Chapter 3: Declaration as Critical Infrastructure and Determination

Medupi Power Station, Lephalale. Photo: Bruce Paulmac, CC BY-SA 3.0, via Wikimedia Commons.

Chapter 3 sets out the actual declaration process: how an application is made, how the National Commissioner and Critical Infrastructure Council assess it, and how the Minister ultimately declares infrastructure — and assigns it a risk category — as critical infrastructure. National Key Points carried over from the old regime, including major generation sites such as Majuba Power Station, are processed through this same declaration and risk-categorisation framework.

Full Text: Chapter 3

OF CRITICAL INFRASTRUCTURE COMPLEX Requirements for declaration of infrastructure as critical infrastructure

Section 16

(1) Infrastructure qualifies for declaration as critical infrastructure, if— (a) the functioning of such infrastructure is essential for the economy, national security, public safety and the continuous provision of basic public services; and (b) the loss, damage, disruption or immobilisation of such infrastructure may severely prejudice— (i) the functioning or stability of the Republic; (ii) the public interest with regard to safety and the maintenance of law and order; and (iii) national security.

(2) In determining whether the qualifying requirements contemplated in subsection (1) are met, one or more of the following criteria must be applied: (a) the infrastructure must be of significant economic, public, social or strategic importance; (b) the Republic's ability to function, deliver basic public services or maintain law and order may be affected if a service rendered by the infrastructure is interrupted, or if the infrastructure is destroyed, disrupted, degraded or caused to fail; (c) interruption of a service rendered by the infrastructure, or the destruction, disruption, degradation, or failure of such infrastructure will have a significant effect on the environment, the health or safety of the public or any segment of the public, or any other infrastructure that may negatively affect the functions and functioning of the infrastructure in question; (d) there are reasonable grounds to believe that the declaration as critical infrastructure will not have a significantly negative effect on the interests of the public; (e) the declaration as critical infrastructure is in pursuance of an obligation under any binding international law or international instrument; and (f) any other criteria which may, from time to time, be determined by the Minister by notice in the Gazette, after consultation with the Critical Infrastructure Council. Application for declaration as critical infrastructure and critical infrastructure complex by person in control of infrastructure

Section 17

(1) A person in control of infrastructure may, in the prescribed manner and format, lodge with the National Commissioner an application to have such infrastructure declared as critical infrastructure in terms of this Chapter.

(2) An application for declaration of infrastructure as critical infrastructure must contain the following information— (a) the sector in which the primary functions of such an infrastructure take place; (b) the resources available to the person in control of the infrastructure to— (i) safeguard such an infrastructure against destruction, disruption, failure or degradation; (ii) repair or replace such infrastructure, including its equipment, materials or service; or (iii) ensure that the infrastructure recovers from any destruction, disruption, failure or degradation; (c) the effects or the risk of a destruction, disruption, failure or degradation of such an infrastructure on— (i) the environment; (ii) the health or safety of the public or any segment of the public; (iii) the Republic's ability to function, deliver basic public services or maintain law and order; and (iv) any other infrastructure that may negatively affect the functions and functioning of the infrastructure in question; (d) the size and location of any population at risk; (e) historic incidents of— (i) threats against the infrastructure; and (ii) destruction, failure or degradation of such infrastructure; (f) the level of risk or threats to which such an infrastructure is exposed or potentially exposed; (g) special characteristics or attributes of such an infrastructure to deal with any threat contemplated in paragraph (f); (h) the extent to which the declaration as critical infrastructure will promote the interests of the public; and (i) any other information which may, from time to time, be determined by the Minister by notice in the Gazette, after consultation with the Critical Infrastructure Council.

(3) In the event that a government department or an organ of state has functional control over the sector in which the activities of the infrastructure falls, the application must further contain— (a) a submission by the head of the government department or head of an organ of state who has functional control over the sector in which the activities of the infrastructure falls to support the application; and (b) particulars of any— (i) person other than the applicant who has a right or interest in the infrastructure in question; (ii) agreement with a person contemplated in subparagraph (i) regarding the application for declaration as critical infrastructure; (iii) person other than the applicant who will be responsible for the costs of securing the infrastructure in question; (iv) agreement with a person contemplated in subparagraph (iii) regarding the costs of securing the infrastructure in question; and (c) any other relevant information which is, in the opinion of the applicant, necessary for the proper consideration of the application.

