Critical Infrastructure Protection Act, 2019 (Act No. 8 of 2019)Chapter 3 : Declaration as Critical Infrastructure and Determination of Critical Infrastructure Complex17. Application for declaration as critical infrastructure and critical infrastructure complex by person in control of infrastructure |
| (1) | A person in control of infrastructure may, in the prescribed manner and format, lodge with the National Commissioner an application to have such infrastructure declared as critical infrastructure in terms of this Chapter. |
| (2) | An application for declaration of infrastructure as critical infrastructure must contain the following information— |
| (a) | the sector in which the primary functions of such an infrastructure take place; |
| (b) | the resources available to the person in control of the infrastructure to— |
| (i) | safeguard such an infrastructure against destruction, disruption, failure or degradation; |
| (ii) | repair or replace such infrastructure, including its equipment, materials or service; or |
| (iii) | ensure that the infrastructure recovers from any destruction, disruption, failure or degradation; |
| (c) | the effects or the risk of a destruction, disruption, failure or degradation of such an infrastructure on— |
| (i) | the environment; |
| (ii) | the health or safety of the public or any segment of the public; |
| (iii) | the Republic’s ability to function, deliver basic public services or maintain law and order; and |
| (iv) | any other infrastructure that may negatively affect the functions and functioning of the infrastructure in question; |
| (d) | the size and location of any population at risk; |
| (e) | historic incidents of— |
| (i) | threats against the infrastructure; and |
| (ii) | destruction, failure or degradation of such infrastructure; |
| (f) | the level of risk or threats to which such an infrastructure is exposed or potentially exposed; |
| (g) | special characteristics or attributes of such an infrastructure to deal with any threat contemplated in paragraph (f); |
| (h) | the extent to which the declaration as critical infrastructure will promote the interests of the public; and |
| (i) | any other information which may, from time to time, be determined by the Minister by notice in the Gazette, after consultation with the Critical Infrastructure Council. |
| (3) | In the event that a government department or an organ of state has functional control over the sector in which the activities of the infrastructure falls, the application must further contain— |
| (a) | a submission by the head of the government department or head of an organ of state who has functional control over the sector in which the activities of the infrastructure falls to support the application; and |
| (b) | particulars of any— |
| (i) | person other than the applicant who has a right or interest in the infrastructure in question; |
| (ii) | agreement with a person contemplated in subparagraph (i) regarding the application for declaration as critical infrastructure; |
| (iii) | person other than the applicant who will be responsible for the costs of securing the infrastructure in question; |
| (iv) | agreement with a person contemplated in subparagraph (iii) regarding the costs of securing the infrastructure in question; and |
| (c) | any other relevant information which is, in the opinion of the applicant, necessary for the proper consideration of the application. |
| (4) | Subject to subsection (5), the National Commissioner must— |
| (a) | upon receipt of an application, publish a notice of the application in the Gazette— |
| (i) | stating the name of the applicant and the address of the premises in respect of which the application is made; and |
| (ii) | inviting interested persons to submit written comments in relation to the application; |
| (b) | within 30 days of receipt of an application conduct a physical security assessment of the infrastructure in order to— |
| (i) | verify the information in the application; |
| (ii) | assess the risk category in which such infrastructure or parts thereof may be categorised; |
| (iii) | confirm whether the physical security measures proposed by the person in control of the infrastructure comply with the prescribed measures and standards for the protection of the infrastructure; |
| (iv) | provide the person in control of that infrastructure with an opportunity to make written submissions regarding the physical security assessment which is conducted in terms of this subsection; and |
| (c) | within 60 days after the physical security assessment has been conducted or the submissions contemplated in paragraph (b)(iv) are received, whichever occurs last, submit to the Council for consideration— |
| (i) | the written physical security assessment report together with the application; |
| (ii) | any comments contemplated in paragraph (a)(ii); and |
| (iii) | any written submissions in terms of paragraph (b)(iv). |
| (5) | In the event that the applicant shows good cause why the procedure in subsection (4)(a) should not be followed, the National Commissioner must refer the request to the Council who may dispense with the publication as referred to in subsection (4)(a) after considering the factors in subsection (6). |
| (6) | For purposes of subsections (4) and (5), the applicant must show that a departure from the procedure in subsection (4)(a) is reasonable and justifiable in the circumstances, taking into account all relevant factors, including— |
| (a) | the objects of declaration as critical infrastructure; |
| (b) | the nature, purpose and likely effect of the declaration as critical infrastructure; |
| (c) | the nature and the extent of the departure from subsection (4)(a); |
| (d) | the relation between the departure and its purpose; |
| (e) | the importance of the purpose of the departure; and |
| (f) | the need to promote an efficient administration and good governance. |
| (7) | In the event that the Council decides that the process contemplated in subsection (4)(a)— |
| (a) | must be followed, the Council must direct the National Commissioner to publish the notice contemplated in subsection (4)(a) with directions on the information that must be contained in the notice, whereafter the National Commissioner will deal with the application; or |
| (b) | may be departed from, the Council must direct the National Commissioner to depart from the provisions of subsection (4)(a) and proceed to deal with the application. |
| (8) | The National Commissioner may request the Head of a Government department which is a security service established under section 199 of the Constitution, to designate a suitably experienced member of that security service to assist with the physical security assessment contemplated in subsection (4)(b), when required. |
| (9) | If the infrastructure relevant to the application consists of multiple structures, services or facilities, the person in control of those infrastructures must apply for declaration in respect of all such infrastructure as critical infrastructure. |
| (10) | Where the National Commissioner is unable to comply with any of the timeframes contemplated in subsection (4), the National Commissioner must, in writing, apply to the Council in the prescribed form and manner for an extension not exceeding 30 days or such other period as the Council may determine. |
| (11) | Where an extension of time is granted as contemplated in subsection (10), the Council must inform the applicant referred to in subsection (1) in writing of such extension. |