Can your board honestly sign that the programme was up to date?
The Security of Critical Infrastructure Act has a board approve, once a year, a statement of whether its risk management programme was up to date at the end of the financial year. Here is why that statement is hard to get right from a view of the programme taken months later, and what a board needs in order to make it honestly and to oversee the programme in between.
Once a year, a board does something it does for almost nothing else in the security programme: it signs its name to it.
Under the Security of Critical Infrastructure Act 2018 (Cth), a responsible entity for a critical infrastructure asset has to maintain a critical infrastructure risk management programme, review it regularly, and give an annual report on it, which its board, council or equivalent governing body has to approve. Within ninety days of the end of the financial year, the entity lodges that report with the relevant regulator, usually the Cyber and Infrastructure Security Centre, and the report states whether the programme was up to date at the end of the financial year. Miss the lodgement and the Act sets a civil penalty of 150 penalty units. For a body corporate the maximum is five times that, 750 units, which runs well into six figures of dollars.
Most of the compliance conversation stops there. Lodge on time, attest, avoid the penalty. But the penalty for not lodging is the least interesting thing in the obligation. The interesting thing is the statement the board approves, that the programme was or was not up to date on 30 June, and whether anyone in the room could see which.
The signature is a point in time. The programme is not.
The board approves the report in, say, September, and the report says the programme was up to date on 30 June. The programme it describes is a fair one: someone competent assembled it, the hazards are named, the controls are described, the review happened. But the programme did not stop on 30 June, and it does not stop when the meeting ends. It does what every programme does: it drifts away from the page that describes it. A supplier the plan leaned on changes its offering. A segmentation control is relaxed to get a release out, on the understanding that someone will revisit it. A role turns over and an access review slips a quarter. Nobody has done anything wrong, and none of it makes the statement false. The statement is about 30 June, and it will say the same thing the following winter as it said on the day of the vote. It says nothing about any day since.
We have written before about the eleven months your certificate isn’t watching: the stretch between one point-in-time assessment and the next, during which the document keeps making its claim and nobody is checking whether the claim still holds. The board attestation is the same shape, except that the board puts its name to it. The board is not asked whether the programme is up to date now. It is asked, once a year, about one date that has already passed, and it sees the programme through a papered summary. The Act separately requires the entity to take all reasonable steps to keep the programme up to date throughout the year, and the statement about 30 June does not show whether it has.
“Up to date” is a state, not a document
The words doing the work in the obligation are up to date at the end of the financial year. They describe a state on a date: the programme as it stood on 30 June, against the hazards as they stood then. But the board approves the statement months later, from papers written for the meeting, and unless those papers rest on records kept from 30 June, they show the programme as it stood when someone wrote them. The gap between those two is not a technicality, and it can mislead in either direction. A programme that had fallen out of date by 30 June and was repaired in August looks current in September, and a board judging from what is in front of it would approve a statement that was not true. A programme that was up to date on 30 June and has drifted since looks worse in September than it was on the date in question, and a board judging the same way might state that it was not. The drift is real and needs dealing with, but it does not make an accurate June statement wrong. The Act provides for either answer: the report states that the programme was up to date, or that it was not. What it asks is that the statement be the right one for 30 June, and a summary of where the programme stands in August, with no record of where it stood in June, cannot show which that is.
The question comes back after the incident
Boards sign these attestations in calm weather. They are read back in a storm. When an incident lands on a critical infrastructure asset, the annual report is one of the first documents pulled, and the board’s approval is read back to the people who now have to account for it: the regulator, the responsible minister’s office, the entity’s own shareholders. The Act keeps the report out of evidence in civil penalty proceedings against the entity under the Act. It does not keep it out of that room. There, “the governing body approved a statement that the programme was up to date” is offered as evidence of diligence, and on its own it carries little weight. The people reading it back ask two things: what showed the programme was up to date on 30 June, and what the board could see of it between then and the incident. A statement with nothing kept behind it answers neither, and the signature meant to demonstrate oversight becomes the record of what the board attested to without being able to see it.
That is the job the board actually has, underneath the lodgement deadline: to be able to survive that question. Not to have signed on time, but to have signed something it could stand behind when it was read back.
What a board can actually sign over
Writing a better annual report does not help, because the quality of the report was never the problem. However well it is drafted, it is a statement about one date, written after that date has passed. What the board needs is two things, and they are easy to run together. To approve the statement, it needs a record of where the programme stood on 30 June, made at the time and kept. A paper written in August can summarise that record, but an account of where the programme stands in August cannot replace it. To oversee the programme between statements, which is what the duty to keep it up to date asks of the entity, it needs a current account of where the programme stands now. The first supports a statement about one date. The second is how the board finds drift while there is still time to act on it.
This is the gap Frank was built for. Every posture Frank publishes is a coverage assertion: a stated posture, against a named scope, with an expiry and the evidence basis it rests on. It says: we stand behind this, for this asset, until this date, on this evidence. Frank keeps every one, including those later withdrawn or replaced, so the postures that stood on 30 June can still be read in September, next to the ones that stand now. Because confidence decays whether or not anyone writes it down, the expiry moves as the evidence does, and an attestation has nothing indefinite to inherit.
That changes the questions in the boardroom. “Was the programme up to date on 30 June?” stops being a matter of trust in a summary and becomes a record the board can read: what stood on that date, against which obligations, and what had already lapsed. “Is it up to date now?” gets its own answer: what stands today, and what expires before the next statement is due. No annual report answers that last question. A board that can read both can approve whichever statement is true for 30 June, including that the programme was not up to date, and can show what it has done since.
Frank does not replace the programme, the annual review, or the governing body’s judgement. It gives that judgement something to exercise itself on, so that when the signature is read back, it describes the state the programme was in on 30 June, not what the board happened to see on the day it met.
Before the vote
Two questions belong at the table. What shows the programme stood where the report says it stood on 30 June, rather than where it stands today? And what would visibly change, between this meeting and the next annual report, if the programme stopped being up to date in the meantime? Where the only artefact is a document that reads the same the day after a control fails as the day before, neither has an answer. The annual signature then measures the calendar rather than the programme, and the board ends up attesting that a review took place. That is not what the Act asks it to attest to.
You can read the current state of one scope before you ever put a name to it: what it covers, what it assumes, what has lapsed, and the date each claim stops being defensible. Start by seeing where you stand. There is no green tick in it for the board to take comfort from, only what the programme holds today and the date each part of that stops being true.