(4) Subject to subsection (5), the National Commissioner must— (a) upon receipt of an application, publish a notice of the application in the Gazette— (i) stating the name of the applicant and the address of the premises in respect of which the application is made; and (ii) inviting interested persons to submit written comments in relation to the application; (b) within 30 days of receipt of an application conduct a physical security assessment of the infrastructure in order to— (i) verify the information in the application; (ii) assess the risk category in which such infrastructure or parts thereof may be categorised; (iii) confirm whether the physical security measures proposed by the person in control of the infrastructure comply with the prescribed measures and standards for the protection of the infrastructure; (iv) provide the person in control of that infrastructure with an opportunity to make written submissions regarding the physical security assessment which is conducted in terms of this subsection; and (c) within 60 days after the physical security assessment has been conducted or the submissions contemplated in paragraph (b)(iv) are received, whichever occurs last, submit to the Council for consideration— (i) the written physical security assessment report together with the application; (ii) any comments contemplated in paragraph (a)(ii); and (iii) any written submissions in terms of paragraph (b)(iv).

(5) In the event that the applicant shows good cause why the procedure in subsection (4)(a) should not be followed, the National Commissioner must refer the request to the Council who may dispense with the publication as referred to in subsection (4)(a) after considering the factors in subsection (6).

(6) For purposes of subsections (4) and (5), the applicant must show that a departure from the procedure in subsection (4)(a) is reasonable and justifiable in the circum- stances, taking into account all relevant factors, including— (a) the objects of declaration as critical infrastructure; (b) the nature, purpose and likely effect of the declaration as critical infrastruc- ture; (c) the nature and the extent of the departure from subsection (4)(a); (d) the relation between the departure and its purpose; (e) the importance of the purpose of the departure; and (f) the need to promote an efficient administration and good governance.

(7) In the event that the Council decides that the process contemplated in subsection (4)(a)— (a) must be followed, the Council must direct the National Commissioner to publish the notice contemplated in subsection (4)(a) with directions on the information that must be contained in the notice, whereafter the National Commissioner will deal with the application; or (b) may be departed from, the Council must direct the National Commissioner to depart from the provisions of subsection (4)(a) and proceed to deal with the application.

(8) The National Commissioner may request the Head of a Government department which is a security service established under section 199 of the Constitution, to designate a suitably experienced member of that security service to assist with the physical security assessment contemplated in subsection (4)(b), when required.

(9) If the infrastructure relevant to the application consists of multiple structures, services or facilities, the person in control of those infrastructures must apply for declaration in respect of all such infrastructure as critical infrastructure.

(10) Where the National Commissioner is unable to comply with any of the timeframes contemplated in subsection (4), the National Commissioner must, in writing, apply to the Council in the prescribed form and manner for an extension not exceeding 30 days or such other period as the Council may determine.

(11) Where an extension of time is granted as contemplated in subsection (10), the Council must inform the applicant referred to in subsection (1) in writing of such extension. Application for declaration as critical infrastructure and critical infrastructure complex by National Commissioner

Section 18

(1) Where the National Commissioner identifies for possible declaration as critical infrastructure— (a) any infrastructure under the control of or occupied by a local or provincial government department, he or she must advise the relevant municipal manager or the relevant head of the department in the province to lodge an application in terms of section 17; and (b) government infrastructure, he or she must lodge an application in accordance with subsection (2).

(2) Where the National Commissioner makes an application for the declaration of government infrastructure as critical infrastructure, the application must, subject to subsection (3), be made in the prescribed form and manner and submitted to the Critical Infrastructure Council for consideration.

(3) Before the National Commissioner makes an application referred to in subsection (1)(b), the National Commissioner must— (a) notify the relevant head of a Government department who is the person in control of the infrastructure, in the prescribed form and manner, of the intention of the National Commissioner; (b) afford the person referred to in paragraph (a) an opportunity to submit written representations within 60 days on any aspect relating to the intended application; (c) consider the representations referred to in paragraph (b); and (d) within seven days of taking a decision on whether or not to proceed with the application, notify the person referred to in paragraph (a) in writing of such decision and his or her reasons.

