member means any member of the CIRB and includes the Chair.

Paid work means work for financial gain or reward (whether as an employee, a self-employed person or otherwise).

Security classification has the same meaning as in the Criminal Code. At the time of making the Rules, section 90.5 of the Criminal Code, defines this to mean a classification of secret or top secret that is applied in accordance with the policy framework developed by the Commonwealth for the purpose (or for purposes that include the purpose) of identifying information for a classification of secret that, if disclosed in an unauthorised manner, could be expected to cause serious damage to the national interest, organisations or individuals; or for a classification of top secret that, if disclosed in an unauthorised manner, could be expected to cause exceptionally grave damage to the national interest; or any equivalent classification or marking prescribed by the regulations.

Part 2 – Cyber Incident Review Board

Division 1 – Preliminary

Section 5 Simplified outline of this Part

Section 5 provides a simplified outline for the operation of Part 2 of the Rules. 

The simplified outline provides guidance to the reader that Part 5 of the Act establishes the CIRB. The function of the CIRB is to conduct reviews in relation to certain cyber security incidents and to make recommendations to government and industry about actions that could be taken to prevent, detect, respond to or minimise the impact of cyber security incidents of a similar nature in the future.

The simplified outline further provides guidance that a review panel will be established for each review in accordance with the terms of reference for the review. The review panel will consist of the Chair, the other standing members of the CIRB that are specified in the terms of reference for the review, and the members of the Expert Panel appointed to assist in relation to the review.

The simplified outline provides guidance to the reader that Part 2 of the Rules provides for procedures for reviews, appointments of Board members and Expert Panel members, and the procedures of the CIRB.

Simplified outlines are included to assist readers to understand the substantive provisions. Simplified outlines are not intended to be comprehensive, and readers should rely on the substantive provisions.

Division 2 – Reviews by the Board

Section 6 Purpose of this Division

Section 6 provides that Division 2 of Part 2 of the Rules are made under subsection 46(5) of the Act. This subsection empowers rules to be made for the provision or in relation to reviews under Part 5 of the Act. Subsection 46(5) provides rules may be made in relation to a number of related matters, included the terms of reference for reviews, the timing of when reviews may be conducted and how information or submissions may be provided for reviews.

Section 7 Requirements to consider referrals

Section 7 of the Rules prescribes the requirement that the CIRB consider written referrals for reviews that are made under subsection 46(1) of the Act. Subsection 46(1) permits the CIRB to accept written referrals to undertake a review made by the Minister, National Cyber Security Coordinator, an impacted entity or a member of the CIRB.

For the purpose of paragraph 46(5)(a), section 7 of the Rules prescribes the actions the CIRB must take when a written referral is made under section 46 of the Act. It provides that if a written referral is made to the CIRB under subsection 46(1) of the Act, the CIRB must consider the referral and decide whether a review should be conducted under section 46 of the Act in relation to any matter raised in the referral.  

The note under this section clarifies that subsection 46(2) of the Act sets out limitations on when a review may be conducted. Subsection 46(2) of the Act provides that a review may only be conducted under section 46 of the Act if the CIRB is satisfied of the matters provided for in that subsection.

Section 8 Matters Board must consider when prioritising referrals and reviews

Section 8 of the Rules prescribes matters the CIRB must have regard to when prioritising written referrals and reviews received under subsection 46(1) for the purpose of paragraph 46(5)(b) of the Act.  

Paragraph 8(a) provides that the first is the severity and scale of impact of the cyber security incidents to which those written referrals relate.

Paragraphs 8(b) and 8(c) provides that the CIRB must have regard to the availability of Board members and the availability and capacity of the Expert Panel, respectively.

Paragraph 8(d) additionally provides that the CIRB must have regard to relevance of the skills, knowledge or experience of members of the Expert Panel relating to those written referrals.  

These matters supplement the threshold in subsection 46(2) of the Act that the CIRB must be satisfied of before conducting a review, which permits the CIRB to only conduct a review under section 46 if:

  • the CIRB is satisfied that the incident or series of incidents meets the criteria mentioned in subsection 46(3); and
  • after the incident or series of incidents, and the immediate response, has ended; and
  • if the Minister has approved the terms of reference for the review.

Section 9 Terms of reference for reviews

Section 9 specifies requirements for terms of references for reviews for the purpose of paragraph 46(5)(c) of the Act. Each review conducted by the CIRB must be conducted in accordance with the terms of reference for the review, which is approved by the Minister. Section 9 contains mandatory requirements that the terms of reference must contain.

Subsection 9(1) provides that the terms of reference for a review by the CIRB must:

  • specify the number of standing members of the Board who will conduct the review (paragraph 9(1)(a));
  • specify the number of members of the Expert Panel to be appointed to assist the CIRB in relation to the review (paragraph 9(1)(b));
  • specify the minimum level of Australian Government security clearance, or equivalent security clearance recognised by the Commonwealth, required for a standing member of the CIRB to hold in order to participate in the conduct of the review (paragraph 9(1)(c)); and
  • specify any eligibility requirements, additional to those set out in paragraphs 23(b) and (c) of the Rules (paragraph 9(1)(d)). Paragraphs 23(b) and (c) of the Rules provide additional requirements the Chair must be satisfied of when appointing Expert Panel members to a review, which are in additional to eligibility requirements specified in the terms of reference.  

The note under paragraph 9(1)(d) clarifies that additional eligibility requirements in the terms of reference, may relate to particular skills, qualifications, expertise or experience in relation to the review.

Subsection 9(2) provides that the CIRB may, with the approval of the Minister, vary the terms of reference for a review.

The rationale for why these matters have been selected as mandatory inclusions for the terms of reference is to establish a baseline of information to be included for the transparent operation of the CIRB, whilst ensuring that the Board has complete discretion in the in the performance of its functions. 

