Sources only, no notice
Every source this assessment relies on is a public legal instrument or a public parliamentary record. No finding is adverse to any party: the assessment observes what instruments say and do not say. No notice was served before publication, and nothing in the document is a matter a party could correct from information this practice does not already hold.
The invitation stands in its place, and it does not expire. Any party who considers a passage misread — a provision, a submission, a report, or its own published material — is invited to say so at any time. Any correction received will be recorded, and where it bears on a finding it will be published, together with what the document said before it. The practice's notice protocol is unchanged and continues to apply to assessments carrying adverse findings about identifiable parties from register data.
What the claims rest on
Every claim carries a species, so a reader can see at a glance what kind of evidence it rests on. A quotation is the strongest; a nil return from a closed statutory list is next; a nil return from a document that does not purport to be exhaustive is weaker and is labelled at each use; an inference across provisions is stated as an inference at the point it is made.
Sources, with hashes
Pins are referenced, not moved. The archived blobs live in the companion scoping case, whose manifest is the register of record. Its own SHA-256 is published here so the whole chain is checkable: 8cf52fa8687c3fb6a49065c912185193b712c427d20d44df5fc919cdffa93bd3 over 22 rows, of which the 12 below are relied on by this assessment. The remaining 10 were set aside as off-spine and carry no assertion in this document.
| Ref | Source | URL | Retrieved (UTC) | Artefact | SHA-256 |
|---|---|---|---|---|---|
| L-HCF-1 | Hosting Certification Framework - Framework page. Zero occurrences of FOCI, model clause, ClauseBank, BuyICT, compel, foreign | https://www.hostingcertification.gov.au/framework | 2026-08-11T08:01:24Z | Web page (raw HTML body) | 392c48af4165878add31536228a0970966355d3f0068ed836598de6470a6a812 |
| L-HCF-2 | Hosting Certification Framework - home page. Same nil return on all six terms | https://www.hostingcertification.gov.au/ | 2026-08-11T08:01:24Z | Web page (raw HTML body) | 9a79df3cff16b1e44a4f70972eb315a9be804729cfe0fdb4da80c65ea55215ec |
| L-SOCI-1 | Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023, compilation in force 10 June 2026 - operative text | https://www.legislation.gov.au/F2023L00112/2026-06-10/2026-06-10/text/original/epub/OEBPS/document_1/document_1.html | 2026-08-11T08:13:14Z | Web page (raw HTML body) | fe8ce29ec7bd06a43faf37cf5d4d7e5113d28231c4e01cd0ed94c230eb54bba4 |
| L-SOCI-2 | Security of Critical Infrastructure Act 2018, Compilation No. 9, compilation date 4 June 2026, includes amendments Act No. 75 2025 - operative text | https://www.legislation.gov.au/C2018A00029/2026-06-04/2026-06-04/text/1/epub/OEBPS/document_1/document_1.html | 2026-08-11T08:25:02Z | Web page (raw HTML body) | f6a8dd06cbdeb355bf79b3ee800f26607ebdf213a18f1ba82184f79748cc6f18 |
| L-HCF-3 | Hosting Certification Framework - March 2021 v2, the operative framework document, 30 pages. Predates the insertion of SOCI s30AB by Act No 33 of 2022 | https://www.hostingcertification.gov.au/sites/default/files/2021-11/Hosting%20Certification%20Framework%20-%20March%202021.v2.pdf | 2026-08-11T08:32:31Z | Web page (raw HTML body) | 7b654f6e435bb90560701bf5e4905538f2da0cae73157ab4d58e710045855070 |
| L-EM-1 | Explanatory Memorandum, Security Legislation Amendment (Critical Infrastructure Protection) Bill 2022 (Bill r6833) as introduced, 147 pages - paras 141-146 explain SOCI s30AB(4) | https://parlinfo.aph.gov.au/parlInfo/download/legislation/ems/r6833_ems_e948a334-98d0-4960-860d-f1d9622b2d53/upload_pdf/JC004947.pdf | 2026-08-11T08:40:04Z | Web page (raw HTML body) | d78dd825f9cdd0e49f1da5beed6c4c8ab5eb533bde3c2bf8ce0cb868af9dae0c |