(4) In the event that the National Commissioner decides to proceed with the application, he or she must ensure that the written representations referred to in subsection (3)(b) as well as his or her written reasons referred to in subsection (3)(d) forms part of the application that is submitted to the Council. Consideration of application for declaration as critical infrastructure by Critical Infrastructure Council

Section 19

(1) Upon receiving an application for declaration of infrastructure as critical infrastructure, the Critical Infrastructure Council must— (a) apply the criteria referred to in section 16(2) in order to determine whether such an application demonstrates that the infrastructure in question qualifies under section 16(1) for declaration as critical infrastructure; (b) consider the potential risk category of such an infrastructure, taking into account— (i) the prescribed system of categorising infrastructure in a low-risk, medium-risk or high-risk category; (ii) the probability of failure, disruption or destruction of the infrastructure in question or threat thereof; and (iii) the impact and consequence of failure, disruption or destruction of infrastructure or threat thereof; (c) consider the extent to which the declaration as critical infrastructure will promote the interests of the public; (d) consider any prescribed guidelines for the identification and declaration of infrastructure as critical infrastructure; and (e) take into account any other criteria contemplated in section 16(2)(f).

(2) The Critical Infrastructure Council must, after performing the functions in subsection (1), make recommendations to the Minister on— (a) whether or not the infrastructure in question qualifies to be declared as critical infrastructure; and (b) an appropriate risk categorisation for the infrastructure.

(3) Before the Council makes a recommendation to the Minister to declare or not to declare the infrastructure as critical infrastructure, the Council must— (a) notify the person in control of that critical infrastructure of such intended recommendation and the reasons for such recommendation; and (b) afford the person in control of that infrastructure a period of no less than 30 days to make representations.

(4) The Council must consider any representations received in terms of subsection (3) before making a recommendation to the Minister on whether or not to declare the infrastructure as critical infrastructure.

(5) Subject to subsection (3), the Council must within seven days of its last meeting submit the application and its recommendations to the Minister for a decision within 30 days of receipt thereof.

(6) Where the Council is unable to comply with the timeframes as contemplated in subsection (5), the Council must, in writing, request the Minister for an extension not exceeding 30 days or such other period as the Minister may determine.

(7) Where an extension of time is granted as contemplated in subsection (6), the Council must inform the applicant referred to in section 17(1) in writing of such extension. Powers of Minister to declare infrastructure as critical infrastructure

Section 20

(1) Subject to subsection (2), the Minister may, on recommendation of the Critical Infrastructure Council— (a) declare infrastructure as critical infrastructure after considering— (i) whether the application complies with the requirements contemplated in section 16(1); (ii) the recommendation of the Critical Infrastructure Council; and (iii) any other information which the Minister deems reasonable and appropriate; (b) categorise critical infrastructure or certain parts of such critical infrastructure that is declared in terms of paragraph (a) in either a low-risk, medium-risk or high-risk category, as may be prescribed; (c) where it is necessary to achieve the objects of this Act, determine that critical infrastructure is part of a critical infrastructure complex; and (d) impose such conditions as may be prescribed regarding any steps and measures the person in control of the critical infrastructure must implement to safeguard the critical infrastructure in question.

(2) The Minister must notify the Council, the National Commissioner and the person in control of that critical infrastructure of— (a) the declaration of the infrastructure as a critical infrastructure; (b) the risk category of such declaration; (c) the conditions contemplated in subsection (1)(d); (d) any implications of the Income Tax Act, 1962 (Act No. 58 of 1962); and (e) the period within which the person in control of that critical infrastructure must take the steps contemplated in section 24(1).

(3) When infrastructure has been declared as critical infrastructure, the Minister may, in consultation with the person in control of the infrastructure, taking into account the probability of compromising the security of the critical infrastructure in question, determine that the publication of information regarding some security measures which must be implemented at such critical infrastructure, be restricted. Certificate of declaration as critical infrastructure

Section 21

(1) Where an infrastructure is declared a critical infrastructure, the Minister must issue a certificate of declaration, in the prescribed form and manner, to the person in control of that critical infrastructure, setting out— (a) the risk categorisation as determined by the Minister; (b) the premises or complex where the critical infrastructure is located; (c) the conditions which the Minister may deem necessary to impose for purposes of securing the critical infrastructure; and (d) whether information regarding security measures will be restricted.

