Chapter 2: Critical Infrastructure Council and Structures

Kendal Power Station, Mpumalanga. Photo: Bruce Paulmac, CC BY-SA 3.0, via Wikimedia Commons.

Chapter 2 establishes the Critical Infrastructure Council — the body responsible for recommending which sites, from major power stations like Kendal and Medupi to ports, pipelines and data infrastructure, should be declared and protected as critical infrastructure. This chapter sets out the Council's composition, its functions, delegation of powers, and its reporting obligations to the Minister.

Full Text: Chapter 2

Part A Critical Infrastructure Council Establishment and composition of Critical Infrastructure Council

Section 4

(1) A Critical Infrastructure Council is hereby established.

(2) The Minister appoints members of the Critical Infrastructure Council which must consist of the following persons: (a) The Secretary for the Police Service; (b) an official at the level of at least Chief Director or an equivalent level, designated by each of the heads of the following institutions— (i) Department of Defence; (ii) Department of Home Affairs; (iii) Department of Public Works; (iv) National Disaster Management Centre; (v) South African Local Government Association; (vi) South African Police Service; and (vii) State Security Agency; and (c) five members appointed in terms of subsection (8) from the private sector and civil society who are— (i) not disqualified in terms of section 5; and (ii) preferably appropriately qualified, knowledgeable and experienced in fields that include critical infrastructure protection, risk management, disaster management or basic public services which must include at least one person who is appropriately qualified in cybersecurity.

(3) The members of the Council must, when viewed collectively, preferably be persons who are suited to serve in the Council by virtue of their qualifications, expertise and experience in fields that include infrastructure protection, engineering, disaster management or security policy.

(4) In the event that— (a) the functions or functioning of infrastructure that forms the subject of an application for declaration as critical infrastructure may affect or be affected by the functional area of responsibility of a government department or an organ of state not referred to in subsection (2)(b), the Chairperson may request the Head of that Government department or the head of that organ of state to designate an appropriately qualified official to assist with such application; or (b) the Council is of the opinion that any other person could assist in general or with a specific application for declaration as critical infrastructure, the Council may request the Minister to appoint such person on an ad hoc basis to advise or assist the Council.

(5) The Minister must appoint— (a) officials referred to in subsection (2)(b) after consultation with the Cabinet member responsible for the institution in question; (b) members referred to in subsection (2)(c) in terms of subsection (8); and (c) persons referred to in subsection (4)(b) on advice of the Council.

(6) In the event that it is necessary to appoint a member referred to in subsection 2(c), the Minister must request the National Assembly to submit a list of candidates for appointment.

(7) The Speaker must refer the matter to the relevant committee of the National Assembly to— (a) publish a notice in the Gazette and in at least two national newspapers circulating in the Republic, inviting applications from interested persons and members of the public to nominate persons; (b) compile a shortlist of not less than 20 persons who are not disqualified in terms of section 5(a), (c), (d), (e), (f) or (g), from the applications and nominations referred to in paragraph (a) or persons serving on the Council who qualify for a further appointment in terms of subsection (10) ; (c) submit the list referred to in paragraph (b) to the State Security Agency for consideration and issuing of a top secret security clearance; (d) conduct interviews with the persons referred to in paragraph (b) who are not disqualified in terms of section 5(b) for purposes of compiling a list of 10 recommended candidates in order of preference; (e) submit the list of names referred to in paragraph (d) to the National Assembly for approval; and (f) submit the approved list of names contemplated in paragraph (e) together with their résumés to the Minister.

(8) The Minister must appoint five members to the Council from the list referred to in subsection (7)(f) and publish the names of the members in the Gazette.

(9) Subject to subsection (12), a member of the Council appointed in terms of subsection (8) holds office for a period not exceeding five years.

(10) Upon the expiry of an appointed member's first term of office as contemplated in subsection (9), the member may be re-appointed for one further term only.

(11) The Secretary for the Police Service is the Chairperson of the Council and the Minister must designate, from the persons contemplated in subsection (2)(c), a member as deputy chairperson.

(12) A member of the Council appointed in terms of subsection (8) must vacate office if that member— (a) resigns by giving at least 30 days written notice addressed to the Minister; or (b) is removed from office by the Minister as contemplated in subsection (14).