Section 10 Timing of reviews – non-interference with investigations etc.

Section 10 specifies requirements relating to the timing of reviews for the purpose of paragraph 46(5)(e) of the Act.

Section 10 prohibits the CIRB from conducting a review at a time where the Chair considers it would interfere with or prejudice the investigation of, or the conduct of proceedings relating to, an offence or a contravention of a civil penalty provision under a law of the Commonwealth or of a State or Territory.

The note under section 10 directs the reader to paragraph 46(2)(b) of the Act, which provides that a review may only be conducted under section 46 after the cyber security incident or series of cyber security incidents, and the immediate response, has ended.

The purpose of section 10 is to ensure the reviews by the CIRB do not interfere, or otherwise prejudice, other regulatory responses or investigations relating to the cyber security incident.  This ensures that actions by government that seek to mitigate or lessen the harm of the cyber security incident are not hindered by an ongoing review by the CIRB.

It is the intention of section 10 that in considering whether a review would interfere with any ongoing matters that Chair would seek advice from relevant Commonwealth and State and Territory agencies who may have an interest in the matter to be reviewed prior to making a decision.

Section 11 Notification of reviews

Section 11 prescribes requirements for the notification of reviews for the purpose of paragraph 46(5)(d) of the Act.

Subsection 11(1) provides that as soon as practicable after deciding to conduct a review, the CIRB must publish, on the Department’s website or in any other way the CIRB considers appropriate, a notification that the review will be conducted.

Subsection 11(2) prescribes the mandatory content requirements for a notification of a review made under subsection 11(1). For this purpose, the notification must include the following:

  • the number of the standing members of the CIRB who will conduct the review (paragraph 11(2)(a));
  • the number of the Expert Panel members to be appointed to assist in the conduct of the review (paragraph 11(2)(b));
  • details of the cyber security incident, or series of cyber security incidents, that will be the subject of the review (paragraph 11(2)(c));
  • a brief description of how the incident or series of incidents meets the requirements in subsection 46(2) of the Act (paragraph 11(2)(d)). Subsection 46(2) provides mandatory requirements that the CIRB must be satisfied of before conducting a review;
  •  the proposed timeframes for the conduct of the review (paragraph 11(2)(e)); and
  •  other information that the CIRB considers appropriate to include in the notification (paragraph 11(2)(f)).

The purpose behind section 11 is to ensure the notification of reviews provides sufficient detail to inform government and industry about the work of the CIRB. The notification requirement also supports the CIRB’s overarching function to make recommendations to government and industry about measures to prevent or minimise future cyber security incidents by providing context of cyber incidents that are under review.

Public notification of the reviews the CIRB intend to undertake into a specific cyber incident and the identified mandatory inclusions is important for the transparent operation of the CIRB and for developing public trust in the CIRB.

The identified mandatory inclusions establish a baseline of information to be included for this purpose, whilst ensuring that the CIRB has complete discretion in the in the performance of its functions. This includes appropriate notification why the CIRB considers a particular incident to have met the appropriate thresholds to warrant the conduct of a review.

Division 3 – Board Members

Section 12 Purpose of this Division

Section 12 provides that Part 2, Division 3 of the Rules is made for the purpose of subsection 64(4), 66(4) and 69(1) of the Act.

Subsection 64(4) provides that the Rules may make provision for, or in relation, to the appointment of the Chair, including in relation to eligibility for appointment.

Subsection 66(4) provides that the Rules may make provisions for or in relation to the appointment of the standing members of the CIRB, including in relation to eligibility for appointment.

Subsection 69(1) provides that the Rules may make provision for or in relation to a number of different matters, including the membership of the Board, the terms of appointment of the Chair and standing members of the CIRB and the termination of appointment of the Chair and standing members.  

Section 13 Eligibility for appointment as a Board member

Section 13 prescribes the eligibility criteria for appointment as a standing member of the CIRB for the purpose of subsection 66(4) of the Act. Persons who meet the criteria in this section may be appointed by the Minister to the CIRB under subsections 64(1) or 66(1) of the Act as the Chair or standing members of the Board.

Paragraph 13(1)(a)(i) provides that the person must hold, or be eligible to hold, an Australian Government security clearance that allows the person access to information that has a security classification of at least secret. It is important that a person appointed to the CIRB holds or is eligible to hold a security clearance of at least secret or that they hold an equivalent security clearance. This requirement ensures that Board members are able to receive relevant briefings from Commonwealth entities, where it is appropriate for the performance of the functions of the CIRB or in the conduct of a review.

Alternatively, paragraph 13(1)(a)(ii) prescribes that a person may satisfy the security clearance requirement if they hold an equivalent security clearance recognised by the Commonwealth for the purposes of allowing the person access to information that has a security classification of at least secret. Security clearances that may be recognised by the Commonwealth as being of an equivalent level are those granted by Five Eyes countries.

Paragraph 13(1)(b) provides additional eligibility criteria for appointment to the CIRB as a Board member. In order to be eligible for appointment, a person must satisfy one or more of the matters prescribed in the subparagraphs under paragraph 13(1)(b). The matters specified are that the person:

  • has obtained a degree from a university, or an educational qualification of a similar standing, in the field of law and has significant experience working in that field (subparagraph 13)(1)(b)(i));  
  • has obtained an educational qualification in the field of cyber security or information security; (subparagraph 13(1)(b)(ii));
  • has significant experience working in the field of cyber security or information security (subparagraph 13(1)(b)(iii));
  • holds a relevant Commonwealth, State or Territory government position at an appropriately senior level (subparagraph 13(1)(b)(iv));
  • has significant experience in audit, assurance or review processes, public administration or financial or prudential regulation (subparagraph 13(1)(b)(v));
  • has significant experience in incident management or crisis response (subparagraph 13(1)(b)(vi));
  • has significant experience in a critical infrastructure sector (within the meaning of the Security of Critical Infrastructure Act 2018) (subparagraph 13(1)(b)(vii)); or
  • has significant academic qualifications or knowledge in a relevant field 13(1)(b)(viii)).

