Document ID: chunk:federal_register_of_legislation:F2024C01258:schedule:2:p2
Version: federal_register_of_legislation:F2024C01258
Segment Type: schedule
Provision Reference: sch 2 (pt 2/6)
Character Range: 348382–351252

environment; or
 (b) where no such material changes occur—at least annually.

1.4  Step 2—Define the boundaries of the CDR data environment
 (1) An accredited data recipient must assess, define and document the boundaries of its CDR data environment.
 (2) The accredited data recipient must review the boundaries of its CDR data environment for completeness and accuracy:
 (a) as soon as practicable when it becomes aware of material changes to the extent and nature of threats to its CDR data environment; or
 (b) where no such material changes occur—at least annually.

1.5  Step 3—Have and maintain an information security capability
 (1) The accredited data recipient must have and maintain an information security capability that:
 (a) complies with the applicable information security controls specified in Part 2 of this Schedule; and
 (b) is appropriate and adapted to respond to risks to information security, having regard to:
 (i) the extent and nature of threats to CDR data that it holds; and
 (ii) the extent and nature of CDR data that it holds; and
 (iii) the potential loss or damage to one or more CDR consumers if all or part of the consumer's data were to be:
 (A) misused, interfered with or lost; or
 (B) accessed, modified or disclosed without authorisation.
 (2) The accredited data recipient must review and adjust its information security capability:
 (a) in response to material changes to both the nature and extent of threats and its CDR data environment; or
 (b) where no such material changes occur—at least annually.

1.6  Step 4—Implement a formal controls assessment program
 (1) An accredited data recipient must establish and implement a testing program to review and assess the effectiveness of its information security capability which:
 (a) is appropriate having regard to the factors set out in paragraph 1.5(1)(b); and
 (b) requires testing at a frequency, and to an extent, that is appropriate having regard to:
 (i) the rate at which vulnerabilities and threats change; and
 (ii) material changes to the boundaries of its CDR data environment; and
 (iii) the likelihood of failure of controls having regard to the results of previous testing.
 (2) The accredited data recipient must monitor and evaluate the design, implementation and operating effectiveness of its security controls relating to the management of CDR data in accordance with its obligations under Part IVD of the Act and these rules, and having regard to the information security controls in Part 2 of this Schedule.
 (3) The accredited data recipient must escalate and report to senior management the results of any testing that identifies design, implementation or operational deficiencies in information security controls relevant to its CDR data environment.
 (4) The accredited data recipient must ensure that testing is conducted by appropriately skilled