(13) If a member of the Council appointed in terms of subsection (8) resigns or vacates office before the expiry of his or her period of office, the Minister must request the NationalAssembly to follow the procedure in subsection (7): Provided that the Minister may appoint a new member from the list contemplated in subsection (7)(d) where candidates on that list are still available for appointment.

(14) The Minister may, after due process by the National Assembly, remove a member of the Council appointed in terms of subsection (8) from office on account of— (a) absence from three consecutive meetings without good cause; (b) misconduct, incapacity or incompetence; (c) becoming disqualified as contemplated in section 5; or (d) any other lawful reason.

(15) The Minister may suspend a member where there are reasonable grounds to do so, until the process contemplated in subsection (14) is finalised.

(16) The Minister may request the Cabinet member responsible for an institution which is represented on the Council, as contemplated in subsection (2)(b), to nominate another representative for appointment to substitute the institution's representative in the Council.

(17) Members of the Council who are appointed in terms of subsection (8) may be paid such remuneration and allowances as the Minister may, with the written concurrence of the Minister of Finance, determine.

(18) The deputy chairperson referred to in subsection (11) must, when the chairperson is absent or unable to perform his or her duties, act in his or her stead and when so acting, exercise or perform any function of the chairperson. Disqualification from appointment as member of Critical Infrastructure Council 5. A person is disqualified from being appointed or continuing to serve as a member of the Critical Infrastructure Council contemplated in section 4(2)(b) and (c), if he or she— (a) is not a South African citizen; (b) does not have a valid top secret security clearance certificate issued to him or her by the State Security Agency; (c) is an unrehabilitated insolvent; (d) has, in the preceding 20 years, been sentenced in the Republic or elsewhere, to imprisonment without the option of a fine; (e) has a direct or indirect financial or personal interest in any critical infrastructure; (f) has been removed from an office of trust; or (g) is by virtue of any other law, disqualified from being appointed. Funding and remuneration 6. The expenses incurred in connection with the exercise of the powers, the carrying out of the duties and the performance of the functions of the Critical Infrastructure Council, including the remuneration and expenses contemplated in section 4(17), must be defrayed from the budget allocation of the Civilian Secretariat for the Police Service, established in terms of section 4(1) of the Civilian Secretariat for Police Service Act, 2011 (Act No. 2 of 2011), as voted in terms of the annual Division of Revenue Act. Functions of Critical Infrastructure Council

Section 7

(1) The functions of the Critical Infrastructure Council are to— (a) subject to subsection (2), consider any application for declaration of infrastructure as critical infrastructure referred to in Chapter 3 and make recommendations on such application to the Minister; (b) subject to subsection (3), approve guidelines regarding— (i) the assessment of an application contemplated in section 17; (ii) the implementation of the prescribed system for categorisation of critical infrastructure in a low-risk, medium-risk or high-risk category referred to in sections 19(1)(b) and 20(1)(b); (iii) policies, protocols and standards regarding any matter necessary to achieve the purpose of this Act; and (iv) the promotion of public-private sector cooperation in the protection of critical infrastructure; and (c) perform any other functions which may be assigned to the Council by the Minister.

(2) When making a recommendation to the Minister on an application referred to in subsection (1)(a), the Council must consider the following before making such a recommendation— (a) The requirements referred to in section 16(1); (b) any criteria contemplated in section 16(2); (c) any report or submission that must accompany such application; (d) an appropriate risk categorisation of the infrastructure in question in accordance with the prescribed system of categorisation referred to in sections 19(1)(b) and 20(1)(b); and (e) any conditions for such declaration as contemplated in section 21(1)(c).

(3) When approving guidelines referred to in subsection (1)(b), the Council must consider the following: (a) any submission by the National Commissioner as contemplated in section 9(2) ; (b) any relevant submission by any other person having an interest in the protection of critical infrastructure; (c) any budgetary implications related to critical infrastructure protection; (d) any other matter that may promote the purpose of this Act or affect the implementation thereof.