As the speed at which cyber technologies are being integrated into all facets of the Australian economy, so too does the potential for all sectors of the economy to be vulnerable to significant cyber incidents or novel attack methods. It is therefore appropriate that the eligibility criteria for appointments to the CIRB are broad enough to ensure the CIRB has of a broad mix of skills and expertise.

Subsection 13(2) provides that before appointing a person as a Board member of the CIRB, the Minister must be satisfied that the person meets the eligibility requirements mentioned in subsection 13(1) and the person has appropriate qualifications, knowledge, skills or experience to perform the role.

Subsection 13(3) provides that the Minister may appoint a person who holds a State or Territory government position only with the agreement of the State or Territory concerned.

Section 14 Acting appointments of standing members of the Board

Section 14 of the Rules prescribes the requirements and process for the Minister to appoint a person to act as a standing member of the CIRB for the purpose of paragraph 69(1)(c) of the Act.

Subsection 14(1) provides that the Minister may, by written instrument, appoint a person to act as a standing member of the CIRB if either circumstance in paragraph 14(1)(a) or paragraph 14(1)(b) occur.

The first circumstance is where there is a vacancy in the office of a standing member of the CIRB, whether or not an appointment has been previously made to the office.  The second circumstance is during any period, or all periods, a standing member is absent from duty or from Australia, or is, for any reason, unable to perform the duties of the office of a standing member of the CIRB.

The note under subsection 14(1) provides that the Minister may appoint a standing member of the CIRB to act as the Chair under section 68 of the Act. Section 68 of the Act specifies the process and procedure for this to occur.

Subsection 14(2) provides that a person must not be appointed to act as a standing member of the CIRB unless the Minister is satisfied that person satisfies the matters in section 13. Section 13 of the Rules provides eligibility criteria that standing members of the CIRB must meet, including requirements to hold a security clearance and to hold or possess particular qualifications or experience. 

The note under subsection 14(2) clarifies that the effect of subsection 14(2) is that a person cannot be appointed to act as a standing member of the CIRB if the person is not eligible to be appointed as a Board member.

Section 15 Disclosure of interests to the Minister

This section prescribes requirements around disclosure of interests that a person seeking appointment as the Chair or standing member (defined collectively as a ‘Board member’ in the Rules when referring to both the Chair and other standing members) must meet before being appointed by the Minister under sections 64 or 66 of the Act.  This section is made for the purpose of paragraph 69(1)(e) of the Act.

Subsection 15(1) provides that before being appointed by the Minister under sections 64 or 66 of the Act, as either the Chair or a standing member, the person must disclose to the Minister all interests, pecuniary or otherwise, that the person is aware of having in a matter of a kind likely to be considered by the CIRB.

Subsection 15(2) provides the ongoing disclosure requirements for persons who have been appointed as a Board member of the CIRB. Subsection 15(2) requires the Board members to disclose to the Minister any matter for the purpose of section 29 of the Public Governance, Performance and Accountability Act 2013 (PGPAA). Section 29 of the PGPAA requires an official of a Commonwealth entity to disclose details of any material personal interest that relates to the affairs of the entity they are an official of.

Subsection 15(3) provides that subsection 15(2) applies in addition to any rules made for the purposes of section 29 of the PGPAA.

Subsection 15(4) provides that for the purposes of the Act, the Rules and the PGPAA, a Board member is taken not to have complied with section 29 of the PGPPA if they do not comply with the requirements in subsection 15(2). This provision clarifies that failure to disclose in accordance with this section will also result in non-compliance under the PGPPA.

The purpose of the disclosure requirements is to avoid or mitigate potential conflicts of interest, whether real or perceived, between a Board member and the work of the CIRB. Failure to disclose conflicts of interest in circumstances where the Board member has a personal or financial interest in a matter being reviewed by the CIRB may undermine public confidence in the CIRB.  This provision also ensures that Board members are subject to the same reporting requirements as other Commonwealth officials.

Conflicts of interest are a common feature of any corporate environment and may be realised without the fault of any individual. However, when the risks associated with conflict of interest are not appropriately managed, the independence and integrity of the CIRB may be harmed. The management of risks associated with any actual, potential or perceived conflicts of interest ensures the highest levels of integrity and public trust for the CIRB.

Pecuniary interests, including actual, potential, or perceived financial gain or loss, includes but is not limited to offices held in a corporation or other entity, shares or other business interests or property. Money does not need to change hands to enliven a pecuniary interest. The interest also exists if it is direct (is held by the board member) or indirect (held by a relative or close associate).

Non-pecuniary interests may arise from personal or family relationships or from involvement in sporting, social, or cultural activities.

Section 16 Disclosure of interests to the Board

Section 16 prescribes how and when a Board member must make a disclosure of interest to the CIRB and the process that must be followed following that disclosure. This section is made for the purpose of paragraph 69(1)(e) of the Act.

Subsection 16(1) provides that a Board member who has an interest, pecuniary or otherwise, in a matter being considered, or about to be considered, by the CIRB in a review conducted under section 46 of the Act must disclose the nature of the interest to the CIRB.

Subsection 16(2) provides that the disclosure must be made as soon as possible after the relevant facts have come to the Board member’s knowledge.

