BSA filed comments responding to the Department of Home Affairs’ (DHA) consultation on streamlining and modernizing the Security of Critical Infrastructure Act 2018. BSA recommended, among other things, that DHA expressly exclude Software-as-a-Service from the proposed new capture pathways for data storage and processing assets, narrowly scope key terms such as “materially uncontrolled” and “relevant operator”, and ensure that obligations are limited to matters that are within an entity’s role, knowledge, and practical control.