(4) The guidelines referred to in subsection (1)(b) must include guidelines regarding— (a) the identification and management of risks relating to critical infrastructure; (b) the establishment and maintenance of a legitimate, effective and transparent process for identifying and declaring infrastructure as critical infrastructure; and (c) the procedures to coordinate the functions and activities of Government departments and the private sector insofar as those functions and activities are performed to achieve the purpose of this Act.

(5) In addition to any function contemplated in this section, the Council may— (a) advise the Minister on the evaluation, monitoring and reviewing of the implementation of policy, protocols, standards and legislation related to the protection of critical infrastructure; and (b) make recommendations to the Minister on any function of the Minister contemplated in section 22 or section 23.

(6) The Council must, on a bi-annual basis, submit a report to the Minister regarding— (a) the activities of the Council during the period preceding the report; (b) particulars pertaining to the number of declarations as critical infrastructure, including the names of the critical infrastructure; (c) particulars pertaining to any decision by the Council to depart from publication of the notice contemplated in section 17(7)(b); (d) particulars pertaining to any limitations or revocation as critical infrastruc- ture; (e) the level and extent of public-private sector cooperation; and (f) any other matter that may impact on the protection of critical infrastructure or the functioning of the Council. Meetings of Critical Infrastructure Council

Section 8

(1) The Critical Infrastructure Council must meet at least quarterly.

(2) The Secretary for the Police Service must ensure that secretarial services are provided to the Critical Infrastructure Council.

(3) The chairperson may at any time convene a special meeting of the Council and must also convene such a meeting at the written request of the Minister.

(4) If at least three members of the Council request a special meeting in writing, the chairperson must convene such a meeting within seven days after receiving the request.

(5) Seven members of the Council, which must include the chairperson or deputy chairperson, will constitute a quorum at any meeting of the Council.

(6) Decisions of the Council must be taken by majority of votes, and in the case of an equality of votes the chairperson has a casting vote in addition to his or her deliberative vote. Part B Administration of Act Functions of National Commissioner

Section 9

(1) The National Commissioner must— (a) establish and maintain the administrative systems and procedures necessary for the implementation and enforcement of this Act; (b) support the Critical Infrastructure Council and the Minister in the administra- tion of this Act; and (c) effect cooperation between the South African Police Service, other organs of state and the private sector insofar as it relates to the protection of critical infrastructure.

(2) The functions of the National Commissioner are to develop uniform standards, guidelines and protocols for approval by the Council regarding— (a) the manner in which— (i) infrastructure must be identified, categorised and declared critical infrastructure; (ii) any physical security assessment of critical infrastructure and potential critical infrastructure is conducted and coordinated between Government departments; (iii) information which may be relevant to critical infrastructure protection is shared between the relevant stakeholders; or (iv) any prescribed committee or forum must function and report; and (b) structures and mechanisms to facilitate coordination in, and management of, the protection of critical infrastructure.

(3) The National Commissioner must— (a) consider an application from a person in control of an infrastructure for declaring that infrastructure as critical infrastructure; (b) conduct or facilitate any physical security assessment of critical infrastructure or potential critical infrastructure; (c) make recommendations to the Council on the declaration and risk categorisation of such critical infrastructure or potential critical infrastructure; (d) evaluate, monitor and review the application and operational effectiveness of policy, guidelines or legislation related to the protection of critical infrastruc- ture, and advise the Council accordingly; (e) evaluate and review physical security assessments, resilience reports and any designation as critical infrastructure, and advise the Council accordingly; (f) consider any draft of a prescribed security policy or plan submitted to his or her office; (g) issue directives regarding the procedures to be followed at the meetings of any prescribed committee or forum; and (h) compile and submit quarterly reports to the Council, which must at least include— (i) particulars of the related activities of the South African Police Service during the preceding quarter; (ii) particulars of the number of applications for declaration of infrastructure as critical infrastructure; (iii) particulars of the level and extent of Government department participa- tion in the functioning of a committee or forum; and (iv) the level and extent of public-private sector cooperation in the functioning of a committee or forum.

(4) The National Commissioner may, in the prescribed manner, apply for the declaration of government infrastructure as critical infrastructure. Designation of inspectors

Section 10

(1) The National Commissioner may designate police officials who are in possession of an appropriate security clearance certificate, experienced in infrastructure protection, on at least the rank level of a warrant officer, as inspectors.