Subsection 16(3) provides the requirement for recording the disclosure following the disclosure of the Board member’s interest. This subsection provides, where a disclosure has been made during a meeting of the CIRB, the disclosure must be recorded in the meeting’s minutes. This subsection further provides that if the disclosure is made in circumstances other than at a meeting of the CIRB, it must be recorded in the minutes of the next meeting of the CIRB after the disclosure is made. 

Subsection 16(4) provides requirements for the conduct of the CIRB following the disclosure by the Board member. It provides that unless the CIRB determines otherwise, the Board member who made the disclosure must not be present during any deliberation by the CIRB on the matter they have declared an interest in and must not take part in any decision of the CIRB with respect to the matter.

Subsection 16(5) provides further requirements relating to the decision to exclude a Board member who made the disclosure for the purpose of subsection 16(4). Subsection 16(5) requires the Board member who made the disclosure to not be present during any deliberation of the CIRB, and to not take part in the making of the determination. The purpose of this subsection is to ensure that the Board member who made the disclosure cannot influence the decision by the CIRB relating to their participation in discussions about the matter they have declared an interest in.

Subsection 16(6) provides that a decision under subsection 16(4) to either exclude or allow the Board member who made the disclosure to participate, must be recorded in the minutes of the meeting of the CIRB.

Similar to the disclosure requirements in section 15, the purpose of the disclosure of interests by a Board member to the CIRB, is to avoid or mitigate potential conflicts of interests, whether real or perceived, relating to a matter the CIRB is responsible for reviewing. Failure of a Board member to disclose conflicts of interest in circumstances where the Board member has an interest in the matter under review, may undermine the public confidence of the CIRB.

Conflicts of interests by Board members may arise in a number of circumstances. This section outlines the overall process for the identification and management principles, which will guide the CIRB in identifying, reporting and managing these conflicts.

Conflicts of interest are managed by a policy of transparency through continuous disclosure. As the personal and financial circumstances of Board members may change over the duration of their appointment, they are required to declare any new interests to the CIRB to ensure there’s ongoing transparency and accountability.

Section 17 Other paid work

Section 17 provides requirements on Board members of the CIRB relating to undertaking other paid work. It provides that a Board member must not engage in any paid work that, in the Minister’s opinion, conflicts or could conflict with the proper performance of the Board member’s duties.

It is not the intention of this section to prevent individuals from working in cyber-related roles for the duration of their appointment to the CIRB, as such conflicts may be mitigated by the CIRB as they arise. Instead, this section is intended to address paid work which conflicts with a persons’ appointment on the CIRB. For example, a person who undertakes paid work for a business or individual which is under sanctions.

Section 18 Leave of absence of Board members

Section 18 provides the process for leaves of absence by the Chair and other Board members for the purpose of paragraph 69(1)(g) of the Act.

Subsection 18(1) provides that the Minister can grant leave of absence to the Chair on the terms and conditions the Minister determines.  

Subsection 18(2) provides that the Chair may grant a leave of absence to any other Board member on the terms and conditions that the Chair determines.

For the purpose of leave granted by the CIRB Chair under subsection 18(2), subsection 18(3) provides that the Chair must notify the Minister if the Chair grants a Board member a leave of absence for a period that exceeds 3 months.

Section 19 Resignation of Board members

Section 19 provides for resignation of Board members for the purpose of paragraph 69(1)(d) of the Act.

Subsection 19(1) provides that a Board member may resign the member’s appointment by giving the Minister a written resignation.

Subsection 19(2) provides that the resignation takes effect on the day it is received by the Minister or, if a later day is specified in the resignation, on that later day.

Section 20 Termination of appointment of Board members

This section provides for the termination of appointment of Board members for the purpose of paragraph 69(1)(f) of the Act.

Subsection 20(1) provides that the Minister may terminate the appointment of a Board member for misbehaviour, or if the Board member is unable to perform the duties of the Board member’s office because of physical or mental incapacity. Subsection 20(2) provides that the Minister may terminate the appointment of a Board member if:

  • they become bankrupt; or applies to take the benefit of any law for the relief of bankrupt or insolvent debtors; or compounds with the Board member’s creditors; or makes an assignment of the Board member’s remuneration for the benefit of the Board member’s creditors (paragraph 20(2)(a)); or

 

  • the Board member is absent, except on leave of absence, from 3 consecutive meetings of the CIRB (paragraph 20(2)(b)); or

 

  • the Board member engages in paid work that, in the Minister’s opinion, conflicts or could conflict with the proper performance of the Board member’s duties (paragraph 20(2)(c)): or

 

  • Board member fails, without reasonable excuse, to comply with section 29 of the PGPAA or rules made for the purposes of that section (paragraph 20(2)(d)); or

 

  • The Minister ceases to be satisfied of any of the matters in subsection 13(1) (eligibility for appointment as Board member) in relation to the Board member (paragraph 20(2)(e)).

The Minister will terminate the appointment of Board members as a last resort to resolve issues, and where existing mechanisms available to the CIRB are insufficient to resolve issues arising from the behaviour, circumstances or attendance of a Board member.

By defining a limited scope for the Minister to exercise this power, the CIRB retains the independence to manage its own functions and governance whilst ensuring an appropriate level of oversight and accountability.

Division 4 – Expert Panel

Section 21 Purpose of this Division

Section 21 provides an application provision for Part 2, Division 4 of the Rules. The application provision provides that Division 4 is made for the purpose of subsection 70(5) of the Act.

Under the Act, the CIRB may establish an Expert Panel. One or more members of the Expert Panel may be appointed to assist in relation to a review conducted under this Part. Expert Panel members are persons with a particular expertise relevant to matters that may be called up to the review panel to assist the CIRB in conducting its review into a particular cyber security incident.

Subsection 70(5) of the Act empowers rules to be made for the provision for or in relation to the appointment of the Expert Panel, including in relation to membership of the Expert Panel, appointment and terms of appointment.

