Security of Critical Infrastructure Act 2018 (SOCI) s30AG: Give the board-approved annual CIRMP report within 90 days of year end

Within 90 days after the end of each financial year in which it was responsible for assets with a program, the entity must give the relevant Commonwealth regulator (if one has security functions for those assets) or otherwise the Secretary a report in the approved form stating whether the program was up to date at year end; for any hazard that had a significant relevant impact, identifying it, evaluating the program's effectiveness in mitigating it and outlining any resulting variation; for critical telecommunications assets, summarising changes notified under s 30EC, risks advised under s 30ED and measures adopted with an evaluation of their effectiveness; and for any s 30AI direction, its content and the variation made. If the entity has a board, council or other governing body, that body must approve the report. The report is not admissible against the entity in civil penalty proceedings.