Optus, Telstra and other major telco boards will be required to sign off on a new or updated cyber risk management program every year or face hundreds of thousands of dollars in penalties.

The changes are part of new laws to be introduced by Home Affairs Minister Clare O’Neil that classify telecommunications as “critical infrastructure” for the first time, requiring company boards to comply with strict rules that already cover hospitals, utilities, ports and energy generation assets.