Section 22 Appointments to the Expert Panel

Section 22 provides provisions for the appointment of the Expert Panel. This section is made under paragraph 70(5)(b) of the Act. Subsection 22(1) provides that an appointment to the Expert Panel is on a part-time basis.

Subsection 22(2) provides that a member of the Expert Panel holds office for the period specified in the instrument of appointment and must not exceed 4 years.

Subsection 22(3)(a) provides that a person is only eligible to be appointed as a member of the Expert Panel if the person either:

  • holds, or is eligible to hold, an Australian Government security clearance that allows the person to access to information that has a security classification of at least secret (subparagraph 22(3)(a)(i)); or
  • holds an equivalent security clearance recognised by the Commonwealth for the purposes of allowing the person to access to information that has a security classification of at least secret (subparagraph 22(3)(a)(ii)).

Subsection 22(3)(b) provides further criteria on eligibility for appointment to the Expert Panel. In addition to holding the appropriate security clearance, a person must also hold or possess one of the following:

  • a degree from a university, or an educational qualification of a similar standing, in the field of law and has significant experience working in that field (subparagraph 22(3)(b)(i));
  • an educational qualification in the field of cyber security, information technology, computer networks or software engineering (subparagraph 22(3)(b)(ii));
  • has significant experience working in the field of cyber security or information security (subparagraph 22(3)(b)(iii));
  • holds a relevant Commonwealth, State or Territory government position at an appropriately senior level (subparagraph 22(3(b)(iv)); or
  • has significant experience in audit, assurance or review processes, public administration or financial or prudential regulation (subparagraph 22(3)(b)(v)); or
  • has significant experience in incident management or crisis response (subparagraph 22(3)(b)(vi));
  • has significant experience in a critical infrastructure sector (within the meaning of the Security of Critical Infrastructure Act 2018) (subparagraph 22(3)(b)(vii)); or
  • has significant academic qualifications or knowledge in a relevant field (subparagraph 22(3)(b)(viii)).

The eligibility criteria for the Expert Panel mirrors that of the standing members to ensure that the CIRB is able to appoint persons with a suitable variety of skills, experience and expertise to the review panel to assist in the conduct of a review. Being able to draw upon a range of expertise beyond just cyber and incident response will ensure that experts can support the CIRB to draw insights and recommendations to address systemic issues and uplift Australia’s cyber preparedness.

The first note under this subsection draws the reader’s attention to subsection 70(4) of the Act, which provides that an appointment to the Expert Panel is not a public office within the meaning of the Remuneration Tribunal Act 1973 (Remuneration Tribunal Act). The effect of this is that the remuneration of Expert Panel members is to be determined by the Chair of the Board by legislative instrument (see section 24 of the Rules).

The second note under this section provides that a member of the Expert Panel is only to be remunerated when the member is appointed to a review panel for a review. This note references section 24 of the Rules, which provides provisions for the remuneration of the Expert Panel.

Subsection 22(4) provides that before appointing a person as a member of the Expert Panel, the Chair must be satisfied that the person meets the eligibility requirements mentioned in subsection 22(3), and the person has appropriate qualifications, knowledge, skills or experience to perform the role.

Subsection 22(5) provides that the Chair may appoint a person who holds a State or Territory government position only with the agreement of the State or Territory concerned.

Section 23 Appointments of Expert Panel members to assist in relation to a review

Section 23 provides provisions for the appointment of Expert Panel members to a review panel to assist in a review. This section is made under paragraph 70(5)(c) of the Act.

Section 23 provides eligibility requirements that the Chair must be satisfied of before appointing a member of the Expert Panel to the review panel to assist in a review. Under subsection 70(3) of the Act, one or more members of the Expert Panel are to be appointed by the Board, in writing and in accordance with the terms of reference for a review under section 46 of the Act, to the review panel for the review to assist in the review.

Section 23 provides that the Chair may only appoint an Expert Panel member to assist in a particular review under subsection 70(3) of the Act if the Chair is satisfied of the following relating to an Expert Panel member:

  •  the Expert Panel member meets the eligibility requirements (if any) specified in the terms of reference for the review for the purposes of paragraph 9(1)(d) of the Rules;
  • The Expert Panel member has appropriate qualifications, knowledge, skills or experience to assist the CIRB in relation to the particular review; and
  • the Expert Panel member will not be engaged in any paid work that conflicts, or could conflict, with the proper performance of the member’s duties assisting the CIRB in relation to the review.

The note under this subsection provides that one or more members of the Expert Panel are to be appointed by the CIRB, in accordance with the terms of reference for a review under section 46 of the Act, to the review panel for the review to assist in the review. These requirements are specified in subsections 46(4) and 70(3) of the Act.

Section 24 Remuneration of Expert Panel members appointed to assist in relation to a review

Section 24 of the Rules provides provisions for the remuneration, resignation and revocation of the appointment of Expert Panel members appointed to a review panel for a review. Section 24 is made under paragraphs 70(5)(e) and 70(5)(f) and of the Act.

Section 24(1) provides that this section applies if a member of the Expert Panel is appointed, under subsection 70(3) of the Act, to the review panel for a review.

The note under subsection 24(1) provides that an appointment to assist in a review is not a public office within the meaning of the Remuneration Tribunal Act 1973.

Subsections 24(2) and (3) provide, respectively, that Expert Panel members are to be paid the remuneration and allowances that are determined by the Chair by legislative instrument.

Subsequently, subsection 24(4) provides a power for the Chair to make legislative instruments for the purpose of subsection 24(2) and 24(3) to determine the remuneration or allowances of Expert Panel members appointed to the review panel for a review.

