Document ID: chunk:federal_register_of_legislation:F2024C01109:reg:4:p25
Version: federal_register_of_legislation:F2024C01109
Segment Type: reg
Provision Reference: reg 4 (pt 25/34)
Character Range: 187800–190935

and
(e)        have in place adequate arrangements to ensure the Market Participant is able to comply with its obligations under the Act and these Rules in relation to the Critical Business Services the subject of an Outsourcing Arrangement including, without limitation, arrangements with the Service Provider to:
(i)         ensure the resilience, reliability, integrity and security of those Critical Business Services in accordance with Rule 8B.2.1; and
(ii)       ensure the confidentiality, integrity and availability of information obtained, held or used by the Market Participant in relation to those Critical Business Services in accordance with Part 8B.3 of these Rules; and
(iii)     deal with a Major Event in accordance with Part 8B.4 of these Rules; and
Note: Such arrangements may include, without limitation, requirements on the Service Provider to:
(a) protect technology from security breaches and cyber-incidents; and
(b) protect proprietary and client-related information and software; and
(c)  protect confidential, market-sensitive and personal information from intentional or inadvertent disclosure to unauthorised individuals; and
(d) establish, implement and maintain emergency procedures and a plan for disaster recovery with periodic testing of backup facilities.
(f)        ensure that the Market Participant and its auditors are able to promptly, upon request, access books, records and other information of the Service Provider relating to the Critical Business Services; and
(g)       ensure that ASIC has the same access to all books, records and other information relating to the Critical Business Services and maintained by the Service Provider, that ASIC would have if not for the Outsourcing Arrangement; and
(h)       ensure that for each Outsourcing Arrangement, the Market Participant's Board or a director or senior manager have confirmed that they have complied with the Market Participant's obligations in this subrule and made a written attestation to that effect.
(2) The Market Participant must comply with subrule (1) in a manner that is appropriate to:
(a)        the nature, complexity and risks of the Outsourcing Arrangement; and
(b)       the materiality of the Outsourcing Arrangement to the Market Participant's Participant Operations and Participant Services.
(3) In determining for the purposes of subrule (1) whether the Service Provider has the ability and capacity to provide the services covered by the Outsourcing Arrangement effectively, the Market Participant must take into account the extent to which the Service Provider is providing the same or similar services to other Market Participants.

Part 8B.3 Information security

8B.3.1 Information security
(1) A Market Participant must have adequate arrangements to ensure the confidentiality, integrity and availability of information obtained, held or used by the Market Participant in relation to its Participant Operations and Participant Services.
(2) Without limiting subrule (1), the arrangements referred to in that subrule must include:
(a)        arrangements to identify and document Information Assets that are