On receipt of a notice referred to in section 20(2), the person in control of a critical infrastructure must, subject to subsection (4), take such steps as may be prescribed to secure such critical infrastructure at that person’s own expense.