(2) The Minister must issue a certificate for each of the premises on which any such critical infrastructure, forming part of a complex, is located.

(3) The certificate must be issued in the designation of the person in control of that critical infrastructure.

(4) Declaration as critical infrastructure does not exempt a person in control of critical infrastructure from having to comply with the provisions of any other law applicable to the critical infrastructure in question.

(5) The National Commissioner must enter the particulars of any declaration as critical infrastructure or the termination of such declaration, into the prescribed register, which must be accessible to the public in the prescribed manner or form.

(6) The Minister must, by notice in the Gazette, publish such particulars as may be prescribed regarding infrastructure which has been declared as critical infrastructure and when such declaration is terminated. Amendment or variation of information or conditions by Minister

Section 22

(1) If there is a change in the circumstances of any critical infrastructure, the Minister may, on the recommendation of the Critical Infrastructure Council or upon a request in writing by the person in control of a critical infrastructure or the National Commissioner— (a) amend the risk categorisation determined in terms of section 20(1)(b); or (b) vary any or all of the information or conditions on a certificate of declaration as critical infrastructure referred to in section 21.

(2) Before acting on the advice or the request contemplated in subsection (1) to amend or vary the risk categorisation, or any of the information or conditions, the Minister must give the person in control of the critical infrastructure— (a) written notice of his or her intention to amend or vary the risk categorisation, information or conditions on the certificate of declaration as critical infrastructure; and (b) no less than 30 days to submit written representations to the Minister as to why the Minister must not amend or vary the risk categorisation, information or conditions on the certificate of declaration.

(3) The Minister must consider the written representations referred to in subsection (2)(b) and notify the person in control of the critical infrastructure in writing— (a) of any decision taken under this section; (b) the reasons for the decision; and (c) the date on which the decision takes effect. Termination and revocation of declaration

Section 23

(1) A declaration as critical infrastructure in terms of this Chapter terminates— (a) where the person in control of a critical infrastructure ceases the activities which formed the basis upon which the Minister declared the infrastructure as a critical infrastructure; or (b) upon revocation in terms of subsection (4).

(2) The person in control of a critical infrastructure must notify the National Commissioner in writing within 30 days if— (a) there is any change with regard to any information that was submitted in respect of the application for declaration as a critical infrastructure; (b) there is a change in the control or ownership of the critical infrastructure; or (c) there is any change that impacts on the ability of the critical infrastructure or the person in control of a critical infrastructure to comply with all or any of the obligations under this Act.

(3) The National Commissioner may, after having considered any notification contemplated in subsection (2), recommend to the Minister to revoke the declaration as critical infrastructure if— (a) there is any change contemplated in subsection (2); (b) the infrastructure in question was declared as critical infrastructure on the basis of incorrect or false information; or (c) the person in control of the critical infrastructure fails to comply with any— (i) condition of declaration; or (ii) of the provisions of this Act.

(4) The Minister may, after having considered the recommendation of the National Commissioner, revoke the declaration as critical infrastructure based on any factor referred to in subsection (3).

(5) Before revoking the declaration as critical infrastructure in terms of subsection (4), the Minister must— (a) give the person in control of that critical infrastructure written notice of the intention to revoke; (b) give the person in control of that critical infrastructure an opportunity to submit written representations within a period of 30 days as to why the declaration as critical infrastructure must not be revoked; and (c) duly consider any such representations and the facts pertaining to the matter.

(6) (a) The Minister must notify the person in control of that critical infrastructure, in writing, of any decision taken under this section and, if the declaration is revoked, state the reasons for the revocation and the date on which the revocation takes effect, in such notice. (b) A notification contemplated in paragraph (a) must be served on the person in control of the critical infrastructure by a police official, in the prescribed manner.

(7) In the event where a declaration as a critical infrastructure is revoked as contemplated in subsection (4), the person in control of that critical infrastructure must— (a) hand all certificates relating to such declaration to the police official serving the notice contemplated in subsection (6) immediately upon such service; or (b) return all certificates to the Minister in the event of a termination contemplated in subsection (1)(a), within seven days after termination.

(8) The police official referred to in subsection (6)(b) must deliver the certificates contemplated in subsection (7)(a) to the Minister.