Cyber Security (Member of the Cyber Incident Review Board) Appointment (No. 3) 2026

Overview

The Cyber Security (Member of the Cyber Incident Review Board) Appointment (No. 3) 2026 Instrument, dated 28 April 2026, was enacted by Tony Burke, the Minister for Home Affairs and Minister for Cyber Security, under section 66 of the Cyber Security Act 2024. This instrument appoints Jessica Burleigh as a standing part-time member of the Cyber Incident Review Board, effective from 1 May 2026, for a term of four years. The Cyber Security Act 2024 was introduced to address the increasing complexity and frequency of cyber threats, aiming to bolster Australia's cyber resilience and safeguard critical infrastructure. The policy objective of this appointment is to enhance the expertise and capacity of the Cyber Incident Review Board in reviewing significant cyber incidents, thereby improving the national response to cyber threats.

Scope and Application

The Cyber Security (Member of the Cyber Incident Review Board) Appointment (No. 3) 2026I, issued under section 66 of the Cyber Security Act 2024, appoints Jessica Burleigh as a standing member of the Cyber Incident Review Board on a part-time basis, effective from 1 May 2026 for a period of four years. The Act applies to individuals appointed to the Cyber Incident Review Board and encompasses the conduct and responsibilities of these members within their capacity to review cyber incidents and advise on relevant cyber security matters. The geographic reach of this legislation is national, aligning with the overarching objectives of the Cyber Security Act 2024 to enhance Australia's cyber security resilience. The appointment does not include specific exclusions, exemptions, or thresholds, but it operates under the broader framework established by the Cyber Security Act 2024. The Act may be extended or restricted through subordinate instruments, ensuring flexibility in addressing emerging cyber security challenges.

Key Provisions

The main operative sections of the ADMIN 26/105 Cyber Security (Member of the Cyber Incident Review Board) Appointment (No. 3) 2026I are primarily concerned with the appointment of Jessica Burleigh as a standing member of the Cyber Incident Review Board. Under section 66 of the Cyber Security Act 2024, Tony Burke, as the Minister for Home Affairs and Minister for Cyber Security, has appointed Jessica Burleigh to this position. The appointment is on a part-time basis and will last for a period of four years, commencing on 1 May 2026. This notifiable instrument formalises Jessica Burleigh's role within the Cyber Incident Review Board and sets the parameters for her tenure. The obligations imposed by this legislation on Jessica Burleigh include fulfilling her duties as a standing member of the Cyber Incident Review Board in a part-time capacity. This entails participating in reviews of cyber incidents, contributing to the development of strategies to mitigate cyber threats, and ensuring that the Board operates effectively in its oversight and advisory functions. Additionally, Jessica Burleigh is required to adhere to any guidelines and policies set forth by the Board and to maintain confidentiality regarding sensitive information encountered during her tenure. Furthermore, she is obligated to engage in professional development activities to stay current with evolving cyber security challenges and best practices. Breaching the obligations set out in this appointment could lead to various consequences. While the specific offences and penalties are not detailed in the notifiable instrument itself, under the broader Cyber Security Act 2024, there are provisions for disciplinary actions and potential legal consequences. For instance, any failure to uphold the confidentiality of sensitive information could result in civil or criminal penalties. Such breaches might also lead to the termination of the appointment, depending on the severity and nature of the misconduct. Furthermore, if Jessica Burleigh engages in activities that are deemed detrimental to the objectives of the Cyber Incident Review Board, this could result in her removal from the position and possibly legal proceedings against her. The exact penalties would depend on the specific breaches and the interpretations provided by relevant authorities within the framework of the Cyber Security Act 2024.