Rule Change: Completed
Overview
On 12 December 2024, the AEMC published a final determination and final rule to confirm and clarify the Australian Energy Market Operator’s (AEMO) cyber security role in the National Electricity Rules (NER). This enables AEMO and the energy industry to better prepare for and respond to potential cyber security incidents.
The final rule clarifies AEMO’s role in protecting the National Electricity Market (NEM) against cyber security incidents. The final rule:
- explicitly includes cyber security preparedness and response as one of AEMO’s power system security responsibilities in Chapter 4 of the NER
- establishes four functions that AEMO will perform to meet its cyber security responsibilities.
AEMO’s cyber security functions include:
- coordinating a NEM cyber incident response plan
- supporting industry preparedness and uplift
- evaluating risks and providing advice to government and industry
- distributing critical cyber security information to industry participants.
These four functions complement AEMO's existing powers to respond to an actual cyber security incident, for example by issuing power system security directions. They focus on preventing cyber incidents and preparing the industry to respond if an incident does occur. The cyber security functions are facilitative and flexible and do not enable AEMO to impose new obligations on market participants.
Commencement
The final rule commences on publication of this determination on 12 December 2024.
Rule change request
In May 2024, the AEMC received a rule change request from the Honourable Chris Bowen MP, Minister for Climate Change and Energy, seeking to clarify AEMO’s cyber security role in the NER. We published a consultation paper for this rule change request on 20 June 2024, and a draft determination and rule on 26 September 2024.