Industry Research and Development (Small Business Cyber Resilience Service Program) Instrument 2024

Administered by Department of Industry, Science and Resources

Legislation au F2024L00266 In force Legislative Instrument

Legislation content

 

EXPLANATORY STATEMENT

Issued by authority of the Minister for Housing, Minister for Homelessness and Minister for Small Business

Industry Research and Development Act 1986

Industry Research and Development (Small Business Cyber Resilience Service Program) Instrument 2024

Subsection 33(1) of the Industry Research and Development Act 1986 (the Act) provides that the Minister for Industry and Science may, by disallowable legislative instrument, prescribe programs in relation to industry, innovation, science or research, including in relation to the expenditure of Commonwealth money under such programs.

Section 33 of the Act provides for a statutory framework to provide authority for Commonwealth spending activities in relation to industry, innovation, science and research programs. This allows the Government to respond quickly and appropriately to the need to implement innovative ideas and pilot programs on an ongoing basis and as opportunities arise. Prescribing programs in legislative instruments provides transparency and Parliamentary oversight of government programs and spending activities, whilst reducing the administrative burden on the Commonwealth.

Once a program is prescribed by the Minister under section 33, subsection 34(1) of the Act allows the Commonwealth to make, vary or administer arrangements in relation to activities under the prescribed program. Arrangements may include contracts, funding agreements or other arrangements, and may provide for money to be payable by the Commonwealth to one or more third parties. The power conferred on the Commonwealth by subsection 34(1) may be exercised on behalf of the Commonwealth by a Minister or an accountable authority of a non‑corporate entity, or by their delegate (under section 36 of the Act).

Subsection 33(6) of the Act provides that the Minister may delegate, to another Minister, the Minister’s power under subsection 33(1) of the Act to prescribe a program. Delegations under subsection 33(6) of the Act are in place for the Small Business Cyber Resilience Service program (the Program) that empower the Minister for Housing, Minister for Homelessness and Minister for Small Business to prescribe (and, by virtue of subsection 33(3) of the Acts Interpretation Act 1901, amend) the Program.

The purpose of the Industry Research and Development (Small Business Cyber Resilience Service Program) Instrument 2024 (the Instrument) is to prescribe the Program.

The Program will improve the cyber resilience of small businesses by providing a free service, delivered by phone or by way of the internet, that small businesses may call or access to receive specific and individualised advice and assistance relating to navigating the cyber security landscape, improving cyber security resilience to prevent attacks, and to obtain support following a cyber incident.

A grant of up to a total of $8.1 million will be provided to a service provider through an open, competitive grant process to deliver the Program. The final funding amount will be dependent on an assessment of eligible expenses against the Program’s grant guidelines. Administration of the grant will be delegated to the Business Grants Hub.

For the purposes of subsection 33(3) of the Act, the Instrument specifies that the legislative power in respect of which the Instrument is made is the communications power (paragraph 51(v) of the Constitution). Paragraph 51(v) of the Constitution empowers the Parliament to make laws with respect to ‘postal, telegraphic, telephonic, and other like services’. In this regard, funding provided under the Instrument will support the service provider to deliver advice and assistance by telephone or by way of the internet.  

The Act does not specify any conditions that need to be satisfied before the power to prescribe programs can be exercised.  

In accordance with section 17 of the Legislation Act 2003, the Attorney General’s Department and the Department of Industry, Science and Resources have been consulted on this Instrument.

The Instrument is a legislative instrument for the purposes of the Legislation Act 2003.

The Instrument commenced on the day after registration on the Federal Register of Legislation.

Details of the Instrument are set out in Attachment A.

A statement of Compatibility with Human Rights is at Attachment B.

The Office of Impact Analysis has been (OIA) has been consulted (OIA ref: OBPR22-03270) and agreed that an Impact Analysis is not required.

 

ATTACHMENT A

Details of the Industry Research and Development (Small Business Cyber Resilience Service Program) Instrument 2024

Section 1 – Name

This section provides that the name of Instrument is the Industry Research and Development (Small Business Cyber Resilience Service Program) Instrument 2024 (the Instrument).

Section 2 – Commencement

This section provides that the Instrument commences on the day after registration on the Federal Register of Legislation.

Section 3 – Authority

The Instrument is made under the Industry Research and Development Act 1986 (the Act).

Section 4 – Definitions

This section provides definitions for the purposes of the Instrument.

Section 5 – Prescribed program

This section prescribes the Small Business Cyber Resilience Service Program for the purposes of subsection 33(1) of the Act.

The program provides funding, by way of a grant to a service provider, for the provision of expert advice and assistance delivered by telephone or by way of the internet to small businesses on matters relating to cyber security. The program has the purposes of helping to build the cyber security capability and resilience of small businesses, and also to support the recovery of small businesses after experiencing a cyber incident.