| L-PJCIS-1 | PJCIS, Advisory report on the Security Legislation Amendment (Critical Infrastructure) Bill 2020 and Statutory Review of the SOCI Act 2018, September 2021, ISBN 978-1-76092-296-2, 99 pages - the report the EM cites for recommendation 7 and paragraph 3.49 | https://parlinfo.aph.gov.au/parlInfo/download/committees/reportjnt/024715/toc_pdf/AdvisoryreportontheSecurityLegislationAmendment(CriticalInfrastructure)Bill2020andStatutoryReviewoftheSecurityofCriticalInfrastructureAct2018.pdf | 2026-08-11T08:47:00Z | Web page (raw HTML body) | 7ee48c871801e73fda8720471aa62914cdbc2ae36f14c930ffca0a47f879721c |
| L-PJCIS-2 | PJCIS, Advisory report on the Security Legislation Amendment (Critical Infrastructure Protection) Bill 2022, 103 pages - the inquiry into the Bill that inserted s30AB(4) | https://parlinfo.aph.gov.au/parlInfo/download/committees/reportjnt/024898/toc_pdf/AdvisoryreportontheSecurityLegislationAmendment(CriticalInfrastructureProtection)Bill2022.pdf | 2026-08-11T08:49:06Z | Web page (raw HTML body) | bb3dd022861e009cb5d58b6963bbcc5c15f8257db10a0385017b0dcac878ce0e |
| L-SUB-5 | PJCIS SLACIP Bill 2022 inquiry, Submission 5, listed as "macquarie Telecom Group", dated 24 February 2022, 11 pages. Sections 4 and 5 address the proposed s30AB(4) HCF exemption | https://www.aph.gov.au/DocumentStore.ashx?id=e5b33216-c7d1-408e-b7bc-920787df7ef9&subId=720407 | 2026-08-11T08:54:33Z | Web page (raw HTML body) | 6cd812b83afa84b42ab8f12f0906b7040159806b07cc21047632a0076a596a17 |
| L-SUB-12 | PJCIS SLACIP Bill 2022 inquiry, Submission 12, UNSW Allens Hub for Technology, Law and Innovation, dated 1 March 2022, 7 pages. Contains no reference to the hosting certification framework | https://www.aph.gov.au/DocumentStore.ashx?id=66cf127e-2c40-46c9-885f-cb08d2c82ed1&subId=720494 | 2026-08-11T08:54:36Z | Web page (raw HTML body) | 9c55cd3c6ff1b45abcd92b9a495772471000507157f83443165569464416e8c3 |
| L-MAQ-1 | Australian Business Register, ABN Lookup historical details for ABN 72 056 712 228 - entity name history: MACQUARIE TECHNOLOGY GROUP LIMITED from 31 May 2023 (current), MACQUARIE TELECOM GROUP LIMITED 09 Dec 2004 to 31 May 2023 | https://abr.business.gov.au/AbnHistory/View?abn=72056712228 | 2026-08-11T10:46:45Z | Web page (raw HTML body) | f20b28a818d1d4f540dad3430759a3ac0397e9937f4242f2c8d006d6e221569a |
| L-HUB-1 | UNSW Allens Hub for Technology, Law and Innovation, home page - states the Hub operated from 1 November 2017 until 1 June 2024 | https://allenshub.unsw.edu.au/ | 2026-08-11T10:46:45Z | Web page (raw HTML body) | ee02dc67782a657ea0464b464cc054be0cd1d88f30de31524cbabe8daaa5bddb |
How this was checked
| Step | What it guards against |
|---|---|
| Pre-insertion audit | No sentence entered the document until its assertions were verified against the pinned sources, working from the blobs rather than from the drafting notes, which share the drafter's blind spot. |
| Page images | Two quotations span a page break in their source. Both were read as rendered page images, because an extracted text layer is no authority for where a sentence breaks. |
| No ellipses | A quotation that elides a qualification is a misquotation. This document contains no ellipsis: where a source qualifies a proposition relied on, the qualification is quoted with it. |
| Guard placement | A limit on how a quotation may be read sits before the quotation, never after. Checked mechanically against a declared list. |
| Adversity audit | Every sentence naming a party classified adverse, neutral or favourable before publication. The adverse column is empty. |
| Counts recomputed | Every stated count was recomputed from its source at freeze, not grepped for. |
| Freeze gate | The rebuilt PDF, the committed PDF, the hash on this page and the attestation record must be identical, and the build epoch must resolve to the date it claims. |
What this assessment cannot establish
No report made under Part 2AA of the Security of Critical Infrastructure Act 2018 has been read, and none can be from public sources. This assessment compares what instruments require. It does not, and cannot, compare what is done. Every observation is as at the capture dates in the register above. A source that has changed since its capture has not made the observation wrong; it has made it historical, and this practice would record that.
Assessment PDF
The attested assessment is the signed PDF. Its SHA-256 is published below.