48.—(1) The Minister may make regulations for carrying out the purposes and provisions of this Act.
(2) Without limiting subsection (1), the Minister may make regulations for or with respect to all or any of the following matters:
(a)
the procedure for the designation of a critical information infrastructure;
(b)
the technical or other standards relating to cybersecurity to be maintained in respect of a critical information infrastructure;
(c)
the responsibilities and duties of the owner of a critical information infrastructure;
(d)
the type of changes that are considered material changes to the design, configuration, security or operations of a critical information infrastructure to be reported by the owner of the critical information infrastructure;
(e)
the type of cybersecurity incidents in respect of a critical information infrastructure that are required to be reported by the owner of the critical information infrastructure;
(f)
the requirements for, and the manner for the carrying out of, cybersecurity audits and cybersecurity risk assessments required to be conducted by the owner of a critical information infrastructure;
(g)
the form and nature of cybersecurity exercises that may be conducted;
(h)
the class or classes of licence to be issued, and the requirements for the grant or renewal of the licence;
(i)
the conduct of licensees in carrying on their business;
(j)
the fees to be paid in respect of any matter or thing required for the purposes of this Act, including the refund and remission (in whole or part) of such fees;
(k)
all matters and things which by this Act are required or permitted to be prescribed or which are necessary or expedient to be prescribed to give effect to this Act.
(3) Except as otherwise expressly provided in this Act, the regulations —
(a)
may be of general or specific application;
(b)
may provide that any contravention of any specified provision of the regulations shall be an offence; and
(c)
may provide for penalties not exceeding a fine of $50,000 or imprisonment for a term not exceeding 12 months or both for each offence and, in the case of a continuing offence, a further penalty not exceeding a fine of 10% of the maximum fine prescribed for that offence for every day or part of a day during which the offence continues after conviction.