EXPLANATORY STATEMENT
Issued by the authority of the Minister for Industry, Science and Technology
Industry Research and Development Act 1986
Industry Research and Development (Cyber Security Business Connect and
Protect Program) Instrument 2020
Purpose and Operation
Section 33 of the Industry Research and Development Act 1986 (the IR&D Act) provides a mechanism for the Minister to prescribe programs, by disallowable legislative instrument, in relation to industry, innovation, science or research, including in relation to the expenditure of Commonwealth money under such programs.
The statutory framework provided by section 33 of the IR&D Act enables a level of flexibility to provide authority for Commonwealth spending activities in relation to industry, innovation, science and research programs. This allows the Government to respond quickly and appropriately to the need to implement innovative ideas and pilot programs on an ongoing basis and as opportunities arise. Prescribing programs in legislative instruments provides transparency and parliamentary oversight of Government programs and spending activities, whilst reducing administrative burden on the Commonwealth.
Once a program is prescribed by the Minister under section 33, subsection 34(1) allows the Commonwealth to make, vary or administer arrangements in relation to activities under the prescribed program. Arrangements may include contracts, funding agreements or other arrangements, and may provide for money to be payable by the Commonwealth to one or more third parties. The power conferred on the Commonwealth by subsection 34(1) may be exercised on behalf of the Commonwealth by a Minister or an accountable authority of a non-corporate Commonwealth entity, or by their delegate (under section 36).
The purpose of the Industry Research and Development (Cyber Security Business Connect and Protect Program) Instrument 2020 (the Legislative Instrument) is to prescribe the Cyber Security Business Connect and Protect Program (the Program). The funding for the Program will be provided through 2020-21 Appropriation Bills. The Program provides $8.3 million over two financial years (2020-21 to 2021-22) as part of the Australian Government’s commitment to support an uplift in the cyber security capability of small and medium enterprises (SMEs). The Program will provide funding to support projects that raise the awareness of cyber security risks among SMEs, promote action to address these risks and support and uplift the capability of SMEs to meet best practice in cyber security.
Funding is available to trusted organisations, such as business chambers and industry associations, that provide business advice to SMEs, and have a demonstrated reach and influence over a large number of SMEs across regional and metropolitan Australia, to undertake eligible projects to:
- raise cyber security risk awareness among SMEs
- promote action among SMEs to address cyber security risks
- lift the cyber security capability of SMEs, including through transfer of cyber security knowledge and skills.
Funding authorised by this Legislative Instrument comes from Program 1.2: Growing innovative and competitive businesses, industries and regions, Outcome 1, as set out in the Portfolio Budget Statements 2020-21, Budget Related Paper No. 1.9, Industry, Science, Energy and Resources Portfolio (https://www.industry.gov.au/about-us/finance-reporting/budget-statements) at page 31.
The Program will be delivered by the Department of Industry, Science, Energy and Resources (the Department) Business Grants Hub, which is a specialised design, management and delivery body with extensive expertise and capability in delivering similar programs.
The Program is a competitive, merits based grants program. The Program will be administered by the Department in accordance with the Commonwealth Grant Rules and Guidelines 2017 (https://www.finance.gov.au/sites/default/files/2019-11/commonwealth-grants-rules-and-guidelines.pdf). Eligibility and merit criteria will be outlined in grant opportunity guidelines, which will be made available on https://www.business.gov.au.
Spending decisions will be made by the Program Delegate, who is the AusIndustry Manager responsible for administering the Program, taking into account the recommendations of a committee of Departmental officials with industry knowledge and expertise (the Departmental committee).
A total of $6.9 million is available for grant funding. Grants will be a minimum of $100,000 up to a maximum of $750,000. The grant amount may be up to 100% of eligible project costs.
The Program involves the allocation of finite resources between competing applicants. In addition, there will be a robust and extensive assessment process, an enquiry and feedback process, and a complaints mechanism for affected applicants. Therefore, external merits review will not apply to decisions about the provision of grants under the Program.
Applications will be assessed in two stages. At first instance, applications will be assessed by AusIndustry against the eligibility criteria. The Departmental committee will then consider eligible applications against the assessment criteria. This will include comparing the applications and scoring each application out of 100. The Departmental committee may seek input from independent experts to inform their assessments.