Subsection 24(5) provides that an Expert Panel member may resign the member’s appointment to the review panel for a review by giving the Chair a written resignation. Subsection 24(6) provides that the resignation takes effect on the day it is received by the Chair or, if a later day is specified in the resignation, on that later day.

Subsection 24(7) provides that the Chair may revoke the appointment of a member of the Expert Panel to the review panel for a review for any of the following reasons:

  • misbehaviour (paragraph 24(7)(a)); or

 

  • if the member of the Expert Panel is unable to perform the duties of the member’s office because of physical or mental incapacity (paragraph 24(7)(b)); or

 

  • if the member becomes bankrupt (subparagraph 24(7)(c)(i)); or

 

  • if the member applies to take the benefit of any law for the relief of bankrupt or insolvent debtors (subparagraph 24(7)(c)(ii)); or

 

  • if the member compounds with the member’s creditors (subparagraph 24(7)(c)(iii)); or

 

  • if the member makes an assignment of the member’s remuneration for the benefit of the member’s creditors (subparagraph 24(7)(c)(iv)); or

 

  • if the member fails, without reasonable excuse, to comply with the duty to disclose conflicts (provided for in section 25 of the Rules) (paragraph 24(7)(d)); or

 

  • if the Chair ceases to be satisfied of any matter in subsection 22(3) or section 23 relating to the member (paragraph 24(7)(e)).

Consistent with the Minister’s powers to terminate the appointment of standing members in certain circumstances, it is appropriate that the Chair have similar powers to revoke the appointment of Expert Panel members to a review panel to resolve issues arising from the behaviour, attendance or another circumstance which can’t be resolved using the CIRB’s existing mechanisms, such as its conflict of interest framework.

By defining a limited scope for the Chair to exercise this power, decisions to revoke the appointment of Expert Panel members are transparent and establishes a clear governance framework for the use of this power, including for a member of the Expert Panel to seek review of this decision.

Unlike the Chair and members of the CIRB who are in public office for the purposes of the PGPAA, appointments to the Expert Panel are not appointments to a public office.

Therefore, the Remuneration Tribunal is not able to make a determination as to the remuneration of the Expert Panel when they are appointed to assist a review. As the CIRB has complete discretion in the performance of the CIRB’s functions and the exercise of its powers, the remuneration of the Expert Panel is to be determined by the Chair.

Section 25 Disclosure of interests to the Board

This section provides requirements for disclosure of interests by Expert Panel members to the CIRB. Section 25 is made under paragraph 70(5)(g) of the Act.

Subsection 25(1) provides that before a person is appointed as a member of the Expert Panel, the person must give written notice to the Chair of all interests, pecuniary or otherwise, that the person has or acquires and that conflict or could conflict with the proper performance of the person’s duties as a member of the Expert Panel.

Subsection 25(2) provides an ongoing disclosure requirement that applies to Expert Panel members. Subsection 25(2) provides that a member of the Expert Panel who has an interest, pecuniary or otherwise, in a matter being considered or about to be considered by the Board must disclose the nature of the interest to the Chair.

Subsection 25(3) provides that a disclosure under subsection 25(2) must be made as soon as possible after the relevant facts have come to the Expert Panel member’s knowledge.

Subsection 25(4) provides that unless the CIRB otherwise determines, the member of the Expert Panel must not be present during any deliberation by the CIRB on the interest raised by the Expert Panel member.

Subsection 25(5) provides that for the purposes of making a determination under subsection 25(4), the member of the Expert Panel must not be present during any deliberation of the Board for the purpose of making the determination regarding their interest that is disclosed.

Subsection 25(6) provides that a determination under subsection 25(4) relating to the disclosure of interest by the Expert Panel member must be recorded by the CIRB. In addition, subsection 25(7) provides that a disclosure under this section must be recorded by the CIRB.  

The purpose of disclosure of interests by  Expert Panel members is to avoid or mitigate potential conflicts of interests, whether real or perceived, relating to a matter the CIRB is responsible for reviewing, or could be responsible for reviewing. Failure of an Expert Panel member to disclose conflicts of interests in circumstances where the member has an interest in the matter under review, may undermine the public confidence of the CIRB.

Section 26 Resignation of members of the Expert Panel

Section 26 provides how a member of the Expert Panel may resign from the Expert Panel. Section 26 is made under paragraph 70(5)(f) of the Act.

Subsection 26(1) provides that a member of the Expert Panel may resign the member’s appointment to the Expert Panel by giving the Chair a written resignation.

Subsection 26(2) provides that the resignation takes effect on the day it is received by the Chair or, if a later day is specified in the resignation, on that later day.

The note under this subsection clarifies that resignation from the Expert Panel also means the person is not a member of any review panel for a review as the person is no longer a member of the Expert Panel.

Section 27 Termination of appointment of Expert Panel members

Section 27 specifies the situation in which the Chair may terminate the appointment of a member of the Expert Panel. Section 27 is made under paragraph 70(5)(h) of the Act.

Section 27 provides that the Chair may terminate the membership of an Expert Panel member for any of the following reasons:

  • misbehaviour (paragraph 27(a)); or

 

  • if the member of the Expert Panel is unable to perform the duties of the member’s office because of physical or mental incapacity (paragraph 27(b)); or

 

  • if the member becomes bankrupt (subparagraph 27(c)(i));or

 

  • if the member applies to take the benefit of any law for the relief of bankrupt or insolvent debtors (subparagraph 27(c)(ii)); or

 

  • if the member compounds with the member’s creditors (subparagraph 27(c)(iii)); or

 

  • if the member makes an assignment of the member’s remuneration for the benefit of the member’s creditors (subparagraph 27(c)(iv)); or

 

  • if the member fails, without reasonable excuse, to comply with the duty to disclose conflicts (provided for in section 25 of the Rules) (paragraph 27(d)); or

 

  • if the Chair ceases to be satisfied of any matter in subsection 22(3) relating to the member (paragraph 27(e)). Subsection 22(3) outlines the eligibility the criteria for appointment to the Expert Panel.

