Critical information infrastructure

(1) The Director shall, by notice in the Gazette, designate certain systems as critical infrastructure.
(2) The Director shall designate a system as a critical infrastructure if a disruption of the system would result in —
the interruption of a life sustaining service including the supply of water, health services and energy;
(b) an adverse effect on the economy of the Republic;
(c) an event that would result in massive casualties or fatalities;
(d) failure or substantial disruption of the money market of the Republic; and
(e) adverse and severe effect of the security of the Republic including intelligence and military services.
(3) The Director shall, within a reasonable time of designating a system as critical infrastructure, inform the owner or operator of the system the reasons for the designation of the system as a critical infrastructure.
(4) The Director shall, within a reasonable time of the declaration of any information infrastructure, or category or class of information infrastructure or any part thereof, as a critical information infrastructure, in line with a critical infrastructure framework issue directives to regulate —
(a) the classification of data held by the critical information infrastructure;
(b) the protection of, the storing of and archiving of data held by the critical information infrastructure;
(c) cyber security incident management by the critical information infrastructure;
(d) disaster contingency and recovery measures, which must be put in place by the critical information infrastructure;
(e) minimum physical and technical security measures that must be implemented in order to protect the critical information infrastructure;
(f) the period within which the owner, or person in control of a critical information infrastructure must comply with the directives; and
(g) any other relevant matter which is necessary or expedient in order to promote cyber security in respect of the critical information infrastructure.