(2) The National Commissioner must issue each inspector designated in terms of subsection (1) with a certificate in the prescribed form, stating that the police official has been designated as an inspector in terms of this Act. Functions of inspectors

Section 11

(1) An inspector may, at any reasonable time, conduct an inspection at a critical infrastructure to— (a) verify whether the person in control of that critical infrastructure took the steps to secure the critical infrastructure contemplated in section 24(1); (b) verify any information relating to the declaration as critical infrastructure as well as the physical security assessment report contemplated in section 17(4)(c)(i) or any other subsequent physical security assessment; (c) review the physical security assessment and evaluate the status of the physical security of the critical infrastructure; (d) verify compliance with this Act; and (e) compile a report on the matters referred to in paragraphs (a) to (d) for the National Commissioner and the person in control of the critical infrastructure.

(2) An inspector must— (a) preserve, or aid in preserving, confidentiality with regard to all matters concerning the operational activities of the critical infrastructure that may come to his or her knowledge in the performance of his or her duties and may not communicate any such matter to any person except the National Commissioner, or unless a court of law orders such communication, or insofar as such communication is necessary to properly carry out the inspection; (b) carry out his or her duties and exercise his or her powers— (i) subject to any prescribed procedure; (ii) in accordance with any directives issued by the Minister; (iii) in a manner that does not hamper or endanger the operational activities of the critical infrastructure where an inspection is being conducted; and (iv) with strict regard to decency and order.

(3) Where the person in control of a critical infrastructure fails or refuses to allow an inspector access to the critical infrastructure concerned, the inspector may issue the prescribed compliance notice in the prescribed manner to the person in control of the critical infrastructure, requiring of that person to provide the inspector with access to the critical infrastructure within seven days, for the purpose of conducting the inspection.

(4) If an inspector has reasonable grounds to believe that any method or practice of safeguarding or securing the critical infrastructure in question or any failure or refusal to comply with this Act, may negatively affect the physical security measures of that critical infrastructure, the inspector may, by written notice in the prescribed form and manner, order the person in control of that critical infrastructure to take, within a period specified in the notice, such steps in respect of the security of the critical infrastructure as may be specified in the notice.

(5) Despite subsection (4), the Minister may take or cause steps to be taken in respect of the security of any critical infrastructure, when credible information on oath is brought to his or her attention to the effect that— (a) the person in control of critical infrastructure fails or refuses to— (i) comply with the provisions of this Act; or (ii) take the steps contemplated in the notice referred to in subsection (4); (b) the failure or refusal contemplated in paragraph (a) creates a substantial risk that the critical infrastructure in question cannot be secured in the event of a threat; and (c) in the event of a threat, a failure to secure the critical infrastructure in question is likely to cause an imminent disruption of— (i) the functioning or stability of the economy of the Republic; (ii) the maintenance of law and order; (iii) the provision of basic public services; or (iv) national security.

(6) Despite the power of the Minister to take or cause steps to be taken in respect of the security of any critical infrastructure as contemplated in subsection (5), the Minister, when exigent circumstances dictate that the provisions of subsection (3) or (4) be dispensed with, may apply to a court having jurisdiction for— (a) an order compelling the person in control of critical infrastructure— (i) to comply with any provision of this Act or to cease contravening a provision of this Act; (ii) to comply with any notice issued under subsection (3) or take any other reasonable steps necessary to secure the critical infrastructure in question; or (iii) to cease any method or practice of safeguarding or securing the critical infrastructure in question that may cause a serious breach of the physical security measures of that critical infrastructure; or (b) any other order the court considers appropriate.

(7) A notice referred to in subsections (3) and (4) must be given to the person in control of the infrastructure or a person designated by the person in control of the critical infrastructure or, in their absence, the most senior employee available at the critical infrastructure to whom the notice can be issued.