The note under this subsection provides that the termination from the Expert Panel also means the person is not a member of any review panel for a review as the person is no longer a member of the Expert Panel.

Division 5 – Other matters

Section 28 Purpose of this Division

Section 28 provides that the purpose of Division 5 is to make Rules for the purpose of subsection 73(2) of the Act. Subsection 73(2) of the Act provides that the Rules may make provisions for or in relation to the operation and procedures of the CIRB.  

Section 29 Convening meetings

Section 29 provides provisions relating to the convening of meetings of the CIRB.

Subsection 29(1) provides that the CIRB must hold such meetings as are necessary for the efficient performance of its functions (which are outlined in section 62 of the Act).

Subsection 29(2) further provides that the Chair may convene a meeting at any time and must convene a meeting within 30 days after receiving a written request to do so from another member of the CIRB.

Section 30 Presiding at meetings

Section 30 provides provisions relating to the presiding of meetings of the CIRB.

Subsection 30(1) provides that the Chair must preside at all meetings at which the Chair is present.

Subsection 30(2) provides that if the Chair is not present at a meeting, the other members of the CIRB present must appoint one of themselves to preside.

Section 31 Voting at meetings

Section 31 provides provisions relating to the voting of meetings of the CIRB.

Subsection 31(1) provides that a question arising at a meeting of the CIRB is to be determined by a majority of the votes of the members of the CIRB present and voting.

Subsection 301(2) provides that the person presiding at a meeting of the CIRB, which will generally be the CIRB’s Chair, has a deliberative vote and, if the votes are equal, a casting vote.

Section 32 Conduct of meetings

Section 32 provides provisions for the conduct of meetings of the CIRB.

Section 32 provides that the CIRB may, subject to this instrument and the Act, regulate proceedings at its meetings as it considered appropriate.

The note in this section provides that section 33B of the Acts Interpretation Act 1901 contains further information about the ways in which Board members may participate in meetings. Section 33B of the Acts Interpretation Act 1901 provides guidance for remote participation in meetings for bodies created under an Act. It applies to both incorporated and unincorporated bodies that are required or permitted to hold meetings. Members of such bodies may participate in meetings using telephone, closed-circuit television, or any other means of communication, as permitted by the body. Members participating remotely are considered present at the meeting and count towards the quorum. Meetings can be conducted entirely through remote communication, with all members participating remotely if necessary. Additionally, meetings may take place across multiple locations simultaneously when remote participation is in effect, providing flexibility for hybrid or remote formats.

Section 33 Minutes

Section 33 provides that the CIRB must keep minutes of its meetings.

Section 34 Decisions without meetings

Section 34 provides guidance on when decisions have been made by the CIRB without a meeting being conducted.

Subsection 34(1) prescribes that the CIRB is taken to have made a decision at a meeting if the following are all satisfied:

  • without meeting, a majority of the Board members entitled to vote on the proposed decision indicate agreement with the decision (paragraph 34(1)(a));
  • that agreement is indicated in accordance with the method determined by the Board under subsection 34(2) (paragraph 34(1)(b)); and
  • all the Board members were informed of the proposed decision, or reasonable efforts were made to inform all the Board members of the proposed decision (paragraph 34(1)(b)).

Subsection 34(2) prescribes that subsection 34(1) only applies if the CIRB has determined that it may make decisions of that kind without meeting and determined the method by which Board members are to indicate agreement with proposed decisions. This will ensure that the CIRB has sufficient discretion to ensure it can make decisions in the manner that suits the operational requirements for each decision.

Subsection 34(3) prescribes that for the purposes of paragraph 34(1)(a), a Board member is not entitled to vote on a proposed decision if the Board member would not have been entitled to vote on that proposal if the matter had been considered at a meeting of the CIRB.

Subsection 34(4) provides that the CIRB must keep a record of decisions made in accordance with section 34.

 


ATTACHMENT B

 

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

 

Cyber Security (Cyber Incident Review Board) Rules 2025

 

This Disallowable Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

 

Overview of the Disallowable Legislative Instrument

Australia’s cyber security landscape is evolving, with malicious activities targeting Australia becoming more frequent and sophisticated. The Cyber Security Act 2024 (the Act) provides a clear legislative framework for whole-of-economy cyber security issues. The Act was introduced to provide additional protections to Australian citizens and businesses; improve the security of our increasingly interconnected devices; build mitigations for existing cyber risks; and improve the Government’s threat picture to inform protections, incident response procedures and future policy.

 

The Act establishes the Cyber Incident Review Board (CIRB) as an independent statutory advisory body to conduct no-fault, post-incident reviews of significant cyber security incidents, and make recommendations to prevent, detect, respond to, or minimise the impact of cyber security incidents of a similar nature in the future.

 

Pursuant to Part 5 of the Act , the Cyber Security (Cyber Incident Review Board) Rules 2025 (the Disallowable Legislative Instrument) establishes the governance parameters through which the CIRB will perform its functions, while providing flexibility to ensure the CIRB can respond effectively and regulate its proceedings as it sees fit. The Disallowable Legislative Instrument sets out the following:

  • Parameters for the CIRB to consider referrals against criteria established in section 46 of the Act, drafting the terms of reference for a review, and the timing and public notification of reviews.
  • Parameters for managing the appointments of standing members of the board, their eligibility requirements, disclosure of interests, resignation and termination parameters.
  • Parameters for the Expert Panel, their eligibility requirements, disclosure of interests, remuneration, resignation and termination parameters.
  • Other governance parameters establishing processes for convening meetings, conduct at meeting, voting and record keeping.