Section 6 – Specified legislative power

This section specifies that the legislative power in respect of which the Instrument is made are the powers of the Parliament to make laws with respect to postal, telegraphic, telephonic, and other like services (within the meaning of paragraph 51(v) of the Constitution).

ATTACHMENT B

 

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Industry Research and Development (Small Business Cyber Resilience Service Program) Instrument 2024

This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

The purpose of the Industry Research and Development (Small Business Cyber Resilience Service Program) Instrument 2024 (the Instrument) is to prescribe the Small Business Cyber Resilience Service Program (the Program). The program provides funding, by way of a grant to a service provider, for the provision of expert advice and assistance delivered by telephone or by way of the internet to small businesses on matters relating to cyber security.

Human rights implications

This Legislative Instrument does not engage any of the applicable rights or freedoms.

Conclusion

This Legislative Instrument is compatible with human rights as it does not raise any human rights issues.

Overview

The Industry Research and Development (Small Business Cyber Resilience Service Program) Instrument 2024 was introduced to address the growing need for enhanced cyber resilience among small businesses in Australia. Enacted under the authority of the Industry Research and Development Act 1986, this legislative instrument allows the Minister for Housing, Minister for Homelessness, and Minister for Small Business to prescribe the Small Business Cyber Resilience Service Program. This program aims to provide small businesses with access to expert advice and assistance in navigating the cyber security landscape, thereby improving their resilience against cyber attacks and supporting their recovery from cyber incidents. The Instrument was developed to ensure transparency and parliamentary oversight of government spending, while reducing administrative burdens on the Commonwealth. The Instrument, which commenced on the day after its registration on the Federal Register of Legislation, specifies that the legislative power underpinning it is the communications power granted by paragraph 51(v) of the Constitution, allowing the provision of expert advice and assistance through telephone or internet services.

Scope and Application

The Industry Research and Development (Small Business Cyber Resilience Service Program) Instrument 2024 prescribes the Small Business Cyber Resilience Service Program under the Industry Research and Development Act 1986, providing a statutory framework for Commonwealth spending on programs related to industry, innovation, science, and research. The prescribed Program aims to enhance the cyber resilience of small businesses by offering a free service that delivers expert advice and assistance on cyber security, delivered either by phone or via the internet. The Program will be funded through a competitive grant process, with a maximum allocation of $8.1 million. The Minister for Housing, Minister for Homelessness, and Minister for Small Business has been delegated the power to prescribe this Program, which will be administered by the Business Grants Hub. The Instrument applies to small businesses across Australia that require support in navigating the cyber security landscape and improving their resilience against cyber attacks. The Instrument does not specify any conditions or exclusions for the program, and its commencement is tied to its registration on the Federal Register of Legislation. The Instrument is consistent with the human rights and freedoms recognised in relevant international instruments, as it does not engage any applicable rights or freedoms.

Key Provisions

The Industry Research and Development (Small Business Cyber Resilience Service Program) Instrument 2024 prescribes the Small Business Cyber Resilience Service Program, which is aimed at bolstering the cyber resilience of small businesses through the provision of expert advice and assistance on cyber security matters (Section 5). This program is established under subsection 33(1) of the Industry Research and Development Act 1986 and is intended to be funded via a grant to a service provider, facilitating the delivery of services by telephone or internet. The service provider will offer individualised advice and support to small businesses to help them navigate the cyber security landscape, enhance their cyber security resilience, and obtain assistance following a cyber incident. The Act imposes several obligations on parties involved in the implementation of the program. These include the requirement for the Minister for Housing, Minister for Homelessness and Minister for Small Business to prescribe the program, as empowered by the delegations under subsection 33(6) of the Act (Section 33(6)). Furthermore, the Commonwealth is authorised to make, vary, or administer arrangements in relation to the activities under the prescribed program, which may encompass contracts, funding agreements, or other arrangements (Section 34(1)). The administration of the grant will be delegated to the Business Grants Hub, ensuring effective management and oversight of the program’s implementation (Section 6). There are no explicit offences, penalties, or civil/criminal consequences detailed within the Instrument for breaches of the prescribed program. However, the Act provides a broader framework for accountability and oversight. For instance, the Act allows for the disallowance of legislative instruments, providing a parliamentary mechanism to challenge the validity of the prescribed program if necessary (Section 33). Additionally, any failure to comply with the terms of the grant agreement or misuse of funds could potentially lead to administrative and financial repercussions, although these would be governed by the general provisions of the Public Governance, Performance and Accountability Act 2013 and other relevant legislation.

Legal classification tags

Area of Law
Commercial Law
Technology Law
Instrument
Legislative Instrument
Concepts
Definitions & Interpretation
Commencement Provisions
Regulatory Standards
Reporting & Disclosure Obligations

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.