(8) The Minister may, by notice in the Gazette, in consultation with the head of a public entity or statutory body, either generally or subject to such conditions as may be specified in the notice, extend the powers provided for in this section to any competent person employed by a public entity contemplated in section 1 of the Public Finance Management Act, 1999 (Act No. 1 of 1999), or any other statutory body if that person is a peace officer contemplated in section 1(1) of the Criminal Procedure Act, 1977 (Act No. 51 of 1977).

(9) The notice referred to in subsection (8) must set out— (a) the extent to, and the conditions under, which such powers are extended to such person; and (b) the extent to which the directives contemplated in subsection (2)(b)(ii) are applicable to such person in the exercise of such powers.

(10) An inspector, prior to exercising any power in terms of this Chapter, must identify himself or herself to the person in control or the security manager of the critical infrastructure in question and must produce the certificate issued by the National Commissioner referred to in section 10(2). Part C Committees, exemption and delegations Ad hoc and standing committees

Section 12

(1) The National Commissioner may, when he or she deems it necessary or expedient to obtain advice or assistance in order to perform any function contemplated in section 9(2) and (3), establish any ad hoc or standing committee to assist him or her.

(2) A committee established under subsection (1) may establish ad hoc working groups to assist it in the performance of its functions.

(3) Any committee or working group established under subsections (1) and (2) may include persons who are not police officials.

(4) The National Commissioner must designate a police official who is a member of a committee or working group, as chairperson thereof.

(5) A committee is accountable to the National Commissioner.

(6) The advice or assistance contemplated in subsection (1) does not bind the National Commissioner or absolve him or her from his or her responsibility under this Act.

(7) A member of a committee is disqualified from being appointed or continuing to serve as a member of the committee, if he or she— (a) has, in the preceding 20 years, been sentenced in the Republic or elsewhere, to imprisonment without the option of a fine; (b) does not have a valid security clearance certificate issued to him or her by the State Security Agency; (c) is an unrehabilitated insolvent; (d) is not a South African citizen; or (e) is by virtue of any other law disqualified from being appointed. Exemption of certain persons

Section 13

(1) The restrictions on entry contemplated in section 25(2) do not apply in respect of a member of the security services established in terms of section 199 of the Constitution, who is required in the performance of his or her functions and the carrying out of his or her duties, to enter any critical infrastructure.

(2) Section 25(2) must not be interpreted so as to restrict powers of entry assigned by law on any functionary in the employ of an organ of state.

(3) Any member or functionary referred to in subsections (1) or (2) must produce proof of his or her appointment and identity to the satisfaction of the person in control of the critical infrastructure or an appointed security manager. Delegation of powers

Section 14

(1) The Minister may, by notice in the Gazette, delegate any of his or her powers under this Act to the National Commissioner, except— (a) the power conferred on the Minister by sections 11, 22, 23 and 27; and (b) the duty imposed on the Minister by sections 4, 14(2), 15 and 20.

(2) The Minister must regularly review and, if necessary, amend or withdraw a delegation under subsection (1).

(3) A delegation to the National Commissioner under subsection (1)— (a) is subject to such limitation and conditions as the Minister may impose; (b) may authorise the National Commissioner to sub-delegate, in writing, the power or duty to another police official of a rank not less than that of level 13; (c) does not prevent the exercise of that power or the performance of that duty by the Minister; and (d) does not divest the Minister of the responsibility concerning the exercise of the delegated power.

(4) The Minister may confirm, vary or revoke any decision taken by a police official as a result of a delegation or sub-delegation under this section, subject to any rights that may have become vested as a consequence of that decision.

(5) The National Commissioner may, in writing, delegate any function conferred upon him or her by this Act to any police official of a rank not less than that of level 13.

(6) A delegation in terms of subsection (5)— (a) is subject to such limitation and conditions as the National Commissioner may impose; (b) does not prevent the exercise of that power or the performance of that duty by the National Commissioner; and (c) does not divest the National Commissioner of the responsibility concerning the exercise of the delegated power.

(7) The National Commissioner may confirm, vary or revoke any decision taken by a police official as a result of a delegation under this section, subject to any rights that may have become vested as a consequence of that decision. Reporting by Minister 15. The Minister must, on a bi-annual basis, table a report in Parliament on the activities of the Critical Infrastructure Council, substantially corresponding with the format of the report in section 7(6).