The CIRB is comprised of a Chair, standing members, which together form the core component of the CIRB, and an Expert Panel of industry experts that can be called upon for individual reviews. Reviews will be conducted by the Chair, the standing members and at least two members of the Expert Panel, who will be allocated based on expertise and experience most relevant to the review. Following reviews by the CIRB, the CIRB will disseminate recommendations to both Government and industry.

 

The CIRB provides an independent, expert body that can distil and disseminate the key lessons to learn from significant cyber security incidents, without apportioning blame. This will help both private and public sectors, and the community, to learn and better inform themselves, enhancing our combined cyber security resilience.

 

Human rights implications

This Disallowable Legislative Instrument may engage the following rights:

  • the right to work in Article 6 of the International Covenant on Social, Economic and Cultural Rights (ISESCR)
  • the prohibition on interference with privacy in Article 17 of the International Covenant on Civil and Political Rights (ICCPR)

 

Right to Work

Article 6 of the ICESCR provides that states will recognise the right to the opportunity for a person to gain work of their choosing. The right to work does not equate to a guarantee to particular employment. The United Nations Committee on Economic Social and Cultural Rights has stated that this protection includes the right to not be unfairly deprived of work. Any limitations need to be reasonable, necessary and proportionate to the legitimate objective sought to be achieved.

 

Section 17 of the Disallowable Legislative Instrument provides that a CIRB member must not engage in any paid work that, in the Minister’s opinion, conflicts or could conflict with the proper performance of the CIRB member’s duties. This may restrict a CIRB member’s ability to engage in other paid work in related industries. To the extent that this provision might limit a CIRB member’s ability to engage in work of their choosing, it is reasonable as a person nominating for a position on the CIRB does so voluntarily, with an understanding of the conditions attached to such a position and the sensitive nature of the work involved. Article 6 does not guarantee an individual’s employment in a particular position. This potential limitation is reasonable and necessary in the circumstances and proportionate to the legitimate objective of ensuring confidence in the CIRB’s ability to conduct its review independently.

 

Right to Privacy

Article 17(1) of the ICCPR provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy.

 

Interferences with privacy may be permissible, where they are authorised by law and not arbitrary. In General Comment 16, the United Nations Human Rights Committee (UNHRC) argued that the introduction of the concept of arbitrariness in Article 17 “is intended to guarantee that even interference provided for by law should be in accordance with the provisions, aims and objectives of the Covenant and should be in any event, reasonable in the particular circumstances.” The UNHRC further clarified that “any interference with privacy must be proportional to the end sought and be necessary in the circumstances of any given case.”[1]

 

Section 15 and 16 of the Disallowable Legislative Instrument require that members of the CIRB disclose to the Minister and the CIRB all interests, pecuniary or otherwise, that the person is aware of having in a matter of a kind likely to be considered by the CIRB. Similarly, section 25 of the Disallowable Legislative Instrument requires that members of the Expert Panel must disclose to the Chair of the Board any interests, pecuniary or otherwise, in a matter being considered or about to be considered by the CIRB. These disclosure requirements are ongoing in nature and are made in order to avoid or mitigate potential conflicts of interests, whether real or perceived, relating to the CIRB or the Panel. Further, the Disallowable Legislative Instrument requires that CIRB members disclose to the Minister any matter for the purpose of section 29 of the Public Governance, Performance and Accountability Act 2013 (PGPAA). Section 29 of the PGPPA requires an official of a Commonwealth entity to disclose details of any material personal interest that relates to the affairs of the entity they are an official of. Failure to disclose in accordance with this section will also result in non-compliance under the PGPPA.

 

These disclosure obligations placed on members of the CIRB and Expert Panel, may require the disclosure of personal and financial information to the CIRB and to the Minister. To the extent these obligations limit the right to privacy in Article 17 of the ICCPR, they are not arbitrary or unlawful. A person is voluntarily appointed to the CIRB or the Panel and it is reasonable and necessary to ensure that they disclose any conflicts of interest to maintain public confidence that these bodies and their members are able to complete their reviews independently. It is appropriate that a CIRB member as an official for the purposes of the PGPPA is subject to the same disclosure requirements as other officials in the Commonwealth. These measures are aimed at the legitimate objective of establishing the governance parameters of an independent advisory body designed to provide recommendations to the Government and industry to strengthen Australia’s collective cyber resilience.

 

Subsections 64(1) and 66(1) of the Act provide that the Minister may appoint a person as the chair or as a standing member by a written instrument. Similarly, section 14 of the Disallowable Legislative Instrument provides that the Minister may appoint a person to act as a standing member by a written instrument. This means that CIRB members’ personal information such as their names may be published on the Federal Register of Legislation. This limitation on the right to privacy is not arbitrary given the public nature of the CIRB’s business. Moreover, appointment to the CIRB is voluntary and the publishing of such personal information would only be done with the agreement and consent of the person.

 

The Disallowable Legislative Instrument establishes the minimum necessary governance standards for oversight of the actions of the CIRB and Expert Panel, which are reasonable, necessary and proportionate to achieving the legitimate objective of providing a transparent and independent advisory body as part of the Government’s strategy to mitigate the recurrence of cyber security incidents and strengthen Australia’s cyber resilience.

 

Conclusion

This Disallowable Legislative Instrument is compatible with human rights because to the extent it may limit human rights, those limitations are reasonable, necessary and proportionate.

 

The Honourable Tony Burke MP 

Minister for Home Affairs and Minister for Cyber Security 

 

[1] Toonen v Australia, Communication No. 488/1992, para. 8.3; see also communications Nos. 903/1999, para 7.3, and 1482/2006, paras. 10.1 and 10.2.

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.