Applications will be required to address the eligibility and assessment criteria, and provide relevant supporting information. The amount of detail and supporting evidence should be relative to the project size, complexity and funding amount requested. Larger and more complex projects should include more detailed evidence. To be competitive, applications must score highly against each assessment criterion.
After considering the applications, the Departmental committee will make recommendations to the Program Delegate regarding those applications suitable for funding. The Program Delegate will make the final decision about which grants to approve, taking into consideration the Departmental committee’s recommendations, and the availability of grant funds. The Program Delegate will not approve funding if there are insufficient Program funds available across relevant financial years for the Program.
Both successful and unsuccessful applicants will be informed in writing. Unsuccessful applicants will have an opportunity to discuss the outcome with the Department.
Persons who are otherwise affected by decisions or who have complaints about the Program will also have recourse to the Department. The Department investigates any complaints about the Program in accordance with its complaints policy and procedures. If a person is not satisfied with the way the Department handles the complaint, they may lodge a complaint with the Commonwealth Ombudsman.
Communications power
The Legislative Instrument specifies that the legislative power in respect of which it is made is the communications power (section 51(v) of the Constitution). Section 51(v) of the Constitution empowers the Parliament to make laws with respect to 'postal, telegraphic, telephonic and other like services'.
In that regard, funding provided under the Legislative Instrument will support SMEs in their use of electronic communication services such as the internet by funding projects which improve their cyber security capability.
Authority
Section 33 of the Industry, Research and Development Act 1986 provides authority for the Legislative Instrument.
Consultation
In accordance with section 17 of the Legislation Act 2003, the Attorney-General’s Department has been consulted on this Legislative Instrument.
In the development of this program, consultation was undertaken directly with the Department of Home Affairs, the Australian Cyber Security Centre, the Department of Finance, Treasury and the Department of the Prime Minister and Cabinet. Furthermore, consultation on appropriate policy mechanisms for achieving the program objectives was conducted through interviews with 43 small and medium businesses, during research undertaken by the Department.
Regulatory Impact
It is estimated that the regulatory burden is likely to be minor (OBPR reference number 25633).
Details of the Industry Research and Development (Cyber Security Business Connect and Protect Program) Instrument 2020
Section 1 – Name of Instrument
This section specifies the name of the Legislative Instrument as the Industry Research and Development (Cyber Security Business Connect and Protect Program) Instrument 2020.
Section 2 – Commencement
This section provides that the Legislative Instrument commences on the day after registration on the Federal Register of Legislation.
Section 3 – Authority
This section specifies the provision of the Industry, Research and Development Act 1986 (the IR&D Act) under which the Legislative Instrument is made.
Section 4 – Definitions
This section provides for definitions of terms used in the Legislative Instrument.
Section 5 –Prescribed Program
This section prescribes the Cyber Security Business Connect and Protect Program (the Program) for the purposes of section 33 of the IR&D Act.
The Program provides funding for a competitive, merit based grants program supporting projects that raise the awareness of cyber security risks among SMEs, promote action to address these risks and support and uplift the capability of SMEs to meet best practice in cyber security
Section 6 – Specified Legislative Power
This section specifies that the legislative power in respect of which the Legislative Instrument is made is the power of the Parliament to make laws with respect to postal, telegraphic, telephonic and other like services (section 51(v) of the Constitution).
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Industry Research and Development (Cyber Security Business Connect and Protect Program) Instrument 2020
This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Legislative Instrument
The Cyber Security Business Connect and Protect Program (the Program) provides $8.3 million over two financial years (2020-21 to 2021-22) as part of the Australian Government’s commitment to support an uplift in the cyber security capability of small and medium enterprises (SMEs). The Program will provide funding to support projects that raise the awareness of cyber security risks amongst SMEs, promote action to address these risks and support and uplift the capability of SMEs to meet best practice in cyber security.
Funding is available to trusted organisations, such as business chambers and industry associations, that provide business advice to SMEs and have a demonstrated reach and influence over a large number of SMEs across regional and metropolitan Australia to undertake eligible projects to:
- raise cyber security risk awareness among SMEs
- promote action amongst SMEs to address cyber security risks
- lift the cyber security capability of SMEs, including through transfer of cyber security knowledge and skills.
Human rights implications
This Legislative Instrument does not engage any of the applicable rights or freedoms.
Conclusion
This Legislative Instrument is compatible with human rights as it does not raise any human rights issues.
The Hon Karen Andrews MP
Minister for Industry, Science and Technology